295 lines
7.6 KiB
Go
295 lines
7.6 KiB
Go
// Licensed to the Apache Software Foundation (ASF) under one
|
|
// or more contributor license agreements. See the NOTICE file
|
|
// distributed with this work for additional information
|
|
// regarding copyright ownership. The ASF licenses this file
|
|
// to you under the Apache License, Version 2.0 (the
|
|
// "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package casbin
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/casbin/casbin/v3/util"
|
|
)
|
|
|
|
func rawEnforce(sub string, obj string, act string) bool {
|
|
policy := [2][3]string{{"alice", "data1", "read"}, {"bob", "data2", "write"}}
|
|
for _, rule := range policy {
|
|
if sub == rule[0] && obj == rule[1] && act == rule[2] {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func BenchmarkRaw(b *testing.B) {
|
|
for i := 0; i < b.N; i++ {
|
|
rawEnforce("alice", "data1", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkBasicModel(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/basic_model.conf", "examples/basic_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "data1", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModel(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "data2", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelSizes(b *testing.B) {
|
|
cases := []struct {
|
|
name string
|
|
roles int
|
|
resources int
|
|
users int
|
|
}{
|
|
{name: "small", roles: 100, resources: 10, users: 1000},
|
|
{name: "medium", roles: 1000, resources: 100, users: 10000},
|
|
{name: "large", roles: 10000, resources: 1000, users: 100000},
|
|
}
|
|
for _, c := range cases {
|
|
c := c
|
|
|
|
e, err := NewEnforcer("examples/rbac_model.conf")
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
pPolicies := make([][]string, c.roles)
|
|
for i := range pPolicies {
|
|
pPolicies[i] = []string{
|
|
fmt.Sprintf("group-has-a-very-long-name-%d", i),
|
|
fmt.Sprintf("data-has-a-very-long-name-%d", i%c.resources),
|
|
"read",
|
|
}
|
|
}
|
|
if _, err := e.AddPolicies(pPolicies); err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
gPolicies := make([][]string, c.users)
|
|
for i := range gPolicies {
|
|
gPolicies[i] = []string{
|
|
fmt.Sprintf("user-has-a-very-long-name-%d", i),
|
|
fmt.Sprintf("group-has-a-very-long-name-%d", i%c.roles),
|
|
}
|
|
}
|
|
if _, err := e.AddGroupingPolicies(gPolicies); err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
// Set up enforcements, alternating between things a user can access
|
|
// and things they cannot. Use 17 tests so that we get a variety of users
|
|
// and roles rather than always landing on a multiple of 2/10/whatever.
|
|
enforcements := make([][]interface{}, 17)
|
|
for i := range enforcements {
|
|
userNum := (c.users / len(enforcements)) * i
|
|
roleNum := userNum % c.roles
|
|
resourceNum := roleNum % c.resources
|
|
if i%2 == 0 {
|
|
resourceNum += 1
|
|
resourceNum %= c.resources
|
|
}
|
|
enforcements[i] = []interface{}{
|
|
fmt.Sprintf("user-has-a-very-long-name-%d", userNum),
|
|
fmt.Sprintf("data-has-a-very-long-name-%d", resourceNum),
|
|
"read",
|
|
}
|
|
}
|
|
|
|
b.Run(c.name, func(b *testing.B) {
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce(enforcements[i%len(enforcements)]...)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelSmall(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_model.conf")
|
|
|
|
// 100 roles, 10 resources.
|
|
for i := 0; i < 100; i++ {
|
|
_, err := e.AddPolicy(fmt.Sprintf("group%d", i), fmt.Sprintf("data%d", i/10), "read")
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
}
|
|
|
|
// 1000 users.
|
|
for i := 0; i < 1000; i++ {
|
|
_, err := e.AddGroupingPolicy(fmt.Sprintf("user%d", i), fmt.Sprintf("group%d", i/10))
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
}
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("user501", "data9", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelMedium(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_model.conf")
|
|
|
|
// 1000 roles, 100 resources.
|
|
pPolicies := make([][]string, 0)
|
|
for i := 0; i < 1000; i++ {
|
|
pPolicies = append(pPolicies, []string{fmt.Sprintf("group%d", i), fmt.Sprintf("data%d", i/10), "read"})
|
|
}
|
|
|
|
_, err := e.AddPolicies(pPolicies)
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
// 10000 users.
|
|
gPolicies := make([][]string, 0)
|
|
for i := 0; i < 10000; i++ {
|
|
gPolicies = append(gPolicies, []string{fmt.Sprintf("user%d", i), fmt.Sprintf("group%d", i/10)})
|
|
}
|
|
|
|
_, err = e.AddGroupingPolicies(gPolicies)
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("user5001", "data99", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelLarge(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_model.conf")
|
|
|
|
// 10000 roles, 1000 resources.
|
|
pPolicies := make([][]string, 0)
|
|
for i := 0; i < 10000; i++ {
|
|
pPolicies = append(pPolicies, []string{fmt.Sprintf("group%d", i), fmt.Sprintf("data%d", i/10), "read"})
|
|
}
|
|
|
|
_, err := e.AddPolicies(pPolicies)
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
// 100000 users.
|
|
gPolicies := make([][]string, 0)
|
|
for i := 0; i < 100000; i++ {
|
|
gPolicies = append(gPolicies, []string{fmt.Sprintf("user%d", i), fmt.Sprintf("group%d", i/10)})
|
|
}
|
|
|
|
_, err = e.AddGroupingPolicies(gPolicies)
|
|
if err != nil {
|
|
b.Fatal(err)
|
|
}
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("user50001", "data999", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelWithResourceRoles(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_with_resource_roles_model.conf", "examples/rbac_with_resource_roles_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "data1", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelWithDomains(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_with_domains_model.conf", "examples/rbac_with_domains_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "domain1", "data1", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkABACModel(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/abac_model.conf")
|
|
data1 := newTestResource("data1", "alice")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", data1, "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkABACRuleModel(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/abac_rule_model.conf")
|
|
sub := newTestSubject("alice", 18)
|
|
|
|
for i := 0; i < 1000; i++ {
|
|
_, _ = e.AddPolicy("r.sub.Age > 20", fmt.Sprintf("data%d", i), "read")
|
|
}
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce(sub, "data100", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkKeyMatchModel(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/keymatch_model.conf", "examples/keymatch_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "/alice_data/resource1", "GET")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelWithDeny(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/rbac_with_deny_model.conf", "examples/rbac_with_deny_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "data1", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkPriorityModel(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/priority_model.conf", "examples/priority_policy.csv")
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("alice", "data1", "read")
|
|
}
|
|
}
|
|
|
|
func BenchmarkRBACModelWithDomainPatternLarge(b *testing.B) {
|
|
e, _ := NewEnforcer("examples/performance/rbac_with_pattern_large_scale_model.conf", "examples/performance/rbac_with_pattern_large_scale_policy.csv")
|
|
e.AddNamedDomainMatchingFunc("g", "", util.KeyMatch4)
|
|
_ = e.BuildRoleLinks()
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_, _ = e.Enforce("staffUser1001", "/orgs/1/sites/site001", "App001.Module001.Action1001")
|
|
}
|
|
}
|