<commit_before>/*-
 * ========================LICENSE_START=================================
 * ids-dataflow-control
 * %%
 * Copyright (C) 2018 <NAME>
 * %%
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * =========================LICENSE_END==================================
 */
package de.fhg.ids.dataflowcontrol;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
import static org.mockito.Matchers.anyString;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import org.junit.Ignore;
import org.junit.Test;

import alice.tuprolog.InvalidTheoryException;
import alice.tuprolog.MalformedGoalException;
import alice.tuprolog.NoMoreSolutionException;
import alice.tuprolog.NoSolutionException;
import alice.tuprolog.SolveInfo;
import de.fhg.aisec.ids.api.policy.DecisionRequest;
import de.fhg.aisec.ids.api.policy.Obligation;
import de.fhg.aisec.ids.api.policy.PDP;
import de.fhg.aisec.ids.api.policy.PolicyDecision;
import de.fhg.aisec.ids.api.policy.PolicyDecision.Decision;
import de.fhg.aisec.ids.api.policy.ServiceNode;
import de.fhg.aisec.ids.api.policy.TransformationDecision;
import de.fhg.aisec.ids.api.router.RouteManager;
import de.fhg.aisec.ids.api.router.RouteVerificationProof;
import de.fhg.ids.dataflowcontrol.lucon.LuconEngine;

/**
 * Unit tests for the LUCON policy engine.
 *
 * @author <NAME> (<EMAIL>)
 */
public class LuconEngineTest {
  // Solving Towers of Hanoi in only two lines. Prolog FTW!
  private static final String HANOI_THEORY =
      "move(1,X,Y,_) :- "
          + "write('Move top disk from '), write(X), write(' to '), write(Y), nl. \n"
          + "move(N,X,Y,Z) :- N>1, M is N-1, move(M,X,Z,Y), move(1,X,Y,_), move(M,Z,Y,X). ";

  // A random but syntactically correct policy.
  private static final String EXAMPLE_POLICY =
      "\n"
          + "%%%%%%%% Rules %%%%%%%%%%%%\n"
          + "rule(denyAll).\n"
          + "rule_priority(denyAll, 0).\n"
          + "has_decision(denyAll, drop).\n"
          + "receives_label(denyAll).\n"
          + "has_target(denyAll, serviceAll).\n"
          + "\n"
          + "rule(allowRule).\n"
          + "rule_priority(allowRule, 1).\n"
          + "has_decision(allowRule, allow).\n"
          + "receives_label(allowRule).\n"
          + "has_target(allowRule, hiveMqttBrokerService).\n"
          + "has_target(allowRule, anonymizerService).\n"
          + "has_target(allowRule, loggerService).\n"
          + "has_target(allowRule, hadoopClustersService).\n"
          + "has_target(allowRule, testQueueService).\n"
          + "\n"
          + "rule(deleteAfterOneMonth).\n"
          + "rule_priority(deleteAfterOneMonth, 1).\n"
          + "has_decision(deleteAfterOneMonth, allow).\n"
          + "receives_label(deleteAfterOneMonth) :- label(private).\n"
          + "has_target(deleteAfterOneMonth, service78096644).\n"
          + "has_obligation(deleteAfterOneMonth, obl1709554620).\n"
          + "% generated service\n"
          + "service(service78096644).\n"
          + "has_endpoint(service78096644, \"hdfs.*\").\n"
          + "% generated obligation\n"
          + "requires_prerequisite(obl1709554620, delete_after_days(30)).\n"
          + "has_alternativedecision(obl1709554620, drop).\n"
          + "\n"
          + "rule(anotherRule).\n"
          + "rule_priority(anotherRule, 1).\n"
          + "has_target(anotherRule, testQueueService).\n"
          + "receives_label(anotherRule) :- label(private).\n"
          + "has_decision(anotherRule, drop).\n"
          + "\n"
          + "%%%%%%%%%%%% Services %%%%%%%%%%%%\n"
          + "service(serviceAll).\n"
          + "has_endpoint(serviceAll,'.*').\n"
          + "\n"
          + "service(hiveMqttBrokerService).\n"
          + "creates_label(hiveMqttBrokerService, labelone).\n"
          + "creates_label(hiveMqttBrokerService, private).\n"
          + "removes_label(hiveMqttBrokerService, labeltwo).\n"
          + "has_endpoint(hiveMqttBrokerService, \"^paho:.*?tcp://broker.hivemq.com:1883.*\").\n"
          + "has_property(hiveMqttBrokerService, type, public).\n"
          + "\n"
          + "service(anonymizerService).\n"
          + "has_endpoint(anonymizerService, \".*anonymizer.*\").\n"
          + "has_property(anonymizerService, myProp, anonymize('surname', 'name')).\n"
          + "\n"
          + "service(loggerService).\n"
          + "has_endpoint(loggerService, \"^log.*\").\n"
          + "\n"
          + "service(hadoopClustersService).\n"
          + "has_endpoint(hadoopClustersService, \"^hdfs://.*\").\n"
          + "has_capability(hadoopClustersService, deletion).\n"
          + "has_property(hadoopClustersService, anonymizes, anonymize('surname', 'name')).\n"
          + "\n"
          + "service(testQueueService).\n"
          + "has_endpoint(testQueueService, \"^amqp:.*?:test\").";

