Skip to content

Commit 02588ce

Browse files
PushpalankaPushpalanka
committed
Attempted benchmark test with JWT evaluation with added complexity with data.
Signed-off-by: Pushpalanka Jayawardhana <[email protected]>
1 parent 1dc831b commit 02588ce

File tree

2 files changed

+273
-0
lines changed

2 files changed

+273
-0
lines changed

‎filters/openpolicyagent/opaauthorizerequest/opaauthorizerequest_test.go‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,7 @@ const (
623623

624624
certPath = "../../../skptesting/cert.pem"
625625
keyPath = "../../../skptesting/key.pem"
626+
dataPath = "../../../skptesting/data.json"
626627
)
627628

628629
func BenchmarkAuthorizeRequest(b *testing.B) {
@@ -806,6 +807,119 @@ func BenchmarkAuthorizeRequest(b *testing.B) {
806807
assert.False(b, ctx.FServed)
807808
}
808809
})
810+
811+
b.Run("authorize-request-jwt-validation-with-pre-evaluation", func(b *testing.B) {
812+
813+
publicKey, err := os.ReadFile(certPath)
814+
if err != nil {
815+
log.Fatalf("Failed to read public key: %v", err)
816+
}
817+
818+
dataFile, err := os.ReadFile(dataPath)
819+
if err != nil {
820+
log.Fatalf("Failed to read data.json: %v", err)
821+
}
822+
823+
opaControlPlane := opasdktest.MustNewServer(
824+
opasdktest.MockBundle("/bundles/somebundle.tar.gz", map[string]string{
825+
"main.rego": fmt.Sprintf(`
826+
package envoy.authz
827+
828+
import future.keywords.if
829+
830+
default allow = false
831+
832+
public_key_cert := %q
833+
834+
bearer_token := t if {
835+
v := input.attributes.request.http.headers.authorization
836+
startswith(v, "Bearer ")
837+
t := substring(v, count("Bearer "), -1)
838+
}
839+
840+
allow if {
841+
[valid, _, payload] := io.jwt.decode_verify(bearer_token, {
842+
"cert": public_key_cert,
843+
"aud": "nqz3xhorr5"
844+
})
845+
846+
valid
847+
sub := payload.sub
848+
has_user_logged_in(sub)
849+
is_admin(sub)
850+
has_some_read_permission(sub)
851+
}
852+
853+
has_user_logged_in(sub) {
854+
data.users[sub].history[_].action == "login"
855+
}
856+
857+
is_admin(sub) {
858+
data.users[sub].role == "admin"
859+
}
860+
861+
has_some_read_permission(sub) {
862+
count(data.users[sub].permissions["read"]) > 0
863+
}
864+
865+
`, publicKey),
866+
"data.json": string(dataFile),
867+
}),
868+
)
869+
870+
f, err := createOpaFilterWithPreEvaluation(opaControlPlane)
871+
assert.NoError(b, err)
872+
873+
url, err := url.Parse("http://opa-authorized.test/somepath")
874+
assert.NoError(b, err)
875+
876+
claims := jwt.MapClaims{
877+
"iss": "https://some.identity.acme.com",
878+
"sub": "5974934733",
879+
"aud": "nqz3xhorr5",
880+
"iat": time.Now().Add(-time.Minute).UTC().Unix(),
881+
"exp": time.Now().Add(tokenExp).UTC().Unix(),
882+
"email": "[email protected]",
883+
}
884+
885+
token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
886+
887+
privKey, err := os.ReadFile(keyPath)
888+
if err != nil {
889+
log.Fatalf("Failed to read priv key: %v", err)
890+
}
891+
892+
key, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(privKey))
893+
if err != nil {
894+
log.Fatalf("Failed to parse RSA PEM: %v", err)
895+
}
896+
897+
// Sign and get the complete encoded token as a string using the secret
898+
signedToken, err := token.SignedString(key)
899+
if err != nil {
900+
log.Fatalf("Failed to sign token: %v", err)
901+
}
902+
903+
ctx := &filtertest.Context{
904+
FStateBag: map[string]interface{}{},
905+
FResponse: &http.Response{},
906+
FRequest: &http.Request{
907+
Header: map[string][]string{
908+
"Authorization": {fmt.Sprintf("Bearer %s", signedToken)},
909+
},
910+
URL: url,
911+
},
912+
FMetrics: &metricstest.MockMetrics{},
913+
}
914+
915+
b.ResetTimer()
916+
b.ReportAllocs()
917+
918+
for i := 0; i < b.N; i++ {
919+
f.Request(ctx)
920+
assert.False(b, ctx.FServed)
921+
}
922+
})
809923
}
810924

