Skip to content

perf(supervisor-network): avoid reparsing native policy input #2654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shiju-nv wants to merge 2 commits into
base: main
Choose a base branch
from
+41 −37
Open

perf(supervisor-network): avoid reparsing native policy input #2654

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c432a59
perf(supervisor-network): avoid reparsing native policy input
shiju-nv Aug 7, 2026
d32537e
perf(supervisor-network): use direct OPA input conversion
shiju-nv Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions crates/openshell-supervisor-network/src/l7/relay.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1929,7 +1929,7 @@ fn evaluate_l7_request_once(
));
}

let input_json = serde_json::json!({
let input = serde_json::json!({
"network": {
"host": ctx.host,
"port": ctx.port,
Expand All @@ -1953,9 +1953,7 @@ fn evaluate_l7_request_once(
.lock()
.map_err(|_| miette!("OPA engine lock poisoned"))?;

engine
.set_input_json(&input_json.to_string())
.map_err(|e| miette!("{e}"))?;
crate::opa::set_regorus_input(&mut engine, input)?;

let allowed = engine
.eval_rule("data.openshell.sandbox.allow_request".into())
Expand Down
72 changes: 39 additions & 33 deletions crates/openshell-supervisor-network/src/opa.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,9 +461,7 @@ impl OpaEngine {
});
}

engine
.set_input_json(&input_json.to_string())
.map_err(|e| miette::miette!("{e}"))?;
set_regorus_input(&mut engine, input_json)?;

let allowed = engine
.eval_rule("data.openshell.sandbox.allow_network".into())
Expand Down Expand Up @@ -524,9 +522,7 @@ impl OpaEngine {
return Ok((NetworkAction::Deny { reason }, generation));
}

engine
.set_input_json(&input_json.to_string())
.map_err(|e| miette::miette!("{e}"))?;
set_regorus_input(&mut engine, input_json)?;

let action_val = engine
.eval_rule("data.openshell.sandbox.network_action".into())
Expand Down Expand Up @@ -823,9 +819,7 @@ impl OpaEngine {
.map_err(|_| miette::miette!("OPA engine lock poisoned"))?;
let generation = self.current_generation();

engine
.set_input_json(&input_json.to_string())
.map_err(|e| miette::miette!("{e}"))?;
set_regorus_input(&mut engine, input_json)?;

let val = engine
.eval_rule("data.openshell.sandbox._matching_endpoint_configs".into())
Expand Down Expand Up @@ -883,9 +877,7 @@ impl OpaEngine {
.lock()
.map_err(|_| miette::miette!("OPA engine lock poisoned"))?;

engine
.set_input_json(&input_json.to_string())
.map_err(|e| miette::miette!("{e}"))?;
set_regorus_input(&mut engine, input_json)?;

let val = engine
.eval_rule("data.openshell.sandbox.exact_declared_endpoint_host".into())
Expand Down Expand Up @@ -1000,6 +992,20 @@ fn network_input_json(input: &NetworkInput) -> serde_json::Value {
})
}

/// Sets an already-built JSON value as Regorus input without encoding and reparsing JSON text.
///
/// The explicit fallible conversion preserves evaluator errors because Regorus's infallible
/// `From<serde_json::Value>` conversion maps failures to [`regorus::Value::Undefined`].
pub(crate) fn set_regorus_input(
engine: &mut regorus::Engine,
input: serde_json::Value,
) -> Result<()> {
let input =
serde_json::from_value::<regorus::Value>(input).map_err(|e| miette::miette!("{e}"))?;
engine.set_input(input);
Ok(())
}

fn query_middleware_chain_locked(
engine: &mut regorus::Engine,
input: &NetworkInput,
Expand Down Expand Up @@ -2788,7 +2794,7 @@ process:

fn eval_l7(engine: &OpaEngine, input: &serde_json::Value) -> bool {
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input.clone()).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -2803,7 +2809,7 @@ process:
engine
.add_data_json(&data.to_string())
.expect("add raw data json");
engine.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut engine, input).unwrap();
let val = engine
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand Down Expand Up @@ -3080,7 +3086,7 @@ process:
}]),
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.request_deny_reason".into())
.unwrap();
Expand Down Expand Up @@ -4383,7 +4389,7 @@ network_policies:
let engine = l7_engine();
let input = l7_input("api.example.com", 8080, "DELETE", "/repos/myorg/foo");
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.request_deny_reason".into())
.unwrap();
Expand Down Expand Up @@ -4777,7 +4783,7 @@ network_policies:
// Verify the cloned engine can evaluate
let input_json = l7_input("api.example.com", 8080, "GET", "/repos/myorg/foo");
let mut eng = cloned.engine().lock().unwrap();
eng.set_input_json(&input_json.to_string()).unwrap();
set_regorus_input(&mut eng, input_json).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand Down Expand Up @@ -4819,7 +4825,7 @@ network_policies:
.clone_engine_for_tunnel(engine.current_generation())
.unwrap();
let mut eng = cloned.engine().lock().unwrap();
eng.set_input_json(&input_json.to_string()).unwrap();
set_regorus_input(&mut eng, input_json).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand Down Expand Up @@ -5019,7 +5025,7 @@ process:
"/repos/myorg/pulls/123/reviews",
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5036,7 +5042,7 @@ process:
// GET repos/issues is allowed and not denied
let input = l7_input("api.github.com", 443, "GET", "/repos/myorg/issues");
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5053,7 +5059,7 @@ process:
// POST to issues is allowed (deny only targets reviews)
let input = l7_input("api.github.com", 443, "POST", "/repos/myorg/issues");
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5070,7 +5076,7 @@ process:
// GET /repos/myorg/rulesets should be denied (method: "*")
let input = l7_input("api.github.com", 443, "GET", "/repos/myorg/rulesets");
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5091,7 +5097,7 @@ process:
"/repos/myorg/branches/main/protection",
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5112,7 +5118,7 @@ process:
"/repos/myorg/pulls/123/reviews",
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.request_deny_reason".into())
.unwrap();
Expand All @@ -5138,7 +5144,7 @@ process:
serde_json::json!({"force": ["true"]}),
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5161,7 +5167,7 @@ process:
serde_json::json!({"force": ["false"]}),
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5186,7 +5192,7 @@ process:
serde_json::json!({"force": ["true", "false"]}),
);
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand All @@ -5204,7 +5210,7 @@ process:
// so no match (key not present) and request should be allowed
let input = l7_input("api.restricted.com", 443, "POST", "/admin/settings");
let mut eng = engine.engine.lock().unwrap();
eng.set_input_json(&input.to_string()).unwrap();
set_regorus_input(&mut eng, input).unwrap();
let val = eng
.eval_rule("data.openshell.sandbox.allow_request".into())
.unwrap();
Expand Down Expand Up @@ -7721,11 +7727,11 @@ host_match if {
];
for (pattern, host) in cases {
let rust = openshell_core::host_pattern::host_matches(pattern, host).unwrap();
engine
.set_input_json(
&serde_json::json!({ "pattern": pattern, "host": host }).to_string(),
)
.unwrap();
set_regorus_input(
&mut engine,
serde_json::json!({ "pattern": pattern, "host": host }),
)
.unwrap();
let rego = engine.eval_rule("data.test.host_match".into()).unwrap()
== regorus::Value::from(true);
assert_eq!(
Expand Down
Loading