aboutsummaryrefslogtreecommitdiffstats
path: root/python_moonclient/python_moonclient/core
diff options
context:
space:
mode:
Diffstat (limited to 'python_moonclient/python_moonclient/core')
-rw-r--r--python_moonclient/python_moonclient/core/__init__.py0
-rw-r--r--python_moonclient/python_moonclient/core/authz.py180
-rw-r--r--python_moonclient/python_moonclient/core/check_tools.py458
-rw-r--r--python_moonclient/python_moonclient/core/cli_exceptions.py4
-rw-r--r--python_moonclient/python_moonclient/core/config.py64
-rw-r--r--python_moonclient/python_moonclient/core/json_export.py26
-rw-r--r--python_moonclient/python_moonclient/core/json_import.py29
-rw-r--r--python_moonclient/python_moonclient/core/models.py279
-rw-r--r--python_moonclient/python_moonclient/core/pdp.py194
-rw-r--r--python_moonclient/python_moonclient/core/policies.py673
-rw-r--r--python_moonclient/python_moonclient/core/slaves.py59
11 files changed, 0 insertions, 1966 deletions
diff --git a/python_moonclient/python_moonclient/core/__init__.py b/python_moonclient/python_moonclient/core/__init__.py
deleted file mode 100644
index e69de29b..00000000
--- a/python_moonclient/python_moonclient/core/__init__.py
+++ /dev/null
diff --git a/python_moonclient/python_moonclient/core/authz.py b/python_moonclient/python_moonclient/core/authz.py
deleted file mode 100644
index d331004c..00000000
--- a/python_moonclient/python_moonclient/core/authz.py
+++ /dev/null
@@ -1,180 +0,0 @@
-from uuid import uuid4
-import copy
-import logging
-import threading
-import time
-import json
-import random
-import requests
-
-HOST_MANAGER = None
-PORT_MANAGER = None
-HOST_KEYSTONE = None
-PORT_KEYSTONE = None
-
-LOCK = threading.Lock()
-LOGGER = logging.getLogger("moonclient.core.authz")
-
-
-def _construct_payload(creds, current_rule, enforcer, target):
- # Convert instances of object() in target temporarily to
- # empty dict to avoid circular reference detection
- # errors in jsonutils.dumps().
- temp_target = copy.deepcopy(target)
- for key in target.keys():
- element = target.get(key)
- if type(element) is object:
- temp_target[key] = {}
- _data = _json = None
- if enforcer:
- _data = {'rule': current_rule,
- 'target': json.dumps(temp_target),
- 'credentials': json.dumps(creds)}
- else:
- _json = {'rule': current_rule,
- 'target': temp_target,
- 'credentials': creds}
- return _data, _json
-
-
-def _send(url, data=None, stress_test=False):
- current_request = dict()
- current_request['url'] = url
- try:
- if stress_test:
- current_request['start'] = time.time()
- # with LOCK:
- res = requests.get(url)
- current_request['end'] = time.time()
- current_request['delta'] = current_request["end"] - current_request["start"]
- else:
- with LOCK:
- current_request['start'] = time.time()
- if data:
- data, _ = _construct_payload(data['credentials'], data['rule'], True,
- data['target'])
- res = requests.post(url, json=data,
- headers={'content-type': "application/x-www-form-urlencode"}
- )
- else:
- res = requests.get(url)
- current_request['end'] = time.time()
- current_request['delta'] = current_request["end"] - current_request["start"]
- except requests.exceptions.ConnectionError:
- LOGGER.warning("Unable to connect to server")
- return {}
- if not stress_test:
- try:
- j = res.json()
- if res.status_code == 200:
- LOGGER.warning("\033[1m{}\033[m \033[32mGrant\033[m".format(url))
- elif res.status_code == 401:
- LOGGER.warning("\033[1m{}\033[m \033[31mDeny\033[m".format(url))
- else:
- LOGGER.error("\033[1m{}\033[m {} {}".format(url, res.status_code, res.text))
- except Exception as e:
- if res.text == "True":
- LOGGER.warning("\033[1m{}\033[m \033[32mGrant\033[m".format(url))
- elif res.text == "False":
- LOGGER.warning("\033[1m{}\033[m \033[31mDeny\033[m".format(url))
- else:
- LOGGER.error("\033[1m{}\033[m {} {}".format(url, res.status_code, res.text))
- LOGGER.exception(e)
- LOGGER.error(res.text)
- else:
- if j.get("result"):
- # logger.warning("{} \033[32m{}\033[m".format(url, j.get("result")))
- LOGGER.debug("{}".format(j.get("error", "")))
- current_request['result'] = "Grant"
- else:
- # logger.warning("{} \033[31m{}\033[m".format(url, "Deny"))
- LOGGER.debug("{}".format(j))
- current_request['result'] = "Deny"
- return current_request
-
-
-class AsyncGet(threading.Thread):
-
- def __init__(self, url, semaphore=None, **kwargs):
- threading.Thread.__init__(self)
- self.url = url
- self.kwargs = kwargs
- self.sema = semaphore
- self.result = dict()
- self.uuid = uuid4().hex
- self.index = kwargs.get("index", 0)
-
- def run(self):
- self.result = _send(self.url,
- data=self.kwargs.get("data"),
- stress_test=self.kwargs.get("stress_test", False))
- self.result['index'] = self.index
-
-
-def send_requests(scenario, authz_host, authz_port, keystone_project_id, request_second=1,
- limit=500,
- dry_run=None, stress_test=False, destination="wrapper"):
- backgrounds = []
- time_data = list()
- start_timing = time.time()
- request_cpt = 0
- subjects = tuple(scenario.subjects.keys())
- objects = tuple(scenario.objects.keys())
- actions = tuple(scenario.actions.keys())
- while request_cpt < limit:
- rule = (random.choice(subjects), random.choice(objects), random.choice(actions))
- if destination.lower() == "wrapper":
- url = "http://{}:{}/authz/oslo".format(authz_host, authz_port)
- data = {
- 'target': {
- "user_id": random.choice(subjects),
- "target": {
- "name": random.choice(objects)
- },
- "project_id": keystone_project_id
- },
- 'credentials': None,
- 'rule': random.choice(actions)
- }
- else:
- url = "http://{}:{}/authz/{}/{}".format(authz_host, authz_port, keystone_project_id,
- "/".join(rule))
- data = None
- if dry_run:
- LOGGER.info(url)
- continue
- request_cpt += 1
- if stress_test:
- time_data.append(copy.deepcopy(_send(url, stress_test=stress_test)))
- else:
- background = AsyncGet(url, stress_test=stress_test, data=data,
- index=request_cpt)
- backgrounds.append(background)
- background.start()
- if request_second > 0:
- if request_cpt % request_second == 0:
- if time.time() - start_timing < 1:
- while True:
- if time.time() - start_timing > 1:
- break
- start_timing = time.time()
- if not stress_test:
- for background in backgrounds:
- background.join()
- if background.result:
- time_data.append(copy.deepcopy(background.result))
- return time_data
-
-
-def save_data(filename, time_data):
- json.dump(time_data, open(filename, "w"))
-
-
-def get_delta(time_data):
- time_delta = list()
- time_delta_sum1 = 0
- for item in time_data:
- time_delta.append(item['delta'])
- time_delta_sum1 += item['delta']
- time_delta_average1 = time_delta_sum1 / len(time_data)
- return time_delta, time_delta_average1
diff --git a/python_moonclient/python_moonclient/core/check_tools.py b/python_moonclient/python_moonclient/core/check_tools.py
deleted file mode 100644
index 381e92c7..00000000
--- a/python_moonclient/python_moonclient/core/check_tools.py
+++ /dev/null
@@ -1,458 +0,0 @@
-from python_moonclient.core.cli_exceptions import MoonCliException
-
-
-def check_optionnal_result(result):
- if type(result) is not dict:
- raise MoonCliException("Unexpected request result. It should be a dictionnary")
- if "result" in result:
- check_result(result)
-
-
-def check_result(result):
- if type(result) is not dict or "result" not in result:
- raise MoonCliException(
- "Unexpected request result. It should be a dictionnary with a 'result' entry")
- if result["result"] is None:
- raise MoonCliException("Unexpected request result. The 'result' entry shall not be null")
-
-
-def _check_generic_in_result(field, result, check_not_null=False):
- if type(field) is not str or type(result) is not dict or field not in result:
- raise MoonCliException(