  // Policy with extended labels, i.e. "purpose(green)"
  private static final String EXTENDED_LABELS_POLICY = "" +
  		"%%%%%%%% Rules %%%%%%%%%%%%\n"
        + "rule(denyAll).\n"
        + "rule_priority(denyAll, 0).\n"
        + "has_decision(denyAll, drop).\n"
        + "receives_label(denyAll).\n"
        + "has_target(denyAll, serviceAll).\n"
        + "\n"
        + "rule(demo).\n"
        + "rule_priority(demo, 1).\n"
  		+ "has_target(demo, service473016340).\n" 
  		+ "service(service473016340).\n"
  		+ "has_endpoint(service473016340,\"(ahc|ahc-ws|cxf|cxfbean|cxfrs)://.*\").\n" 
  		+ "receives_label(demo) :- label(purpose(green)).\n"  // Note that Prolog does not support nested predicates.
  		+ "has_decision(demo, allow).\n" 
  		+ "\n"
  		+ "%%%%% Services %%%%%%%%%%%%\n" 
        + "service(serviceAll).\n"
        + "has_endpoint(serviceAll,'.*').\n"
        + "\n"
  		+ "service(sanitizedata).\n"
  		+ "has_endpoint(sanitizedata, \"^bean://SanitizerBean.*\").\n" 
  		+ "creates_label(sanitizedata, public).\n"
  		+ "creates_label(sanitizedata, purpose(blue)).\n" 
  		+ "removes_label(sanitizedata, private).\n";
  

		  
		  // Route from LUCON paper with path searching logic
  public static final String VERIFIABLE_ROUTE =
      "%\n"
          + "% (C) <NAME>, Fraunhofer AISEC, 2017\n"
          + "%\n"
          + "% Demonstration of model checking a message route against a usage control policy\n"
          + "%\n"
          + "% Message Route definition\n"
          + "%\n"
          + "%       hiveMqttBroker       \n"
          + "%       /     \\     \n"
          + "%  logger    anonymizer  \n"
          + "%       \\     /     \n"
          + "%       hadoopClusters       \n"
          + "%         |          \n"
          + "%       testQueue       \n"
          + "entrynode(hiveMqttBroker).\n"
          + "stmt(hiveMqttBroker).\n"
          + "has_action(hiveMqttBroker, \"paho:something:tcp://broker.hivemq.com:1883/anywhere\").\n"
          + "stmt(logger).\n"
          + "has_action(logger, \"log\").\n"
          + "stmt(anonymizer).\n"
          + "has_action(anonymizer, \"hello_anonymizer_world\").\n"
          + "stmt(hadoopClusters).\n"<commit_msg>minor test improvements<commit_after>/*-
 * ========================LICENSE_START=================================
 * ids-dataflow-control
 * %%
 * Copyright (C) 2018 Fraunhofer AISEC
 * %%
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * =========================LICENSE_END==================================
 */
package de.fhg.ids.dataflowcontrol;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
import static org.mockito.Matchers.anyString;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import org.junit.Ignore;
import org.junit.Test;