811925
func createOpaFilter(opaControlPlane *opasdktest.Server) (filters.Filter, error) {
@@ -815,6 +929,13 @@ func createOpaFilter(opaControlPlane *opasdktest.Server) (filters.Filter, error)
815929
return spec.CreateFilter([]interface{}{"somebundle.tar.gz"})
816930
}
817931

932+
func createOpaFilterWithPreEvaluation(opaControlPlane *opasdktest.Server) (filters.Filter, error) {
933+
config := generateConfig(opaControlPlane, "envoy/authz/allow")
934+
opaFactory := openpolicyagent.NewOpenPolicyAgentRegistry(openpolicyagent.WithPreevaluationOptimization(true))
935+
spec := NewOpaAuthorizeRequestSpec(opaFactory, openpolicyagent.WithConfigTemplate(config))
936+
return spec.CreateFilter([]interface{}{"somebundle.tar.gz"})
937+
}
938+
818939
func createBodyBasedOpaFilter(opaControlPlane *opasdktest.Server) (filters.Filter, error) {
819940
config := generateConfig(opaControlPlane, "envoy/authz/allow")
820941
opaFactory := openpolicyagent.NewOpenPolicyAgentRegistry()

‎skptesting/data.json‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
{
2+
"users": {
3+
"5974934733": {
4+
"name": "John Amal",
5+
"role": "admin",
6+
"permissions": {
7+
"read": [
8+
"file1",
9+
"file2"
10+
],
11+
"write": [
12+
"file3"
13+
]
14+
},
15+
"history": [
16+
{
17+
"action": "login",
18+
"timestamp": "2024-12-08T10:00:00Z"
19+
},
20+
{
21+
"action": "upload",
22+
"timestamp": "2024-12-08T11:00:00Z"
23+
},
24+
{
25+
"action": "logout",
26+
"timestamp": "2024-12-08T12:00:00Z"
27+
}
28+
]
29+
},
30+
"7836491938": {
31+
"name": "Jane Nayana",
32+
"role": "user",
33+
"permissions": {
34+
"read": [
35+
"file1"
36+
],
37+
"write": []
38+
},
39+
"history": [
40+
{
41+
"action": "login",
42+
"timestamp": "2024-12-08T09:30:00Z"
43+
},
44+
{
45+
"action": "download",
46+
"timestamp": "2024-12-08T10:30:00Z"
47+
}
48+
]
49+
},
50+
"8237491821": {
51+
"name": "Nimal Johnson",
52+
"role": "manager",
53+
"permissions": {
54+
"read": [
55+
"file2",
56+
"file3"
57+
],
58+
"write": [
59+
"file1"
60+
]
61+
},
62+
"history": [
63+
{
64+
"action": "login",
65+
"timestamp": "2024-12-08T08:00:00Z"
66+
},
67+
{
68+
"action": "upload",
69+
"timestamp": "2024-12-08T08:15:00Z"
70+
}
71+
]
72+
},
73+
"9823749823": {
74+
"name": "Bob Sunil",
75+
"role": "guest",
76+
"permissions": {
77+
"read": [
78+
"file1"
79+
],
80+
"write": []
81+
},
82+
"history": [
83+
{
84+
"action": "login",
85+
"timestamp": "2024-12-08T08:30:00Z"
86+
}
87+
]
88+
},
89+
"1928374650": {
90+
"name": "Nihal Smith",
91+
"role": "admin",
92+
"permissions": {
93+
"read": [
94+
"file1",
95+
"file2",
96+
"file3"
97+
],
98+
"write": [
99+
"file1"
100+
]
101+
},
102+
"history": [
103+
{
104+
"action": "login",
105+
"timestamp": "2024-12-08T08:35:00Z"
106+
},
107+
{
108+
"action": "update",
109+
"timestamp": "2024-12-08T09:00:00Z"
110+
}
111+
]
112+
},
113+
"8472637450": {
114+
"name": "Kamal Lee",
115+
"role": "user",
116+
"permissions": {
117+
"read": [
118+
"file2"
119+
],
120+
"write": [
121+
"file2"
122+
]
123+
},
124+
"history": [
125+
{
126+
"action": "login",
127+
"timestamp": "2024-12-08T09:10:00Z"
128+
},
129+
{
130+
"action": "edit",
131+
"timestamp": "2024-12-08T09:15:00Z"
132+
}
133+
]
134+
},
135+
"5748392048": {
136+
"name": "Johnson Siril",
137+
"role": "guest",
138+
"permissions": {
139+
"read": [
140+
"file3"
141+
],
142+
"write": []
143+
},
144+
"history": [
145+
{
146+
"action": "login",
147+
"timestamp": "2024-12-08T09:25:00Z"
148+
}
149+
]
150+
}
151+
}
152+
}

0 commit comments

Comments
 (0)