- "Unexpected request result. It should be a dictionnary with a '{}' entry".format(field))
- if check_not_null is True and result[field] is None:
- raise MoonCliException(
- "Unexpected request result. The '{}' entry shall not be null".format(field))
-
-
-def check_slaves_in_result(result):
- _check_generic_in_result("slaves", result)
-
-
-def check_pdp_in_result(result):
- _check_generic_in_result("pdps", result)
-
-
-def check_model_in_result(result, check_not_null=False):
- _check_generic_in_result("models", result)
- if check_not_null is True and result["models"] is None:
- raise MoonCliException("Unexpected request result. The 'models' entry shall not be null")
-
-
-def check_meta_rule_in_result(result):
- _check_generic_in_result("meta_rules", result)
-
-
-def check_rule_in_result(result):
- _check_generic_in_result("rules", result)
-
-
-def check_subject_in_result(result):
- _check_generic_in_result("subjects", result)
-
-
-def check_subject_category_in_result(result):
- _check_generic_in_result("subject_categories", result)
-
-
-def check_object_category_in_result(result):
- _check_generic_in_result("object_categories", result)
-
-
-def check_action_category_in_result(result):
- _check_generic_in_result("action_categories", result)
-
-
-def check_policy_in_result(result):
- _check_generic_in_result("policies", result)
-
-
-def check_object_in_result(result):
- _check_generic_in_result("objects", result)
-
-
-def check_action_in_result(result):
- _check_generic_in_result("actions", result)
-
-
-def check_subject_assignment_in_result(result):
- _check_generic_in_result("subject_assignments", result, True)
-
-
-def check_object_assignment_in_result(result):
- _check_generic_in_result("object_assignments", result, True)
-
-
-def check_action_assignment_in_result(result):
- _check_generic_in_result("action_assignments", result, True)
-
-
-def check_pdp_id(pdp_id, result):
- check_pdp_in_result(result)
- if pdp_id not in result['pdps']:
- raise MoonCliException("Unexpected request result. Unknown pdp id")
-
-
-def _check_generic_name(field, name, field_elt_id, result, do_check_name=True):
- if type(field) is str:
- if result[field] is None:
- raise MoonCliException(
- "Unexpected request result : {} shall not be empty".format(field))
- if field_elt_id not in result[field]:
- raise MoonCliException("Unexpected request result. Unknown {} id".format(field))
- if "name" not in result[field][field_elt_id]:
- raise MoonCliException(
- "Unexpected request result : {} with id {} has no name".format(field, field_elt_id))
- if do_check_name and name != result[field][field_elt_id]["name"]:
- raise MoonCliException(
- "Unexpected request result : {} with id {} has a bad name. Expected {}".format(
- field, field_elt_id, name))
-
-
-def check_model_name(name, model_id, result, do_check_name):
- _check_generic_name("models", name, model_id, result, do_check_name)
-
-
-def check_pdp_name(name, pdp_id, result):
- _check_generic_name("pdps", name, pdp_id, result)
-
-
-def check_subject_categories_name(name, category_id, result):
- _check_generic_name("subject_categories", name, category_id, result)
-
-
-def check_object_categories_name(name, category_id, result):
- _check_generic_name("object_categories", name, category_id, result)
-
-
-def check_action_categories_name(name, category_id, result):
- _check_generic_name("action_categories", name, category_id, result)
-
-
-def check_meta_rules_name(name, meta_rule_id, result):
- _check_generic_name("meta_rules", name, meta_rule_id, result, False)
-
-
-def check_policy_name(name, policy_id, result):
- _check_generic_name("policies", name, policy_id, result)
-
-
-def check_subject_name(name, subject_id, result):
- _check_generic_name("subjects", name, subject_id, result)
-
-
-def check_object_name(name, object_id, result):
- _check_generic_name("objects", name, object_id, result)
-
-
-def check_action_name(name, action_id, result):
- _check_generic_name("actions", name, action_id, result)
-
-
-def check_scat_id_in_dict(scat_id, in_dict):
- if scat_id not in in_dict:
- raise MoonCliException("Unexpected request result. Subject category not in result")
-
-
-def check_ocat_id_in_dict(ocat_id, in_dict):
- if ocat_id not in in_dict:
- raise MoonCliException("Unexpected request result. Object category not in result")
-
-
-def check_acat_id_in_dict(acat_id, in_dict):
- if acat_id not in in_dict:
- raise MoonCliException("Unexpected request result. Action category not in result")
-
-
-def check_policy_id_in_pipeline(policy_id, pipeline):
- if policy_id not in pipeline:
- raise MoonCliException(
- "Unexpected request result. The policy id {} shall be in the pipeline".format(
- policy_id))
-
-
-def _check_generic_policy_in_dict(field, policy_id, in_dict):
- if type(field) is str:
- if policy_id is not None:
- if "policy_list" not in in_dict:
- raise MoonCliException(
- "Unexpected request result. The policy list of the {} shall not be empty".format(
- field))
- if policy_id not in in_dict["policy_list"]:
- raise MoonCliException(
- "Unexpected request result. The policy with id {} shall be in the {}".format(
- policy_id, field))
-
-
-def check_subject_policy(policy_id, in_dict):
- _check_generic_policy_in_dict("subject", policy_id, in_dict)
-
-
-def check_object_policy(policy_id, in_dict):
- _check_generic_policy_in_dict("object", policy_id, in_dict)
-
-
-def check_action_policy(policy_id, in_dict):
- _check_generic_policy_in_dict("action", policy_id, in_dict)
-
-
-def _check_generic_elt_id(field1, field1_id, field2, field2_id, result):
- if type(field1) is str and type(field2) is str:
- if result[field1] is None:
- raise MoonCliException(
- "Unexpected request result: {} shall not be empty".format(field1))
- if field1_id not in result[field1]:
- raise MoonCliException("Unexpected request result. Unknown {} with id".format(field1))
- if field2 not in result[field1][field1_id]:
- raise MoonCliException(
- "Unexpected request result. {} element with id {} has no {} field".format(field1,
- field1_id,
- field2))
- if field2_id != result[field1][field1_id][field2]:
- raise MoonCliException(
- "Unexpected request result. {} element with id {} has a bad {} id. Expected {}".format(
- field1, field1_id, field2, field2_id))
-
-
-def check_policy_model_id(model_id, policy_id, result):
- _check_generic_elt_id("policies", policy_id, "model_id", model_id, result)
-
-
-def check_pdp_project_id(project_id, pdp_id, result):
- _check_generic_elt_id("pdps", pdp_id, "keystone_project_id", project_id, result)
-
-
-def check_subject_description(description, in_dict):
- if description is not None:
- if "description" not in in_dict:
- raise MoonCliException(
- "Unexpected request result. The description of the subject shall not be empty")
- if description not in in_dict["description"]:
- raise MoonCliException(
- "Unexpected request result. The description {} shall be in the subject".format(
- description))
-
-
-def check_meta_rules_list_in_model(meta_rule_list, model_id, result):
- if result["models"] is None:
- raise MoonCliException("Unexpected request result. results shall not be empty")
- if model_id not in result['models']:
- raise MoonCliException("Unexpected request result. Unknown Model id")
- if "meta_rules" not in result['models'][model_id]:
- raise MoonCliException(
- "Unexpected request result. Meta rules related to model with id {} are empty".format(
- model_id))
- if meta_rule_list != result['models'][model_id]["meta_rules"]:
- raise MoonCliException(
- "Unexpected request result. Meta rule of model with id {} are different from those expected".format(
- model_id))
-
-
-def check_name_in_slaves(name, slaves):
- if name is None:
- raise MoonCliException("The slave name must be provided !")