import alice.tuprolog.InvalidTheoryException;
import alice.tuprolog.MalformedGoalException;
import alice.tuprolog.NoMoreSolutionException;
import alice.tuprolog.NoSolutionException;
import alice.tuprolog.SolveInfo;
import de.fhg.aisec.ids.api.policy.DecisionRequest;
import de.fhg.aisec.ids.api.policy.Obligation;
import de.fhg.aisec.ids.api.policy.PDP;
import de.fhg.aisec.ids.api.policy.PolicyDecision;
import de.fhg.aisec.ids.api.policy.PolicyDecision.Decision;
import de.fhg.aisec.ids.api.policy.ServiceNode;
import de.fhg.aisec.ids.api.policy.TransformationDecision;
import de.fhg.aisec.ids.api.router.RouteManager;
import de.fhg.aisec.ids.api.router.RouteVerificationProof;
import de.fhg.ids.dataflowcontrol.lucon.LuconEngine;

/**
 * Unit tests for the LUCON policy engine.
 *
 * @author <NAME> (<EMAIL>)
 */
public class LuconEngineTest {
  // Solving Towers of Hanoi in only two lines. Prolog FTW!
  private static final String HANOI_THEORY =
      "move(1,X,Y,_) :- "
          + "write('Move top disk from '), write(X), write(' to '), write(Y), nl. \n"
          + "move(N,X,Y,Z) :- N>1, M is N-1, move(M,X,Z,Y), move(1,X,Y,_), move(M,Z,Y,X). ";

  // A random but syntactically correct policy.
  private static final String EXAMPLE_POLICY =
      "\n"
          + "%%%%%%%% Rules %%%%%%%%%%%%\n"
          + "rule(denyAll).\n"
          + "rule_priority(denyAll, 0).\n"
          + "has_decision(denyAll, drop).\n"
          + "receives_label(denyAll).\n"
          + "has_target(denyAll, serviceAll).\n"
          + "\n"
          + "rule(allowRule).\n"
          + "rule_priority(allowRule, 1).\n"
          + "has_decision(allowRule, allow).\n"
          + "receives_label(allowRule).\n"
          + "has_target(allowRule, hiveMqttBrokerService).\n"
          + "has_target(allowRule, anonymizerService).\n"
          + "has_target(allowRule, loggerService).\n"
          + "has_target(allowRule, hadoopClustersService).\n"
          + "has_target(allowRule, testQueueService).\n"
          + "\n"
          + "rule(deleteAfterOneMonth).\n"
          + "rule_priority(deleteAfterOneMonth, 1).\n"
          + "has_decision(deleteAfterOneMonth, allow).\n"
          + "receives_label(deleteAfterOneMonth) :- label(private).\n"
          + "has_target(deleteAfterOneMonth, service78096644).\n"
          + "has_obligation(deleteAfterOneMonth, obl1709554620).\n"
          + "% generated service\n"
          + "service(service78096644).\n"
          + "has_endpoint(service78096644, \"hdfs.*\").\n"
          + "% generated obligation\n"
          + "requires_prerequisite(obl1709554620, delete_after_days(30)).\n"
          + "has_alternativedecision(obl1709554620, drop).\n"
          + "\n"
          + "rule(anotherRule).\n"
          + "rule_priority(anotherRule, 1).\n"
          + "has_target(anotherRule, testQueueService).\n"
          + "receives_label(anotherRule) :- label(private).\n"
          + "has_decision(anotherRule, drop).\n"
          + "\n"
          + "%%%%%%%%%%%% Services %%%%%%%%%%%%\n"
          + "service(serviceAll).\n"
          + "has_endpoint(serviceAll,'.*').\n"
          + "\n"
          + "service(hiveMqttBrokerService).\n"
          + "creates_label(hiveMqttBrokerService, labelone).\n"
          + "creates_label(hiveMqttBrokerService, private).\n"
          + "removes_label(hiveMqttBrokerService, labeltwo).\n"
          + "has_endpoint(hiveMqttBrokerService, \"^paho:.*?tcp://broker.hivemq.com:1883.*\").\n"
          + "has_property(hiveMqttBrokerService, type, public).\n"
          + "\n"
          + "service(anonymizerService).\n"
          + "has_endpoint(anonymizerService, \".*anonymizer.*\").\n"
          + "has_property(anonymizerService, myProp, anonymize('surname', 'name')).\n"
          + "\n"
          + "service(loggerService).\n"
          + "has_endpoint(loggerService, \"^log.*\").\n"
          + "\n"
          + "service(hadoopClustersService).\n"
          + "has_endpoint(hadoopClustersService, \"^hdfs://.*\").\n"
          + "has_capability(hadoopClustersService, deletion).\n"
          + "has_property(hadoopClustersService, anonymizes, anonymize('surname', 'name')).\n"
          + "\n"
          + "service(testQueueService).\n"
          + "has_endpoint(testQueueService, \"^amqp:.*?:test\").";

