Class: ARBACVerifier::ReachabilityVerifier

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Includes:
Utils
Defined in:
lib/arbac_verifier/classes/reachability_verifier.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Utils

#backward_slicing, #forward_slicing, #overaproximate_reachable_roles, #overaproximate_relevant_roles

Constructor Details

#initialize(**params) ⇒ ReachabilityVerifier

Returns a new instance of ReachabilityVerifier.



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/arbac_verifier/classes/reachability_verifier.rb', line 30

def initialize(**params)
  if params[:instance].nil?
    path = T.cast(params[:path], String)
    logger.info("Initializing reachability problem for policy from file #{path}...")
    instance = T.let(Instance.new(path: path), Instance)
    logger.info("*** Initial instance info ***")
    log_complexity(instance)
    @instance = forward_slicing(backward_slicing(instance))
    logger.info("*** Post pruning instance info ***")
    log_complexity(@instance)
  else
    instance = T.cast(params[:instance], Instance)
    logger.info("Initializing reachability problem for policy #{instance.hash}...")
    logger.info("*** Initial instance info ***")
    log_complexity(instance)
    @instance = forward_slicing(backward_slicing(instance))
    logger.info("*** Post pruning instance info ***")
    log_complexity(@instance)
  end
end

Instance Attribute Details

#instance ⇒ Object (readonly)

Returns the value of attribute instance.



15
16
17
 
# File 'lib/arbac_verifier/classes/reachability_verifier.rb', line 15

def instance
  @instance
end

Class Method Details

.logger ⇒ Object 



18
19
20
21
22
 
# File 'lib/arbac_verifier/classes/reachability_verifier.rb', line 18

def self.logger
  @@logger ||= Logger.new($stdout).tap do |log|
    log.progname = self.name
  end
end

.set_logger(logger) ⇒ Object 



25
26
27
 
# File 'lib/arbac_verifier/classes/reachability_verifier.rb', line 25

def self.set_logger(logger)
  @@logger = logger
end

Instance Method Details

#verify ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/arbac_verifier/classes/reachability_verifier.rb', line 52

def verify
  all_states = {}
  initial_state = @instance.user_to_role
  new_states = { initial_state => true }
  found = Concurrent::AtomicBoolean.new(false)

  users = @instance.users.to_a
  user_pairs = users.product(users)

  num_cpus = Concurrent.processor_count
  pool = Concurrent::ThreadPoolExecutor.new(
    min_threads: num_cpus,
    max_threads: num_cpus,
    max_queue: num_cpus * 2,
    fallback_policy: :caller_runs
  )

  until found.true? || new_states.empty?
    all_states.merge!(new_states)
    current_states = new_states.keys
    new_states.clear

    futures = current_states.flat_map do |current_state|
      user_pairs.map do |subject, object|
        Concurrent::Future.execute(executor: pool) do
          new_local_states = []
          perform_assignments(subject, object, new_local_states, all_states, current_state, found)
          perform_revocations(subject, object, new_local_states, all_states, current_state)
          new_local_states
        end
      end
    end

    futures.each do |future|
      future.value.each { |state| new_states[state] = true }
    end
    break if found.true?
  end

  pool.shutdown
  pool.wait_for_termination

  found.true?
end