- names = map(lambda x: x['name'], slaves)
- if name not in names:
- raise MoonCliException("The slave '{}' was not found !".format(name))
-
-
-def _check_generic_data_data(field, result):
- if type(field) is str:
- if field not in result:
- raise MoonCliException(
- "Unexpected request result. The {} field shall be in result".format(field))
- # if "data" not in resulti[field]:
- # raise MoonCliException("Unexpected request result. The data field shall be in result['{}']".format(field))
-
-
-def _check_id_in_generic_data_data(field, data_id, result):
- if type(field) is str:
- _check_generic_data_data(field, result)
- for _data in result[field]:
- if data_id not in list(_data['data'].keys()):
- raise MoonCliException(
- "Unexpected request result. Data id {} not in {}".format(data_id, field))
-
-
-def _check_id_not_in_generic_data_data(field, data_id, result):
- if type(field) is str:
- _check_generic_data_data(field, result)
- for _data in result[field]:
- if data_id in list(_data['data'].keys()):
- raise MoonCliException(
- "Unexpected request result. Data id {} shall not be in {}".format(data_id,
- field))
-
-
-def _check_category_in_generic_data_data(field, category_id, result):
- _check_generic_data_data(field, result)
- for _data in result[field]:
- if category_id != _data["category_id"]:
- raise MoonCliException(
- "Unexpected request result. Category id {} not in {} data".format(category_id,
- field))
-
-
-def check_subject_data_data(result):
- _check_generic_data_data("subject_data", result)
-
-
-def check_id_in_subject_data_data(data_id, result):
- _check_id_in_generic_data_data("subject_data", data_id, result)
-
-
-def check_id_not_in_subject_data_data(data_id, result):
- _check_id_not_in_generic_data_data("subject_data", data_id, result)
-
-
-def check_category_id_in_subject_data_data(category_id, result):
- _check_category_in_generic_data_data('subject_data', category_id, result)
-
-
-def check_object_data_data(result):
- _check_generic_data_data("object_data", result)
-
-
-def check_id_in_object_data_data(data_id, result):
- _check_id_in_generic_data_data("object_data", data_id, result)
-
-
-def check_id_not_in_object_data_data(data_id, result):
- _check_id_not_in_generic_data_data("object_data", data_id, result)
-
-
-def check_category_id_in_object_data_data(category_id, result):
- _check_category_in_generic_data_data('object_data', category_id, result)
-
-
-def check_action_data_data(result):
- _check_generic_data_data("action_data", result)
-
-
-def check_id_in_action_data_data(data_id, result):
- _check_id_in_generic_data_data("action_data", data_id, result)
-
-
-def check_id_not_in_action_data_data(data_id, result):
- _check_id_not_in_generic_data_data("action_data", data_id, result)
-
-
-def check_category_id_in_action_data_data(category_id, result):
- _check_category_in_generic_data_data('action_data', category_id, result)
-
-
-def _check_generic_assignments(field, field_id_name, field_id, field_cat_id, field_data_id, result):
- if type(field) is str and type(field_id_name) is str:
- for key in result[field]:
- if field_id_name not in result[field][key]:
- raise MoonCliException(
- "Unexpected request result. subject_id not in result[{}] data".format(field))
- if "category_id" not in result[field][key]:
- raise MoonCliException(
- "Unexpected request result. category_id not in result[{}] data".format(field))
- if "assignments" not in result[field][key]:
- raise MoonCliException(
- "Unexpected request result. assignments not in result[{}] data".format(field))
- if result[field][key][field_id_name] == field_id and \
- result[field][key]["category_id"] == field_cat_id:
- if field_data_id not in result[field][key]["assignments"]:
- raise MoonCliException(
- "Unexpected request result. {} data with id {} not in result[{}][]['assignements'] data".format(
- field, field_data_id, field))
-
-
-def check_subject_assignements(subject_id, subject_act_id, subject_data_id, result):
- _check_generic_assignments("subject_assignments", "subject_id", subject_id, subject_act_id,
- subject_data_id, result)
-
-
-def check_object_assignements(object_id, object_act_id, object_data_id, result):
- _check_generic_assignments("object_assignments", "object_id", object_id, object_act_id,
- object_data_id, result)
-
-
-def check_action_assignements(action_id, action_act_id, action_data_id, result):
- _check_generic_assignments("action_assignments", "action_id", action_id, action_act_id,
- action_data_id, result)
-
-
-def _check_not_generic_assignments(field, field_id_name, field_id, field_cat_id, field_data_id,
- result):
- if type(field) is str and type(field_id_name) is str:
- for key in result[field]:
- if field_id_name not in result[field][key]:
- raise MoonCliException(
- "Unexpected request result. subject_id not in result[{}] data".format(field))
- if "category_id" not in result[field][key]:
- raise MoonCliException(
- "Unexpected request result. category_id not in result[{}] data".format(field))
- if "assignments" not in result[field][key]:
- raise MoonCliException(
- "Unexpected request result. assignments not in result[{}] data".format(field))
- if result[field][key]['subject_id'] == field_id and \
- result[field][key]["category_id"] == field_cat_id:
- if field_data_id in result[field][key]["assignments"]:
- raise MoonCliException(
- "Unexpected request result. {} data with id {} shall not be in result[{}][]['assignements'] data".format(
- field, field_data_id, field))
-
-
-def check_not_subject_assignements(subject_id, subject_act_id, subject_data_id, result):
- _check_not_generic_assignments("subject_assignments", "subject_id", subject_id, subject_act_id,
- subject_data_id, result)
-
-
-def check_not_object_assignements(object_id, object_act_id, object_data_id, result):
- _check_not_generic_assignments("object_assignments", "object_id", object_id, object_act_id,
- object_data_id, result)
-
-
-def check_not_action_assignements(action_id, action_act_id, action_data_id, result):
- _check_not_generic_assignments("action_assignments", "action_id", action_id, action_act_id,
- action_data_id, result)
-
-
-def check_policy_id_in_dict(policy_id, in_dict):
- if "policy_id" not in in_dict:
- raise MoonCliException("Unexpected request result. policy_id not in result")
- if policy_id != in_dict["policy_id"]:
- raise MoonCliException(
- "Unexpected request result. Bad policy id in result, expected {}".format(policy_id))
-
-
-def check_meta_rule_id_in_dict(meta_rule_id, in_dict):
- if "meta_rule_id" not in in_dict:
- raise MoonCliException("Unexpected request result. meta_rule_id not in result")
- if meta_rule_id != in_dict["meta_rule_id"]:
- raise MoonCliException(
- "Unexpected request result. Bad meta rule id in result, expected {}".format(
- meta_rule_id))
-
-
-def check_rule_in_dict(rule, in_dict):
- if "rule" not in in_dict:
- raise MoonCliException("Unexpected request result. rule not in result")
- if rule != in_dict["rule"]:
- raise MoonCliException(
- "Unexpected request result. Bad rule in result, expected {}".format(rule))
-
-
-def check_rule_id_in_list(meta_rule_id, rule_id, rule, in_dict):
- for item in in_dict:
- if "meta_rule_id" not in item:
- raise MoonCliException("Unexpected request result. meta_rule_id field not in result")
- if meta_rule_id == item["meta_rule_id"]:
- if rule_id == item["id"]:
- if rule != item["rule"]:
- raise MoonCliException(
- "Unexpected request result. Bad rule in result, expected {}".format(rule))
-
-
-def check_rule_id_not_in_list(rule_id, in_dict):
- found_rule = False
- for item in in_dict:
- if rule_id == item["id"]:
- found_rule = True
- if found_rule is True:
- raise MoonCliException(
- "Unexpected request result. Rule with id {} shall not be in result".format(rule_id))
diff --git a/python_moonclient/python_moonclient/core/cli_exceptions.py b/python_moonclient/python_moonclient/core/cli_exceptions.py
deleted file mode 100644
index 01fd23e0..00000000
--- a/python_moonclient/python_moonclient/core/cli_exceptions.py
+++ /dev/null
@@ -1,4 +0,0 @@
-class MoonCliException(Exception):
- def __init__(self, message):
- # Call the base class constructor with the parameters it needs
- super(MoonCliException, self).__init__(message)
diff --git a/python_moonclient/python_moonclient/core/config.py b/python_moonclient/python_moonclient/core/config.py
deleted file mode 100644
index c123499b..00000000
--- a/python_moonclient/python_moonclient/core/config.py
+++ /dev/null
@@ -1,64 +0,0 @@
-import base64
-import json
-import requests
-
-
-def get_configuration(consul_host, consul_port, key):
- url = "http://{}:{}/v1/kv/{}".format(consul_host, consul_port, key)
- req = requests.get(url)
- if req.status_code != 200:
- raise Exception("Exception when retrieving configuration from Consul: {} {}".format(
- req.status_code, req.text
- ))
- data = req.json()
- if len(data) == 1:
- data = data[0]
- return {data["Key"]: json.loads(base64.b64decode(data["Value"]).decode("utf-8"))}
- return [
