This change updates how errors from http.send are handled.
By default, an error returned by `http.send` halts the policy evaluation.
This commit allows users to return errors in the response object
returned by `http.send` instead of halting evaluation.
Fixes: #2187
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit adds two new fields to the http.send builtin
that allow the user to override the caching directives defined
by the server and thus get more control over the caching
behavior.
Fixes: #2666
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit adds a new builtin to merge adjacent subnets and return the
smallest possible list of CIDRs.
To help with computing CIDR blocks between two
IP networks, an implemetation from https://github.com/cilium/cilium
is leveraged.
Fixes: #2692
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The current age of a http response is calculated as the difference
between the current time and the value contained in the "Date" response
header. There are couple of scenarios that could lead to the current age
being represented as a negative duration.
1. Since the value of "Date" response header is parsed using Go's
time.Parse method, it does not contain a monotonic clock reading. As a result,
the time.Sub method uses wall clock readings to determine the difference between
current time and the parsed version of the response time.
2. The server could set a value for the "Date" response header which may not be a true indication of
when the response was generated.
This change updates the logic that determines whether a cached response is fresh or not,
to treat the resposne as stale if the current response age is represented as a negative duration.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This builtin is the reverse of the encode_object builtin and
makes it easier to use the URI query parameters in policies
Fixes#2647
Signed-off-by: Frederic <frederic.vanreet@icloud.com>
This commit adds a new inter-query cache that built-in
functions can use to cache responses across queries.
The OPA config includes a new "caching" field that can be used
to set the size of the cache. By default there is no limit.
This change also updates `http.send` to optionally utilize the
inter-query cache.
Fixes#1753
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Fixes https://github.com/open-policy-agent/opa/issues/2557
In #2557 I highlighted an inconsistency in our parsing of x509 data
where CSRs were PEM decoded and certificate chains where DER data.
This change allows both built-ins to accept data as DER or PEM wrapped
in base64.
While addressing the inconsistency, this also makes it possible to
decode a PEM certificate chain - the use case that prompted me to make
this change.
I have also updated the tests to use common names as the expected
output. I feel that this makes it clearer what we're dealing with
without detracting from the utility of the test cases (since we're not
really testing crypto/x509 from the standard library).
Signed-off-by: Charlie Egan <charlieegan3@users.noreply.github.com>
This ought to have been done a while ago. Going forward we prefer all
built-in functions to be namespaced. We made that change after
introducing `re_match` but before introducing several other
regex-related functions. This commit deprecates `re_match` in a
backwards-compatible manner.
Also, move a few built-in declarations up in the ast/builtins.go file
because they were in the wrong sections.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The existing regex functions error if the pattern is invalid. Until
OPA exposes a way to treat built-in function errors as undefined, it
is useful to be able to check for validity. Also, some use cases may
simply want to verify a regex pattern from the outside.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This commit adds a new built-in function to generate a range of
integers between two values (inclusive). This is useful in certain
cases where users need to enumerate a set of values (e.g., port
numbers).
Fixes#2479
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Before this change the parse_bytes builtin would fail when the unit
did not contain the bytes symbol (e.g. 128Mi would fail).
With this change we also accept units without the b/B at the end.
Fixes#2340
Signed-off-by: Frederic <frederic.vanreet@icloud.com>
A lot of common use cases for recursion in Rego can be reduced to a graph
reachability problem. This new builtin allows policies to evaluate such
recursive rules.
Signed-off-by: Jasper Van der Jeugt <jasper@fugue.co>
This change merges the cheat sheet content into the reference page--so
that there is one place that users can go to answer basic questions
about how to do X inside of Rego. Also, reorder the policy language
pages to go from language definitions => reference => testing =>
performance as this is the order we want users to navigate.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
With this commit the following algorithms are now supported for verifying jwt tokens:
HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384 and PS512
Fixes#2324
Signed-off-by: Frederic <frederic.vanreet@icloud.com>
Signed-off-by: Rene Klootwijk <rene.klootwijk@rencon.nl>
A built-in command to create a version 4 uuid
Signed-off-by: Rene Klootwijk <rene.klootwijk@rencon.nl>
A built-in command to create a version 4 uuid
Signed-off-by: Rene Klootwijk <rene.klootwijk@rencon.nl>
Removed external dependency and created helper for uuid
Signed-off-by: Rene Klootwijk <rene.klootwijk@rencon.nl>
Added idempotency for the uuid.rfc4122() command
Signed-off-by: Rene Klootwijk <rene.klootwijk@rencon.nl>
`http.send` already supports TLS keys and certificates obtained from
external files and environment variables. Add support for specifying
certificates and keys as direct parameters to `http.send`. This is
useful when you already have policy variables with this data.