  // Policy with extended labels, i.e. "purpose(green)"
  private static final String EXTENDED_LABELS_POLICY = "" +
  		"%%%%%%%% Rules %%%%%%%%%%%%\n"
        + "rule(denyAll).\n"
        + "rule_priority(denyAll, 0).\n"
        + "has_decision(denyAll, drop).\n"
        + "receives_label(denyAll).\n"
        + "has_target(denyAll, serviceAll).\n"
        + "\n"
        + "rule(demo).\n"
        + "rule_priority(demo, 1).\n"
  		+ "has_target(demo, service473016340).\n" 
  		+ "service(service473016340).\n"
  		+ "has_endpoint(service473016340,\"(ahc|ahc-ws|cxf|cxfbean|cxfrs)://.*\").\n" 
  		+ "receives_label(demo) :- label(purpose(green)).\n"  // Note that Prolog does not support nested predicates.
  		+ "has_decision(demo, allow).\n" 
  		+ "\n"
  		+ "%%%%% Services %%%%%%%%%%%%\n" 
        + "service(serviceAll).\n"
        + "has_endpoint(serviceAll,'.*').\n"
  		+ "creates_label(serviceAll, purpose(green)).\n" 
        + "\n"
  		+ "service(sanitizedata).\n"
  		+ "has_endpoint(sanitizedata, \"^bean://SanitizerBean.*\").\n" 
  		+ "creates_label(sanitizedata, public).\n"
  		+ "removes_label(sanitizedata, private).\n";
  

		  
		  // Route from LUCON paper with path searching logic
  public static final String VERIFIABLE_ROUTE =
      "%\n"
          + "% (C) <NAME>, Fraunhofer AISEC, 2017\n"
          + "%\n"
          + "% Demonstration of model checking a message route against a usage control policy\n"
          + "%\n"
          + "% Message Route definition\n"
          + "%\n"
          + "%       hiveMqttBroker       \n"
          + "%       /     \\     \n"
          + "%  logger    anonymizer  \n"
          + "%       \\     /     \n"
          + "%       hadoopClusters       \n"
          + "%         |          \n"
          + "%       testQueue       \n"
          + "entrynode(hiveMqttBroker).\n"
          + "stmt(hiveMqttBroker).\n"
          + "has_action(hiveMqttBroker, \"paho:something:tcp://broker.hivemq.com:1883/anywhere\").\n"
          + "stmt(logger).\n"
          + "has_action(logger, \"log\").\n"
          + "stmt(anonymizer).\n"
          + "has_action(anonymizer, \"hello_anonymizer_world\").\n"
          + "stmt(hadoopClusters).\n"
{'fraction_non_alphanumeric': 0.17554700800807113, 'fraction_numerical': 0.014250583265023015, 'mean_word_length': 2.6611265004616804, 'pattern_counts': {'":': 0, '<': 10, '<?xml version=': 0, '>': 12, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1223060', 'n_tokens_mistral': 5671, 'n_tokens_neox': 5294, 'n_words': 880}