- {item["Key"]: json.loads(base64.b64decode(item["Value"]).decode("utf-8"))}
- for item in data
- ]
-
-
-def get_config_data(consul_host, consul_port):
- conf_data = dict()
- conf_data['manager_host'] = get_configuration(
- consul_host, consul_port,
- 'components/manager')['components/manager']['external']['hostname']
- conf_data['manager_port'] = get_configuration(
- consul_host, consul_port,
- 'components/manager')['components/manager']['external']['port']
- try:
- requests.get("http://{}:{}/".format(
- conf_data['manager_host'],
- conf_data['manager_port']
- ),
- timeout=2)
- except requests.exceptions.ConnectionError:
- conf_data['manager_host'] = get_configuration(consul_host, consul_port,
- 'components/manager')[
- 'components/manager']['hostname']
- conf_data['manager_port'] = get_configuration(consul_host, consul_port,
- 'components/manager')[
- 'components/manager']['port']
-
- conf_data['keystone_host'] = get_configuration(
- consul_host, consul_port,
- 'openstack/keystone')['openstack/keystone']['external']['url']
- try:
- requests.get(conf_data['keystone_host'], timeout=2)
- except requests.exceptions.ConnectionError:
- conf_data['keystone_host'] = get_configuration(
- consul_host, consul_port,
- 'openstack/keystone')['openstack/keystone']['url']
-
- conf_data['keystone_user'] = get_configuration(consul_host, consul_port,
- 'openstack/keystone')['openstack/keystone'][
- 'user']
- conf_data['keystone_password'] = get_configuration(consul_host, consul_port,
- 'openstack/keystone')['openstack/keystone'][
- 'password']
- conf_data['keystone_project'] = get_configuration(consul_host, consul_port,
- 'openstack/keystone')['openstack/keystone'][
- 'project']
- return conf_data
diff --git a/python_moonclient/python_moonclient/core/json_export.py b/python_moonclient/python_moonclient/core/json_export.py
deleted file mode 100644
index edaeb177..00000000
--- a/python_moonclient/python_moonclient/core/json_export.py
+++ /dev/null
@@ -1,26 +0,0 @@
-import logging
-import copy
-import requests
-from python_moonclient.core import config
-
-LOGGER = logging.getLogger("moonclient.core.export_json")
-
-URL = None
-HEADERS = None
-
-
-def init(consul_host, consul_port):
- conf_data = config.get_config_data(consul_host, consul_port)
- global URL, HEADERS
- URL = "http://{}:{}".format(
- conf_data['manager_host'],
- conf_data['manager_port'])
- URL = URL + "{}"
- HEADERS = {"content-type": "application/json"}
-
-
-def export_to_json():
- req = requests.get(URL.format("/export"))
- req.raise_for_status()
- result = req.json()
- return result
diff --git a/python_moonclient/python_moonclient/core/json_import.py b/python_moonclient/python_moonclient/core/json_import.py
deleted file mode 100644
index b65ec39b..00000000
--- a/python_moonclient/python_moonclient/core/json_import.py
+++ /dev/null
@@ -1,29 +0,0 @@
-import logging
-import requests
-import copy
-from python_moonclient.core import config
-
-LOGGER = logging.getLogger("moonclient.core.import_json")
-
-URL = None
-HEADERS = None
-
-
-def init(consul_host, consul_port):
- conf_data = config.get_config_data(consul_host, consul_port)
- global URL, HEADERS
- URL = "http://{}:{}".format(
- conf_data['manager_host'],
- conf_data['manager_port'])
- URL = URL + "{}"
- HEADERS = {"content-type": "application/json"}
-
-
-def import_json(file_name):
- files = {'file': open(file_name, 'rb')}
- req = requests.post(URL.format("/import"), files=files)
- result = req.json()
- if isinstance(result, dict) and "message" in result:
- req.reason = result["message"]
- req.raise_for_status()
- return result
diff --git a/python_moonclient/python_moonclient/core/models.py b/python_moonclient/python_moonclient/core/models.py
deleted file mode 100644
index 8d3c8858..00000000
--- a/python_moonclient/python_moonclient/core/models.py
+++ /dev/null
@@ -1,279 +0,0 @@
-import logging
-import copy
-import requests
-from python_moonclient.core import config
-from python_moonclient.core.check_tools import *
-
-LOGGER = logging.getLogger("moonclient.core.models")
-
-URL = None
-HEADERS = None
-
-model_template = {
- "name": "test_model",
- "description": "test",
- "meta_rules": []
-}
-
-category_template = {
- "name": "name of the category",
- "description": "description of the category"
-}
-
-meta_rule_template = {
- "name": "test_meta_rule",
- "subject_categories": [],
- "object_categories": [],
- "action_categories": []
-}
-
-
-def init(consul_host, consul_port):
- conf_data = config.get_config_data(consul_host, consul_port)
- global URL, HEADERS
- URL = "http://{}:{}".format(
- conf_data['manager_host'],
- conf_data['manager_port'])
- URL = URL + "{}"
- HEADERS = {"content-type": "application/json"}
-
-
-def check_model(model_id=None, do_check_model_name=True):
- req = requests.get(URL.format("/models"))
- req.raise_for_status()
- result = req.json()
- check_model_in_result(result)
- if model_id:
- check_model_name(model_template["name"], model_id, result, do_check_model_name)
- return result
-
-
-def add_model(name=None):
- if name:
- model_template['name'] = name
- req = requests.post(URL.format("/models"), json=model_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_model_in_result(result)
- model_id = list(result['models'].keys())[0]
- check_model_name(model_template["name"], model_id, result, True)
- return model_id
-
-
-def delete_model(model_id):
- req = requests.delete(URL.format("/models/{}".format(model_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
-
-def add_subject_category(name="subject_cat_1"):
- category_template["name"] = name
- req = requests.post(URL.format("/subject_categories"), json=category_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
-
- check_subject_category_in_result(result)
- category_id = list(result['subject_categories'].keys())[0]
- check_optionnal_result(result)
- check_subject_categories_name(category_template["name"], category_id, result)
- return category_id
-
-
-def check_subject_category(category_id=None):
- req = requests.get(URL.format("/subject_categories"))
- req.raise_for_status()
- result = req.json()
-
- check_subject_category_in_result(result)
- check_optionnal_result(result)
- if category_id is not None:
- check_subject_categories_name(category_template["name"], category_id, result)
- return result
-
-
-def delete_subject_category(category_id):
- req = requests.delete(URL.format("/subject_categories/{}".format(category_id)))
- req.raise_for_status()
- result = req.json()
- check_optionnal_result(result)
-
-
-def add_object_category(name="object_cat_1"):
- category_template["name"] = name
- req = requests.post(URL.format("/object_categories"), json=category_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_object_category_in_result(result)
- category_id = list(result['object_categories'].keys())[0]
- check_optionnal_result(result)
- check_object_categories_name(category_template["name"], category_id, result)
- return category_id
-
-
-def check_object_category(category_id=None):
- req = requests.get(URL.format("/object_categories"))
- req.raise_for_status()
- result = req.json()
- check_object_category_in_result(result)
- check_optionnal_result(result)
- if category_id is not None:
- check_object_categories_name(category_template["name"], category_id, result)
- return result
-
-
-def delete_object_category(category_id):
- req = requests.delete(URL.format("/object_categories/{}".format(category_id)))
- req.raise_for_status()
- result = req.json()
- check_optionnal_result(result)
-
-
-def add_action_category(name="action_cat_1"):
- category_template["name"] = name
- req = requests.post(URL.format("/action_categories"), json=category_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_action_category_in_result(result)
- category_id = list(result['action_categories'].keys())[0]
- check_optionnal_result(result)
- check_action_categories_name(category_template["name"], category_id, result)
- return category_id
-
-
-def check_action_category(category_id=None):
- req = requests.get(URL.format("/action_categories"))
- req.raise_for_status()
- result = req.json()
- print(result)
- check_action_category_in_result(result)
- check_optionnal_result(result)
- if category_id is not None:
- check_action_categories_name(category_template["name"], category_id, result)
- return result
-
-
-def delete_action_category(category_id):
- req = requests.delete(URL.format("/action_categories/{}".format(category_id)))
- req.raise_for_status()
- result = req.json()
- check_optionnal_result(result)
-
-
-def add_categories_and_meta_rule(name="test_meta_rule"):
- scat_id = add_subject_category()
- ocat_id = add_object_category()
- acat_id = add_action_category()
- _meta_rule_template = copy.deepcopy(meta_rule_template)
- _meta_rule_template["name"] = name
- _meta_rule_template["subject_categories"].append(scat_id)
- _meta_rule_template["object_categories"].append(ocat_id)
- _meta_rule_template["action_categories"].append(acat_id)
