checking for obsolete entries in an ACL

private/path/pathpol/acl.go

@@ -27,6 +27,9 @@ import (
 var (
  // ErrNoDefault indicates that there is no default acl entry.
  ErrNoDefault = errors.New("ACL does not have a default")
+ // ErrObsoleteEntries indicates that there is a default acl entry posisioned in
+ // the middle, making the following acl entries obsolete.
+ ErrObsoleteEntries = errors.New("ACL has a default entry posisioned in the middle, making the following entries obsolete")
 )
 
 type ACL struct {
@@ -97,9 +100,26 @@ func (a *ACL) evalInterface(iface snet.PathInterface, ingress bool) ACLAction {
 }
 
 func validateACL(entries []*ACLEntry) error {
- if len(entries) == 0 || !entries[len(entries)-1].Rule.matchesAll() {
+ if len(entries) == 0 {
  return ErrNoDefault
  }
+
+ foundAt := -1
+ for i, e := range entries {
+ if e.Rule.matchesAll() {
+ foundAt = i
+ break
+ }
+ }
+
+ if foundAt < 0 {
+ return ErrNoDefault
+ }
+
+ if foundAt != len(entries)-1 {
+ return ErrObsoleteEntries
+ }
+
  return nil
 }
 

private/path/pathpol/acl_test.go

@@ -79,6 +79,14 @@ func TestUnmarshalJSON(t *testing.T) {
  "Entry with hop predicates": {
  Input: `["+ 42", "-"]`,
  },
+ "Obsolete entries (first)": {
+ Input: `["-", "+ 27"]`,
+ ExpectedErr: ErrObsoleteEntries,
+ },
+ "Obsolete entries (in the middle)": {
+ Input: `["+ 42", "-", "+ 27", "- 30"]`,
+ ExpectedErr: ErrObsoleteEntries,
+ },
  }
  for name, test := range tests {
  t.Run(name, func(t *testing.T) {