Skip to content

[Proposal] Add Wasm-based Cedar policy engine #362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
andreaTP wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[Proposal] Add Wasm-based Cedar policy engine #362

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CedarWasm/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
wasm-build/target/
core/target/
benchmark/target/
77 changes: 77 additions & 0 deletions CedarWasm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
# Cedar Wasm

Pure-Java Cedar policy engine using WebAssembly. The Cedar Rust crate is compiled to Wasm and executed via [Chicory Redline](https://github.com/AnyTimeTraveler/chicory-redline) — no JNI or native libraries required.

## Project structure

```
CedarWasm/
├── wasm-build/ Rust crate compiled to wasm32-unknown-unknown
├── core/ Java module (CedarEngine + Chicory Redline)
└── benchmark/ JMH benchmarks comparing JNI vs Wasm
```

## Prerequisites

- Java 17+
- Rust 1.89+ with `wasm32-unknown-unknown` target
- `wasm-opt` (from [binaryen](https://github.com/WebAssembly/binaryen))
- [Chicory Redline](https://github.com/AnyTimeTraveler/chicory-redline) installed to local Maven repo (`mvn install -DskipTests`)

## Building the Wasm module

```bash
cd wasm-build
rustup target add wasm32-unknown-unknown
cargo build --release --target wasm32-unknown-unknown
wasm-opt --enable-bulk-memory -O3 \
target/wasm32-unknown-unknown/release/cedar_wasm.wasm \
-o ../core/wasm/cedar_wasm.wasm
```

## Building and testing

```bash
cd CedarWasm
mvn clean test -pl core
```

## Running benchmarks (JNI vs Wasm)

First, build the JNI uber jar (requires Gradle + Rust):

```bash
cd CedarJava
./gradlew uberJar -x test -x spotbugsMain -x spotbugsTest -x spotbugsJmh \
-x checkstyleMain -x checkstyleTest -x jacocoTestCoverageVerification
```

Then run the benchmarks:

```bash
cd CedarWasm
mvn install -DskipTests
mvn exec:java -pl benchmark
```

## Sample results

```
Benchmark Mode Cnt Score Error Units
CedarBenchmark.jniCachedLarge avgt 3 1077.137 ± 2500.105 us/op
CedarBenchmark.jniCachedMedium avgt 3 68.613 ± 44.063 us/op
CedarBenchmark.jniCachedSmall avgt 3 29.142 ± 7.306 us/op
CedarBenchmark.jniCachedXLarge avgt 3 476.329 ± 1036.358 us/op
CedarBenchmark.jniUncachedLarge avgt 3 2209.292 ± 2208.573 us/op
CedarBenchmark.jniUncachedMedium avgt 3 335.507 ± 269.147 us/op
CedarBenchmark.jniUncachedSmall avgt 3 64.400 ± 20.911 us/op
CedarBenchmark.jniUncachedXLarge avgt 3 9672.329 ± 1197.832 us/op
CedarBenchmark.wasmCachedLarge avgt 3 2080.047 ± 1085.834 us/op
CedarBenchmark.wasmCachedMedium avgt 3 218.603 ± 112.547 us/op
CedarBenchmark.wasmCachedSmall avgt 3 131.787 ± 148.610 us/op
CedarBenchmark.wasmCachedXLarge avgt 3 906.421 ± 664.702 us/op
CedarBenchmark.wasmUncachedLarge avgt 3 2788.757 ± 364.868 us/op
CedarBenchmark.wasmUncachedMedium avgt 3 840.366 ± 441.384 us/op
CedarBenchmark.wasmUncachedSmall avgt 3 233.398 ± 41.424 us/op
CedarBenchmark.wasmUncachedXLarge avgt 3 21890.498 ± 12325.095 us/op
```
99 changes: 99 additions & 0 deletions CedarWasm/benchmark/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>com.cedarpolicy</groupId>
<artifactId>cedar-wasm-parent</artifactId>
<version>4.0.0-SNAPSHOT</version>
</parent>
<artifactId>cedar-benchmark</artifactId>
<name>Cedar JNI vs Wasm Benchmark</name>

<dependencies>
<!-- Wasm implementation -->
<dependency>
<groupId>com.cedarpolicy</groupId>
<artifactId>cedar-wasm</artifactId>
<version>${project.version}</version>
</dependency>
<!-- JNI implementation (uber jar from Gradle build) -->
<dependency>
<groupId>com.cedarpolicy</groupId>
<artifactId>cedar-java</artifactId>
<version>3.1.2</version>
<scope>system</scope>
<systemPath>${project.basedir}/../../CedarJava/build/libs/CedarJava-uber.jar</systemPath>
</dependency>
<!-- JNI runtime dependencies -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.20.0</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jdk8</artifactId>
<version>2.20.0</version>
</dependency>
<dependency>
<groupId>com.fizzed</groupId>
<artifactId>jne</artifactId>
<version>4.5.3</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>33.5.0-jre</version>
</dependency>
<!-- JMH -->
<dependency>
<groupId>org.openjdk.jmh</groupId>
<artifactId>jmh-core</artifactId>
<version>${jmh.version}</version>
</dependency>
<dependency>
<groupId>org.openjdk.jmh</groupId>
<artifactId>jmh-generator-annprocess</artifactId>
<version>${jmh.version}</version>
</dependency>
</dependencies>

<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<annotationProcessorPaths>
<path>
<groupId>org.openjdk.jmh</groupId>
<artifactId>jmh-generator-annprocess</artifactId>
<version>${jmh.version}</version>
</path>
</annotationProcessorPaths>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
<version>3.5.0</version>
<configuration>
<classpathScope>test</classpathScope>
<mainClass>org.openjdk.jmh.Main</mainClass>
<arguments>
<argument>-f</argument>
<argument>0</argument>
<argument>-i</argument>
<argument>3</argument>
<argument>-wi</argument>
<argument>3</argument>
<argument>-r</argument>
<argument>1</argument>
<argument>-w</argument>
<argument>1</argument>
</arguments>
</configuration>
</plugin>
</plugins>
</build>
</project>
Loading