- req = requests.post(URL.format("/meta_rules"), json=_meta_rule_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_meta_rule_in_result(result)
- meta_rule_id = list(result['meta_rules'].keys())[0]
- check_optionnal_result(result)
- check_meta_rules_name(_meta_rule_template["name"], meta_rule_id, result)
- return meta_rule_id, scat_id, ocat_id, acat_id
-
-
-def add_meta_rule(name="test_meta_rule", scat=[], ocat=[], acat=[]):
- _meta_rule_template = copy.deepcopy(meta_rule_template)
- _meta_rule_template["name"] = name
- _meta_rule_template["subject_categories"] = []
- _meta_rule_template["subject_categories"].extend(scat)
- _meta_rule_template["object_categories"] = []
- _meta_rule_template["object_categories"].extend(ocat)
- _meta_rule_template["action_categories"] = []
- _meta_rule_template["action_categories"].extend(acat)
- req = requests.post(URL.format("/meta_rules"), json=_meta_rule_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_meta_rule_in_result(result)
- meta_rule_id = list(result['meta_rules'].keys())[0]
- check_optionnal_result(result)
- check_meta_rules_name(_meta_rule_template["name"], meta_rule_id, result)
- return meta_rule_id
-
-
-def check_meta_rule(meta_rule_id, scat_id=None, ocat_id=None, acat_id=None):
- req = requests.get(URL.format("/meta_rules"))
- req.raise_for_status()
- result = req.json()
- check_meta_rule_in_result(result)
- check_optionnal_result(result)
- if not meta_rule_id:
- return result
- check_meta_rules_name(None, meta_rule_id, result)
- if scat_id:
- check_scat_id_in_dict(scat_id, result['meta_rules'][meta_rule_id]["subject_categories"])
- if ocat_id:
- check_ocat_id_in_dict(ocat_id, result['meta_rules'][meta_rule_id]["object_categories"])
- if acat_id:
- check_acat_id_in_dict(acat_id, result['meta_rules'][meta_rule_id]["action_categories"])
- return result
-
-
-def delete_meta_rule(meta_rule_id):
- req = requests.delete(URL.format("/meta_rules/{}".format(meta_rule_id)))
- req.raise_for_status()
- result = req.json()
- check_optionnal_result(result)
-
-
-def add_meta_rule_to_model(model_id, meta_rule_id):
- model = check_model(model_id, do_check_model_name=False)['models']
- meta_rule_list = model[model_id]["meta_rules"]
- if meta_rule_id not in meta_rule_list:
- meta_rule_list.append(meta_rule_id)
- req = requests.patch(URL.format("/models/{}".format(model_id)),
- json={"meta_rules": meta_rule_list},
- headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_model_in_result(result)
- model_id = list(result['models'].keys())[0]
- check_optionnal_result(result)
- check_meta_rules_list_in_model(meta_rule_list, model_id, result)
-
-
-def create_model(scenario, model_id=None):
- LOGGER.info("Creating model {}".format(scenario.model_name))
- if not model_id:
- LOGGER.info("Add model")
- model_id = add_model(name=scenario.model_name)
- LOGGER.info("Add subject categories")
- for cat in scenario.subject_categories:
- scenario.subject_categories[cat] = add_subject_category(name=cat)
- LOGGER.info("Add object categories")
- for cat in scenario.object_categories:
- scenario.object_categories[cat] = add_object_category(name=cat)
- LOGGER.info("Add action categories")
- for cat in scenario.action_categories:
- scenario.action_categories[cat] = add_action_category(name=cat)
- sub_cat = []
- ob_cat = []
- act_cat = []
- meta_rule_list = []
- for item_name, item_value in scenario.meta_rule.items():
- for item in item_value["value"]:
- if item in scenario.subject_categories:
- sub_cat.append(scenario.subject_categories[item])
- elif item in scenario.object_categories:
- ob_cat.append(scenario.object_categories[item])
- elif item in scenario.action_categories:
- act_cat.append(scenario.action_categories[item])
- meta_rules = check_meta_rule(meta_rule_id=None)
- for _meta_rule_id, _meta_rule_value in meta_rules['meta_rules'].items():
- if _meta_rule_value['name'] == item_name:
- meta_rule_id = _meta_rule_id
- break
- else:
- LOGGER.info("Add meta rule")
- meta_rule_id = add_meta_rule(item_name, sub_cat, ob_cat, act_cat)
- item_value["id"] = meta_rule_id
- if meta_rule_id not in meta_rule_list:
- meta_rule_list.append(meta_rule_id)
- return model_id, meta_rule_list
diff --git a/python_moonclient/python_moonclient/core/pdp.py b/python_moonclient/python_moonclient/core/pdp.py
deleted file mode 100644
index f67a4d01..00000000
--- a/python_moonclient/python_moonclient/core/pdp.py
+++ /dev/null
@@ -1,194 +0,0 @@
-import sys
-import logging
-import requests
-from python_moonclient.core import config
-from python_moonclient.core.check_tools import *
-
-LOGGER = logging.getLogger("python_moonclient.core.pdp")
-
-URL = None
-HEADERS = None
-KEYSTONE_USER = None
-KEYSTONE_PASSWORD = None
-KEYSTONE_PROJECT = None
-KEYSTONE_SERVER = None
-
-pdp_template = {
- "name": "test_pdp",
- "security_pipeline": [],
- "keystone_project_id": None,
- "description": "test",
-}
-
-
-def init(consul_host, consul_port):
- conf_data = config.get_config_data(consul_host, consul_port)
- global URL, HEADERS, KEYSTONE_USER, KEYSTONE_PASSWORD, KEYSTONE_PROJECT, KEYSTONE_SERVER
- URL = "http://{}:{}".format(
- conf_data['manager_host'],
- conf_data['manager_port'])
- # URL = URL + "{}"
- HEADERS = {"content-type": "application/json"}
- KEYSTONE_USER = conf_data['keystone_user']
- KEYSTONE_PASSWORD = conf_data['keystone_password']
- KEYSTONE_PROJECT = conf_data['keystone_project']
- KEYSTONE_SERVER = conf_data['keystone_host']
-
-
-def get_keystone_projects():
- global HEADERS
- HEADERS = {
- "Content-Type": "application/json"
- }
-
- data_auth = {
- "auth": {
- "identity": {
- "methods": [
- "password"
- ],
- "password": {
- "user": {
- "name": KEYSTONE_USER,
- "domain": {
- "name": "Default"
- },
- "password": KEYSTONE_PASSWORD
- }
- }
- }
- }
- }
-
- req = requests.post("{}/auth/tokens".format(KEYSTONE_SERVER), json=data_auth, headers=HEADERS)
- LOGGER.debug("{}/auth/tokens".format(KEYSTONE_SERVER))
- LOGGER.debug(req.text)
- req.raise_for_status()
- token = req.headers['X-Subject-Token']
- HEADERS['X-Auth-Token'] = token
- req = requests.get("{}/projects".format(KEYSTONE_SERVER), headers=HEADERS)
- if req.status_code not in (200, 201):
- data_auth["auth"]["scope"] = {
- "project": {
- "name": KEYSTONE_PROJECT,
- "domain": {
- "id": "default"
- }
- }
- }
- req = requests.post("{}/auth/tokens".format(KEYSTONE_SERVER), json=data_auth,
- headers=HEADERS)
- req.raise_for_status()
- token = req.headers['X-Subject-Token']
- HEADERS['X-Auth-Token'] = token
- req = requests.get("{}/projects".format(KEYSTONE_SERVER), headers=HEADERS)
- req.raise_for_status()
- return req.json()
-
-
-def get_keystone_id(pdp_name):
- keystone_project_id = None
- for pdp_key, pdp_value in check_pdp()["pdps"].items():
- if pdp_name:
- if pdp_name != pdp_value["name"]:
- continue
- if pdp_value['security_pipeline'] and pdp_value["keystone_project_id"]:
- LOGGER.debug(
- "Found pdp with keystone_project_id={}".format(pdp_value["keystone_project_id"]))
- keystone_project_id = pdp_value["keystone_project_id"]
-
- if not keystone_project_id:
- LOGGER.error("Cannot find PDP with keystone project ID")
- sys.exit(1)
- return keystone_project_id
-
-
-def check_pdp(pdp_id=None, keystone_project_id=None, moon_url=None):
- _url = URL
- if moon_url:
- _url = moon_url
- req = requests.get(_url + "/pdp")
- req.raise_for_status()
- result = req.json()
- check_pdp_in_result(result)
- if pdp_id:
- check_pdp_name(pdp_template["name"], pdp_id, result)
- if keystone_project_id:
- check_pdp_project_id(keystone_project_id, pdp_id, result)
- return result
-
-
-def add_pdp(name="test_pdp", policy_id=None):
- pdp_template['name'] = name
- if policy_id:
- pdp_template['security_pipeline'].append(policy_id)
- req = requests.post(URL + "/pdp", json=pdp_template, headers=HEADERS)
- LOGGER.debug(req.status_code)
- LOGGER.debug(req)
- req.raise_for_status()
- result = req.json()
- check_pdp_in_result(result)
- pdp_id = list(result['pdps'].keys())[0]
- check_pdp_name(pdp_template["name"], pdp_id, result)
- return pdp_id
-
-
-def update_pdp(pdp_id, policy_id=None):
- req = requests.get(URL + "/pdp/{}".format(pdp_id))
- req.raise_for_status()
- result = req.json()
- check_pdp_id(pdp_id, result)
- pipeline = result['pdps'][pdp_id]["security_pipeline"]
- if policy_id not in pipeline:
- pipeline.append(policy_id)
- req = requests.patch(URL + "/pdp/{}".format(pdp_id),
- json={"security_pipeline": pipeline})
- req.raise_for_status()
- result = req.json()
- check_pdp_id(pdp_id, result)
-
- req = requests.get(URL + "/pdp/{}".format(pdp_id))
- req.raise_for_status()
- result = req.json()
- check_pdp_id(pdp_id, result)
- check_policy_id_in_pipeline(pdp_id, pipeline)
-
-
-def map_to_keystone(pdp_id, keystone_project_id):
- req = requests.patch(URL + "/pdp/{}".format(pdp_id),
- json={"keystone_project_id": keystone_project_id},
- headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_pdp_id(pdp_id, result)
- # assert "name" in result['pdps'][pdp_id]
- # assert pdp_template["name"] == result['pdps'][pdp_id]["name"]
