mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Anand Krishnamoorthi
d561531613
This commit introduces a complete multi-threaded evaluation benchmark suite for both Rust and C# implementations of Regorus. - Implemented engine evaluation benchmark with input and engine cloning strategies - Implemented compiled policy evaluation benchmark with input cloning and shared compiled policy strategies. - Created EngineEvaluationBenchmark.cs and CompiledPolicyEvaluationBenchmark.cs with time-based execution (3s warmup + 3s evaluation) - Implemented configuration options matching Rust implementation (useClonedEngines, useSharedPolicies parameters) - Created markdown analysis documentation with cross-platform performance analysis - C# seems to achieve 58-89% of Rust performance on test machine. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
32 lines
986 B
Rego
32 lines
986 B
Rego
package bench
|
|
|
|
default allow := false
|
|
|
|
# Azure Network Security Group rules policy
|
|
dangerous_ports := [22, 3389, 1433, 3306, 5432, 6379, 27017]
|
|
internal_networks := ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
|
|
|
|
is_internal_source if {
|
|
some network in internal_networks
|
|
net.cidr_contains(network, input.rule.sourceAddressPrefix)
|
|
}
|
|
|
|
allow if {
|
|
input.operation == "Microsoft.Network/networkSecurityGroups/securityRules/write"
|
|
input.rule.direction == "Inbound"
|
|
input.rule.access == "Allow"
|
|
input.rule.destinationPortRange != "*"
|
|
not input.rule.destinationPortRange in dangerous_ports
|
|
input.rule.sourceAddressPrefix != "*"
|
|
input.rule.sourceAddressPrefix != "Internet"
|
|
}
|
|
|
|
allow if {
|
|
input.operation == "Microsoft.Network/networkSecurityGroups/securityRules/write"
|
|
input.rule.direction == "Inbound"
|
|
input.rule.access == "Allow"
|
|
input.rule.destinationPortRange in dangerous_ports
|
|
is_internal_source
|
|
input.rule.priority >= 1000
|
|
}
|