mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
a3a20a1235
# RVM compiler test cases Coverage: - arithmetic - arrays - chained lookups - comparisons - comprehensions - default rules - destructuring - function rules - loops/quantifiers - multiple entrypoints - objects/sets - variables - negative/edge scenarios such as data/rule conflicts - virtual data lookups - etc # Modify interpreter and compiled policy for RVM Compilation - Interpreter::eval_default_rule_for_compiler: evaluates a named default rule in isolation - allows compiler to emit a constant value instead of instructions for the default value # feat: Rego Compiler Scaffolding - Introduce the rego::compiler module surface and entry point wiring - Add the core compiler concepts: - register allocator - scope tracking - literal/builtin tables - rule worklists - instruction emit helpers - compiler-specific error types - context structs for rules, comprehensions, and loops to support later lowering passes. # feat: Compile Rules/Queries - add compiler::compile_from_policy workflow plus rule worklist, entry-point wiring, and recursion checks - implement query lowering: - scheduling-aware statement ordering - loop hoisting - “every/some” semantics - context yields - literal assertions - finalize Program construction # feat: Expression Lowering - add compile_rego_expr and helpers to translate every AST expression into RVM instructions, - interop with binding plans, comprehensions, and membership checks. - implement collection literal builders (ArrayCreate, SetCreate, ObjectCreate) - dedupe literal keys and handle mixed literal/dynamic fields via instruction data blocks. - operations: - arithmetic/boolean/bin operators - membership - unary minus - set unions/intersections - etc - user-defined and builtin function calls - reference handling - analyse chained refs - distinguishe data/input/local roots - perform rule dispatch or virtual document lookups - emits optimized Index/ChainedIndex instructions. # feat: Comprehensions & Loops - shared comprehension emitter - wraps array/set/object comprehensions with ComprehensionBegin/End - context management - loop lowering utilities - read hoisting metadata - emit LoopStart/LoopNext - some in lowering - every quantifiers - index iteration - propagate binding plans into stored registers so downstream statements see bound variables. # feat: Destructuring Lowering - destructuring planner integration - assignment/parameter/loop bindings use hoisted plans instead of re-walking ASTs. - handle :=, =, wildcard matches, and equality - evaluate RHS - applying destructuring plans - emit assert condition as needed - support nested array/object destructuring, dynamic keys, and some ... in forms # test: Shared Testing + RVM Suites - move YAML test helpers into test_utils.rs and re-export via common.rs for use by interpreter and vm test suites - comprehensive compiler test suite - compiles policies with the new Rego→RVM compiler - runs them through RegoVM - compares against interpreter behavior - supports multiple entry points - provides assembly listings - filterable YAML suites. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
cases:
|
|
- note: server_security_policy
|
|
data: {}
|
|
input:
|
|
servers:
|
|
- id: "app"
|
|
protocols: ["https", "ssh"]
|
|
ports: ["p1", "p2", "p3"]
|
|
- id: "db"
|
|
protocols: ["mysql"]
|
|
ports: ["p3"]
|
|
- id: "cache"
|
|
protocols: ["memcache"]
|
|
ports: ["p3"]
|
|
- id: "ci"
|
|
protocols: ["http"]
|
|
ports: ["p1", "p2"]
|
|
- id: "busybox"
|
|
protocols: ["telnet"]
|
|
ports: ["p1"]
|
|
networks:
|
|
- id: "net1"
|
|
public: false
|
|
- id: "net2"
|
|
public: false
|
|
- id: "net3"
|
|
public: true
|
|
- id: "net4"
|
|
public: true
|
|
ports:
|
|
- id: "p1"
|
|
network: "net1"
|
|
- id: "p2"
|
|
network: "net3"
|
|
- id: "p3"
|
|
network: "net2"
|
|
modules:
|
|
- |
|
|
package example
|
|
|
|
default allow := false # unless otherwise defined, allow is false
|
|
|
|
allow := r if { # allow is true if...
|
|
r := {
|
|
"outcome": count(violation) == 0, # there are zero violations.
|
|
"violations": violation # the violations are listed in the output.
|
|
}
|
|
}
|
|
|
|
violation contains server.id if { # a server is in the violation set if...
|
|
server := input.servers[_] # it exists in the input.servers collection and...
|
|
server.protocols[_] == "telnet" # it contains the "telnet" protocol.
|
|
}
|
|
|
|
violation contains server.id if { # a server is in the violation set if...
|
|
some server
|
|
public_server[server] # it exists in the 'public_server' set and...
|
|
server.protocols[_] == "http" # it contains the insecure "http" protocol.
|
|
}
|
|
|
|
public_server contains server if { # a server exists in the public_server set if...
|
|
some i, j
|
|
server := input.servers[_] # it exists in the input.servers collection and...
|
|
server.ports[_] == input.ports[i].id # it references a port in the input.ports collection and...
|
|
input.ports[i].network == input.networks[j].id # the port references a network in the input.networks collection and...
|
|
input.networks[j].public # the network is public.
|
|
}
|
|
query: data.example.allow
|
|
want_result:
|
|
outcome: false
|
|
violations:
|
|
set!: ["ci", "busybox"]
|