- return pdp_id
-
-
-def delete_pdp(pdp_id):
- req = requests.delete(URL + "/pdp/{}".format(pdp_id))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
-
-def create_pdp(scenario, policy_id=None, project_id=None):
- LOGGER.info("Creating PDP {}".format(scenario.pdp_name))
- projects = get_keystone_projects()
- # if not project_id:
- # for _project in projects['projects']:
- # if _project['name'] == "admin":
- # project_id = _project['id']
- # assert project_id
- pdps = check_pdp()["pdps"]
- for pdp_id, pdp_value in pdps.items():
- if scenario.pdp_name == pdp_value["name"]:
- update_pdp(pdp_id, policy_id=policy_id)
- LOGGER.debug(
- "Found existing PDP named {} (will add policy {})".format(scenario.pdp_name,
- policy_id))
- return pdp_id
- _pdp_id = add_pdp(name=scenario.pdp_name, policy_id=policy_id)
- # map_to_keystone(pdp_id=_pdp_id, keystone_project_id=project_id)
- return _pdp_id
diff --git a/python_moonclient/python_moonclient/core/policies.py b/python_moonclient/python_moonclient/core/policies.py
deleted file mode 100644
index b9b05dd8..00000000
--- a/python_moonclient/python_moonclient/core/policies.py
+++ /dev/null
@@ -1,673 +0,0 @@
-import logging
-import requests
-from python_moonclient.core import models, config
-from python_moonclient.core.check_tools import *
-
-LOGGER = logging.getLogger("moonclient.core.policies")
-
-URL = None
-HEADERS = None
-
-policy_template = {
- "name": "test_policy",
- "model_id": "",
- "genre": "authz",
- "description": "test",
-}
-
-subject_template = {
- "name": "test_subject",
- "description": "test",
- "email": "mail",
- "password": "my_pass",
-}
-
-object_template = {
- "name": "test_subject",
- "description": "test"
-}
-
-action_template = {
- "name": "test_subject",
- "description": "test"
-}
-
-subject_data_template = {
- "name": "subject_data1",
- "description": "description of the data subject"
-}
-
-object_data_template = {
- "name": "object_data1",
- "description": "description of the data subject"
-}
-
-action_data_template = {
- "name": "action_data1",
- "description": "description of the data subject"
-}
-
-subject_assignment_template = {
- "id": "",
- "category_id": "",
- "scope_id": ""
-}
-
-
-def init(consul_host, consul_port):
- conf_data = config.get_config_data(consul_host, consul_port)
- global URL, HEADERS
- URL = "http://{}:{}".format(
- conf_data['manager_host'],
- conf_data['manager_port'])
- URL = URL + "{}"
- HEADERS = {"content-type": "application/json"}
-
-
-def check_policy(policy_id=None):
- req = requests.get(URL.format("/policies"))
- req.raise_for_status()
- result = req.json()
- check_policy_in_result(result)
- if policy_id:
- check_policy_name(policy_template["name"], policy_id, result)
- return result
-
-
-def add_policy(name="test_policy", genre="authz"):
- policy_template["name"] = name
- policy_template["genre"] = genre
- req = requests.post(URL.format("/policies"), json=policy_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_policy_in_result(result)
- policy_id = list(result['policies'].keys())[0]
- check_optionnal_result(result)
- check_policy_name(policy_template["name"], policy_id, result)
- return policy_id
-
-
-def update_policy(policy_id, model_id):
- req = requests.patch(URL.format("/policies/{}".format(policy_id)),
- json={"model_id": model_id}, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_policy_in_result(result)
- policy_id = list(result['policies'].keys())[0]
- check_optionnal_result(result)
- check_policy_model_id(model_id, policy_id, result)
-
-
-def delete_policy(policy_id):
- req = requests.delete(URL.format("/policies/{}".format(policy_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
-
-def add_subject(policy_id=None, name="test_subject"):
- subject_template['name'] = name
- if policy_id:
- LOGGER.debug(URL.format("/policies/{}/subjects".format(policy_id)))
- req = requests.post(URL.format("/policies/{}/subjects".format(policy_id)),
- json=subject_template, headers=HEADERS)
- else:
- LOGGER.debug(URL.format("/subjects"))
- req = requests.post(URL.format("/subjects"), json=subject_template, headers=HEADERS)
- LOGGER.debug(req.text)
- req.raise_for_status()
- result = req.json()
- check_subject_in_result(result)
- subject_id = list(result['subjects'].keys())[0]
- return subject_id
-
-
-def update_subject(subject_id, policy_id=None, description=None):
- if policy_id and not description:
- req = requests.patch(URL.format("/policies/{}/subjects/{}".format(policy_id, subject_id)),
- json={})
- elif policy_id and description:
- req = requests.patch(URL.format("/policies/{}/subjects/{}".format(policy_id, subject_id)),
- json={"description": description})
- else:
- req = requests.patch(URL.format("/subjects/{}".format(subject_id)),
- json={"description": description})
- req.raise_for_status()
- result = req.json()
- check_subject_name(subject_template["name"], subject_id, result)
- check_subject_policy(policy_id, result["subjects"][subject_id])
- check_subject_description(description, result["subjects"][subject_id])
-
-
-def check_subject(subject_id=None, policy_id=None):
- if policy_id:
- req = requests.get(URL.format("/policies/{}/subjects".format(policy_id)))
- else:
- req = requests.get(URL.format("/subjects"))
- req.raise_for_status()
- result = req.json()
- check_subject_name(subject_template["name"], subject_id, result)
- check_subject_policy(policy_id, result["subjects"][subject_id])
-
-
-def delete_subject(subject_id, policy_id=None):
- if policy_id:
- req = requests.delete(URL.format("/policies/{}/subjects/{}".format(policy_id, subject_id)))
- else:
- req = requests.delete(URL.format("/subjects/{}".format(subject_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
- if policy_id:
- req = requests.get(URL.format("/policies/{}/subjects".format(policy_id)))
- else:
- req = requests.get(URL.format("/subjects"))
- req.raise_for_status()
- result = req.json()
- check_subject_in_result(result)
- if subject_id in result["subjects"]:
- check_subject_name(subject_template["name"], subject_id, result)
- check_subject_policy(policy_id, result["subjects"][subject_id])
-
-
-def add_object(policy_id=None, name="test_object"):
- object_template['name'] = name
- if policy_id:
- req = requests.post(URL.format("/policies/{}/objects".format(policy_id)),
- json=object_template, headers=HEADERS)
- else:
- req = requests.post(URL.format("/objects"), json=object_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_object_in_result(result)
- object_id = list(result['objects'].keys())[0]
- return object_id
-
-
-def update_object(object_id, policy_id):
- req = requests.patch(URL.format("/policies/{}/objects/{}".format(policy_id, object_id)),
- json={})
- req.raise_for_status()
- result = req.json()
- check_object_in_result(result)
- check_object_name(object_template["name"], object_id, result)
- check_object_policy(policy_id, result["objects"][object_id])
-
-
-def check_object(object_id=None, policy_id=None):
- if policy_id:
- req = requests.get(URL.format("/policies/{}/objects".format(policy_id)))
- else:
- req = requests.get(URL.format("/objects"))
- req.raise_for_status()
- result = req.json()
- check_object_in_result(result)
- check_object_name(object_template["name"], object_id, result)
- if policy_id:
- check_object_policy(policy_id, result["objects"][object_id])
-
-
-def delete_object(object_id, policy_id=None):
- if policy_id:
- req = requests.delete(URL.format("/policies/{}/objects/{}".format(policy_id, object_id)))
- else:
- req = requests.delete(URL.format("/objects/{}".format(object_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
- if policy_id:
- req = requests.get(URL.format("/policies/{}/objects".format(policy_id)))
- else:
- req = requests.get(URL.format("/objects"))
- req.raise_for_status()
- result = req.json()
- check_object_in_result(result)
- if object_id in result["objects"]:
- check_object_name(object_template["name"], object_id, result)
- if policy_id:
- check_object_policy(policy_id, result["objects"][object_id])
-
-
-def add_action(policy_id=None, name="test_action"):
- action_template['name'] = name
- if policy_id:
- req = requests.post(URL.format("/policies/{}/actions".format(policy_id)),
- json=action_template, headers=HEADERS)
- else:
- req = requests.post(URL.format("/actions"), json=action_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_action_in_result(result)
- action_id = list(result['actions'].keys())[0]
- return action_id
-
-
-def update_action(action_id, policy_id):
- req = requests.patch(URL.format("/policies/{}/actions/{}".format(policy_id, action_id)),
- json={})
- req.raise_for_status()
- result = req.json()
- check_action_in_result(result)
- check_action_name(action_template["name"], action_id, result)
- check_action_policy(policy_id, result["actions"][action_id])
-
-
-def check_action(action_id=None, policy_id=None):
- if policy_id:
- req = requests.get(URL.format("/policies/{}/actions".format(policy_id)))
- else:
- req = requests.get(URL.format("/actions"))