There are 3 options that this affects: client certificates, client
keys and CA bundles. All of these can now be specified from either a
file, an environment variable or from raw data. In the case of client
certificates and keys, each access method must use a matched pair (e.g.
both the certificate and the key must come from environment variables).
CA certificate bundles are the union of all the specified access methods.
Signed-off-by: James Peach <jpeach@vmware.com>
A user pointed out that our EBNF grammar did not quote a few of the
terms correctly. This commit fixes those cases.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously we left them off the returned AST object, this will now
just massage them into valid types and pass them along into the
return value.
Fixes: #2238
Signed-off-by: Patrick East <east.patrick@gmail.com>
regex.template_match both per the code as well as the documentation
takes 4 string arguments and returns one boolean. The example had a 5th
argument that looked to be an out value. Remove the extra argument and
clean up the text.
Signed-off-by: Brian Atkinson <brian@atkinson.mn>
New builtin for adding years, months and days to a time
This might be useful for computing a day in the future or past
more easily
Fixes#1990
Signed-off-by: Frederic <frederic.vanreet@icloud.com>
If the caller sets the Host header, then we can reasonably impute that
they wanted to use that at the TLS layer as well. To handle test cases
where the caller needs to explicitly set the TLS server name, add a
`tls_server_name` parameter that overrides both the `Host` header and
the Go default.
Signed-off-by: James Peach <jpeach@vmware.com>
If the headers map given to `http.send` includes the `Host` header, hoist
it up to the request. This lets users specify the server to connect to
and the `Host` header to send independently, much like curl.
Signed-off-by: James Peach <jpeach@vmware.com>
Add the ability to verify a JWT signature using only the PEM
encoded public key, instead of the whole certificate. The test
case key was extracted from the certPem in the line directly above.
Closes#2158
Signed-off-by: Michael Krotscheck <krotscheck@gmail.com>
This adds in a new built-in function `json.remove` which will take in
an object and list of json pointer paths (similar to `json.filter`)
and create a new object with all of the paths removed from the base
object.
Reference: #1617
Signed-off-by: Patrick East <east.patrick@gmail.com>
There is a new optional `timeout` option to specify with `http.send`
which will set a client timeout on the request. This will override the
default 5 second timeout.
This change also corrects the request to use the builtin context. This
means that if the evaluation is canceled the request will also now be
canceled.
There is an environment variable for adjusting the default timeout
which we should aim to remove in future OPA versions (when
appropriate). For now though it is still supported, and will panic if
supplied with an invalid value rather than previously ignoring it and
effectively disable the timeout (0 == unlimited).
Fixes: #2099
Signed-off-by: Patrick East <east.patrick@gmail.com>
Previously it would ignore the provided CA parameters unless client
cert info was provided. This change now allows for providing CA info
without any client auth details.
Fixes: #1976
Signed-off-by: Patrick East <east.patrick@gmail.com>
This commit adds in the following built-ins:
`object.remove`
`object.union`
`object.filter`
All of which are helpers for object manipulation in policies.
Reference: #1617
Signed-off-by: Patrick East <east.patrick@gmail.com>
Attempt to clarify how `glob.match` works with respect to delimiters by
adding an additional example.
Signed-off-by: Fredrik Appelros <fredrik.appelros@sinch.com>
In some cases, policies may need to expand CIDRs to check if hosts in
the range are valid (e.g., due to limitations of external APIs being
accessed from inside the policy.)
This change adds a built-in function to enumerate the addresses in a
CIDR. The built-in function supports cancellation in case the range is
too large and taking too long to generate.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This adds some highlights to sections that commonly trip up users and
gives some additional examples for how the functions work and can
interact.
Fixes: #1916
Signed-off-by: Patrick East <east.patrick@gmail.com>
Instead of changing the behaviour of the body parameter (which is
always sent as JSON) just add a new parameter that gives the caller
complete control over the message body.
Also, refactor the docs for the function to be a bit more readable.
Fixes#1903
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Jasper Van der Jeugt