- req.raise_for_status()
- result = req.json()
- check_action_in_result(result)
- check_action_name(action_template["name"], action_id, result)
- if policy_id:
- check_action_policy(policy_id, result["actions"][action_id])
-
-
-def delete_action(action_id, policy_id=None):
- if policy_id:
- req = requests.delete(URL.format("/policies/{}/actions/{}".format(policy_id, action_id)))
- else:
- req = requests.delete(URL.format("/actions/{}".format(action_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
- if policy_id:
- req = requests.get(URL.format("/policies/{}/actions".format(policy_id)))
- else:
- req = requests.get(URL.format("/actions"))
- req.raise_for_status()
- result = req.json()
- check_action_in_result(result)
- if action_id in result["actions"]:
- check_action_name(action_template["name"], action_id, result)
- if policy_id:
- check_action_policy(policy_id, result["actions"][action_id])
-
-
-def add_subject_data(policy_id, category_id, name="subject_data1"):
- subject_data_template['name'] = name
- req = requests.post(URL.format("/policies/{}/subject_data/{}".format(policy_id, category_id)),
- json=subject_data_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_subject_data_data(result)
- subject_id = list(result['subject_data']['data'].keys())[0]
- return subject_id
-
-
-def check_subject_data(policy_id, data_id, category_id):
- req = requests.get(URL.format("/policies/{}/subject_data/{}".format(policy_id, category_id)))
- req.raise_for_status()
- result = req.json()
- print(result)
- if data_id is not None:
- check_id_in_subject_data_data(data_id, result)
- check_category_id_in_subject_data_data(category_id, result)
- return result
-
-
-def delete_subject_data(policy_id, category_id, data_id):
- req = requests.delete(
- URL.format("/policies/{}/subject_data/{}/{}".format(policy_id, category_id, data_id)),
- headers=HEADERS)
- req.raise_for_status()
- req = requests.get(URL.format("/policies/{}/subject_data/{}".format(policy_id, category_id)))
- req.raise_for_status()
- result = req.json()
- check_id_not_in_subject_data_data(data_id, result)
- check_category_id_in_subject_data_data(category_id, result)
-
-
-def add_object_data(policy_id, category_id, name="object_data1"):
- object_data_template['name'] = name
- req = requests.post(URL.format("/policies/{}/object_data/{}".format(policy_id, category_id)),
- json=object_data_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_object_data_data(result)
- object_id = list(result['object_data']['data'].keys())[0]
- return object_id
-
-
-def check_object_data(policy_id, data_id, category_id):
- req = requests.get(URL.format("/policies/{}/object_data/{}".format(policy_id, category_id)))
- req.raise_for_status()
- result = req.json()
- if data_id is not None:
- check_id_in_object_data_data(data_id, result)
- check_category_id_in_object_data_data(category_id, result)
- return result
-
-
-def delete_object_data(policy_id, category_id, data_id):
- req = requests.delete(
- URL.format("/policies/{}/object_data/{}/{}".format(policy_id, category_id, data_id)),
- headers=HEADERS)
- req.raise_for_status()
- req = requests.get(URL.format("/policies/{}/object_data/{}".format(policy_id, category_id)))
- req.raise_for_status()
- result = req.json()
- check_id_not_in_object_data_data(data_id, result)
- check_category_id_in_object_data_data(category_id, result)
-
-
-def add_action_data(policy_id, category_id, name="action_data1"):
- action_data_template['name'] = name
- req = requests.post(URL.format("/policies/{}/action_data/{}".format(policy_id, category_id)),
- json=action_data_template, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_action_data_data(result)
- action_id = list(result['action_data']['data'].keys())[0]
- return action_id
-
-
-def check_action_data(policy_id, data_id, category_id):
- req = requests.get(URL.format("/policies/{}/action_data/{}".format(policy_id, category_id)))
- req.raise_for_status()
- result = req.json()
- print(result)
- if data_id is not None:
- check_id_in_action_data_data(data_id, result)
- check_category_id_in_action_data_data(category_id, result)
- return result
-
-
-def delete_action_data(policy_id, category_id, data_id):
- req = requests.delete(
- URL.format("/policies/{}/action_data/{}/{}".format(policy_id, category_id, data_id)),
- headers=HEADERS)
- req.raise_for_status()
- req = requests.get(URL.format("/policies/{}/action_data/{}".format(policy_id, category_id)))
- req.raise_for_status()
- result = req.json()
- check_id_not_in_action_data_data(data_id, result)
- check_category_id_in_action_data_data(category_id, result)
-
-
-def add_subject_assignments(policy_id, subject_id, subject_cat_id, subject_data_id):
- req = requests.post(URL.format("/policies/{}/subject_assignments".format(policy_id)),
- json={
- "id": subject_id,
- "category_id": subject_cat_id,
- "data_id": subject_data_id
- }, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_subject_assignment_in_result(result)
-
-
-def check_subject_assignments(policy_id, subject_id, subject_cat_id, subject_data_id):
- req = requests.get(URL.format("/policies/{}/subject_assignments/{}/{}/{}".format(
- policy_id, subject_id, subject_cat_id, subject_data_id)))
- req.raise_for_status()
- result = req.json()
- check_subject_assignment_in_result(result)
- check_subject_assignements(subject_id, subject_cat_id, subject_data_id, result)
-
-
-def check_object_assignments(policy_id, object_id, object_cat_id, object_data_id):
- req = requests.get(URL.format("/policies/{}/object_assignments/{}/{}/{}".format(
- policy_id, object_id, object_cat_id, object_data_id)))
- req.raise_for_status()
- result = req.json()
- check_object_assignment_in_result(result)
- check_object_assignements(object_id, object_cat_id, object_data_id, result)
-
-
-def check_action_assignments(policy_id, action_id, action_cat_id, action_data_id):
- req = requests.get(URL.format("/policies/{}/action_assignments/{}/{}/{}".format(
- policy_id, action_id, action_cat_id, action_data_id)))
- req.raise_for_status()
- result = req.json()
- check_action_assignment_in_result(result)
- check_action_assignements(action_id, action_cat_id, action_data_id, result)
-
-
-def add_object_assignments(policy_id, object_id, object_cat_id, object_data_id):
- req = requests.post(URL.format("/policies/{}/object_assignments".format(policy_id)),
- json={
- "id": object_id,
- "category_id": object_cat_id,
- "data_id": object_data_id
- }, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_object_assignment_in_result(result)
-
-
-def add_action_assignments(policy_id, action_id, action_cat_id, action_data_id):
- req = requests.post(URL.format("/policies/{}/action_assignments".format(policy_id)),
- json={
- "id": action_id,
- "category_id": action_cat_id,
- "data_id": action_data_id
- }, headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_action_assignment_in_result(result)
-
-
-def delete_subject_assignment(policy_id, subject_id, subject_cat_id, subject_data_id):
- req = requests.delete(URL.format("/policies/{}/subject_assignments/{}/{}/{}".format(
- policy_id, subject_id, subject_cat_id, subject_data_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
- req = requests.get(URL.format("/policies/{}/subject_assignments/{}/{}/{}".format(
- policy_id, subject_id, subject_cat_id, subject_data_id)))
- req.raise_for_status()
- result = req.json()
- check_subject_assignment_in_result(result)
- check_not_subject_assignements(subject_id, subject_cat_id, subject_data_id, result)
-
-
-def delete_object_assignment(policy_id, object_id, object_cat_id, object_data_id):
- req = requests.delete(URL.format("/policies/{}/object_assignments/{}/{}/{}".format(
- policy_id, object_id, object_cat_id, object_data_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
- req = requests.get(URL.format("/policies/{}/object_assignments/{}/{}/{}".format(
- policy_id, object_id, object_cat_id, object_data_id)))
- req.raise_for_status()
- result = req.json()
- check_object_assignment_in_result(result)
- check_not_object_assignements(object_id, object_cat_id, object_data_id, result)
-
-
-def delete_action_assignment(policy_id, action_id, action_cat_id, action_data_id):
- req = requests.delete(URL.format("/policies/{}/action_assignments/{}/{}/{}".format(
- policy_id, action_id, action_cat_id, action_data_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
-
- req = requests.get(URL.format("/policies/{}/action_assignments/{}/{}/{}".format(
- policy_id, action_id, action_cat_id, action_data_id)))
- req.raise_for_status()
- result = req.json()
- check_action_assignment_in_result(result)
- check_not_action_assignements(action_id, action_cat_id, action_data_id, result)
-
-
-def add_rule(policy_id, meta_rule_id, rule,
- instructions={"chain": [{"security_pipeline": "rbac"}]}):
- req = requests.post(URL.format("/policies/{}/rules".format(policy_id)),
- json={
- "meta_rule_id": meta_rule_id,
- "rule": rule,
- "instructions": instructions,
- "enabled": True
- },
- headers=HEADERS)
- req.raise_for_status()
- result = req.json()
- check_rule_in_result(result)
- rule_id = list(result["rules"].keys())[0]
- check_policy_id_in_dict(policy_id, result["rules"][rule_id])
- check_meta_rule_id_in_dict(meta_rule_id, result["rules"][rule_id])
- check_rule_in_dict(rule, result["rules"][rule_id])
- return rule_id
-
-
-def check_rule(policy_id, meta_rule_id, rule_id, rule):
- req = requests.get(URL.format("/policies/{}/rules".format(policy_id)))
- req.raise_for_status()
- result = req.json()
- check_rule_in_result(result)
- check_policy_id_in_dict(policy_id, result["rules"])
- check_rule_id_in_list(meta_rule_id, rule_id, rule, result["rules"]["rules"])
-
-
-def delete_rule(policy_id, rule_id):
- req = requests.delete(URL.format("/policies/{}/rules/{}".format(policy_id, rule_id)))
- req.raise_for_status()
- result = req.json()
- check_result(result)
- req = requests.get(URL.format("/policies/{}/rules".format(policy_id)))
- req.raise_for_status()
- result = req.json()
- check_rule_in_result(result)
- check_policy_id_in_dict(policy_id, result["rules"])
- check_rule_id_not_in_list(rule_id, result["rules"]["rules"])
-
-
-def check_meta_rule():
- req = requests.get(URL.format("/meta_rules/"))
- req.raise_for_status()
- result = req.json()
- print(result)
- return result
-
-
-def create_policy(scenario, model_id, meta_rule_list):
- LOGGER.info("Creating policy {}".format(scenario.policy_name))
- _policies = check_policy()
- for _policy_id, _policy_value in _policies["policies"].items():
- if _policy_value['name'] == scenario.policy_name:
- policy_id = _policy_id
- break
- else:
- policy_id = add_policy(name=scenario.policy_name, genre=scenario.policy_genre)
-
- update_policy(policy_id, model_id)
-
- for meta_rule_id in meta_rule_list:
- LOGGER.debug("add_meta_rule_to_model {} {}".format(model_id, meta_rule_id))
- models.add_meta_rule_to_model(model_id, meta_rule_id)
-
- LOGGER.info("Add subject data")
- for subject_cat_name in scenario.subject_data:
- for subject_data_name in scenario.subject_data[subject_cat_name]:
- data_id = scenario.subject_data[subject_cat_name][subject_data_name] = add_subject_data(
- policy_id=policy_id,
- category_id=scenario.subject_categories[subject_cat_name], name=subject_data_name)
- scenario.subject_data[subject_cat_name][subject_data_name] = data_id
- LOGGER.info("Add object data")
- for object_cat_name in scenario.object_data:
- for object_data_name in scenario.object_data[object_cat_name]:
- data_id = scenario.object_data[object_cat_name][object_data_name] = add_object_data(
- policy_id=policy_id,
- category_id=scenario.object_categories[object_cat_name], name=object_data_name)
- scenario.object_data[object_cat_name][object_data_name] = data_id
- LOGGER.info("Add action data")
- for action_cat_name in scenario.action_data:
- for action_data_name in scenario.action_data[action_cat_name]:
- data_id = scenario.action_data[action_cat_name][action_data_name] = add_action_data(
- policy_id=policy_id,
- category_id=scenario.action_categories[action_cat_name], name=action_data_name)
- scenario.action_data[action_cat_name][action_data_name] = data_id
-
- LOGGER.info("Add subjects")
- for name in scenario.subjects:
- scenario.subjects[name] = add_subject(policy_id, name=name)
- LOGGER.info("Add objects")
- for name in scenario.objects:
- scenario.objects[name] = add_object(policy_id, name=name)
- LOGGER.info("Add actions")
- for name in scenario.actions:
- scenario.actions[name] = add_action(policy_id, name=name)
-
- LOGGER.info("Add subject assignments")
- for subject_name in scenario.subject_assignments:
- if type(scenario.subject_assignments[subject_name]) in (list, tuple):
- for items in scenario.subject_assignments[subject_name]:
- for subject_category_name in items:
- subject_id = scenario.subjects[subject_name]
- subject_cat_id = scenario.subject_categories[subject_category_name]
- for data in scenario.subject_assignments[subject_name]:
- subject_data_id = scenario.subject_data[subject_category_name][
- data[subject_category_name]]
- add_subject_assignments(policy_id, subject_id, subject_cat_id,
- subject_data_id)
- else:
- for subject_category_name in scenario.subject_assignments[subject_name]:
- subject_id = scenario.subjects[subject_name]
- subject_cat_id = scenario.subject_categories[subject_category_name]
- subject_data_id = scenario.subject_data[subject_category_name][
- scenario.subject_assignments[subject_name][subject_category_name]]
- add_subject_assignments(policy_id, subject_id, subject_cat_id, subject_data_id)
-
- LOGGER.info("Add object assignments")
- for object_name in scenario.object_assignments:
- if type(scenario.object_assignments[object_name]) in (list, tuple):
- for items in scenario.object_assignments[object_name]:
- for object_category_name in items:
- object_id = scenario.objects[object_name]
- object_cat_id = scenario.object_categories[object_category_name]
- for data in scenario.object_assignments[object_name]:
- object_data_id = scenario.object_data[object_category_name][
- data[object_category_name]]
- add_object_assignments(policy_id, object_id, object_cat_id, object_data_id)
- else:
- for object_category_name in scenario.object_assignments[object_name]:
- object_id = scenario.objects[object_name]
- object_cat_id = scenario.object_categories[object_category_name]
- object_data_id = scenario.object_data[object_category_name][
- scenario.object_assignments[object_name][object_category_name]]
- add_object_assignments(policy_id, object_id, object_cat_id, object_data_id)
-
- LOGGER.info("Add action assignments")
- for action_name in scenario.action_assignments:
- if type(scenario.action_assignments[action_name]) in (list, tuple):
- for items in scenario.action_assignments[action_name]:
- for action_category_name in items:
- action_id = scenario.actions[action_name]
- action_cat_id = scenario.action_categories[action_category_name]
- for data in scenario.action_assignments[action_name]:
- action_data_id = scenario.action_data[action_category_name][
- data[action_category_name]]
- add_action_assignments(policy_id, action_id, action_cat_id, action_data_id)
- else:
- for action_category_name in scenario.action_assignments[action_name]:
- action_id = scenario.actions[action_name]
- action_cat_id = scenario.action_categories[action_category_name]
- action_data_id = scenario.action_data[action_category_name][
- scenario.action_assignments[action_name][action_category_name]]
- add_action_assignments(policy_id, action_id, action_cat_id, action_data_id)
-
- LOGGER.info("Add rules")
- for meta_rule_name in scenario.rules:
- meta_rule_value = scenario.meta_rule[meta_rule_name]
- for rule in scenario.rules[meta_rule_name]:
- data_list = []
- _meta_rule = list(meta_rule_value["value"])
- for data_name in rule["rule"]:
- category_name = _meta_rule.pop(0)
- if category_name in scenario.subject_categories:
- data_list.append(scenario.subject_data[category_name][data_name])
- elif category_name in scenario.object_categories:
- data_list.append(scenario.object_data[category_name][data_name])
- elif category_name in scenario.action_categories:
- data_list.append(scenario.action_data[category_name][data_name])
- instructions = rule["instructions"]
- add_rule(policy_id, meta_rule_value["id"], data_list, instructions)
- return policy_id
diff --git a/python_moonclient/python_moonclient/core/slaves.py b/python_moonclient/python_moonclient/core/slaves.py
deleted file mode 100644
index 77b127c1..00000000
--- a/python_moonclient/python_moonclient/core/slaves.py
+++ /dev/null
@@ -1,59 +0,0 @@
-import logging
-import requests
-from python_moonclient.core import config
-from python_moonclient.core.check_tools import *
-
-LOGGER = logging.getLogger("moonclient.core.slaves")
-
-URL = None
-HEADERS = None
-
-
-def init(consul_host, consul_port):
- conf_data = config.get_config_data(consul_host, consul_port)
- global URL, HEADERS
- URL = "http://{}:{}".format(
- conf_data['manager_host'],
- conf_data['manager_port'])
- URL = URL + "{}"
- HEADERS = {"content-type": "application/json"}
-
-
-def get_slaves():
- req = requests.get(URL.format("/slaves"))
- req.raise_for_status()
- result = req.json()
- check_slaves_in_result(result)
- return result
-
-
-def set_slave(name):
- slaves = get_slaves().get("slaves", [])
- check_name_in_slaves(name, slaves)
- req = requests.patch(URL.format("/slaves/{}".format(name)),
- headers=HEADERS,
- json={
- "op": "replace",
- "variable": "configured",
- "value": True
- })
- req.raise_for_status()
- result = req.json()
- check_slaves_in_result(result)
- return get_slaves()
-
-
-def delete_slave(name):
- slaves = get_slaves().get("slaves", [])
- check_name_in_slaves(name, slaves)
- req = requests.patch(URL.format("/slaves/{}".format(name)),
- headers=HEADERS,
- json={
- "op": "replace",
- "variable": "configured",
- "value": False
- })
- req.raise_for_status()
- result = req.json()
- check_slaves_in_result(result)
- return get_slaves()