sciond: Add method to filter paths with a policy

go/lib/pathpol/acl.go

@@ -17,20 +17,25 @@ package pathpol
 
 import (
 	"encoding/json"
+	"errors"
 	"strings"
 
 	"github.com/scionproto/scion/go/lib/common"
 )
 
+var (
+	// ErrNoDefault indicates that there is no default acl entry.
+	ErrNoDefault = errors.New("ACL does not have a default")
+)
+
 type ACL struct {
 	Entries []*ACLEntry
 }
 
 // NewACL creates a new entry and checks for the presence of a default action
 func NewACL(entries ...*ACLEntry) (*ACL, error) {
-	lastRule := entries[len(entries)-1].Rule
-	if lastRule.IfIDs[0] != 0 || lastRule.ISD != 0 || lastRule.AS != 0 {
-		return nil, common.NewBasicError("ACL does not have a default", nil)
+	if len(entries) == 0 || !entries[len(entries)-1].Rule.matchesAll() {
+		return nil, ErrNoDefault
 	}
 	return &ACL{Entries: entries}, nil
 }

go/lib/pathpol/acl_test.go

@@ -22,6 +22,27 @@ import (
 	"github.com/scionproto/scion/go/lib/common"
 )
 
+func TestNewACL(t *testing.T) {
+	tests := map[string]struct {
+		Entries        []*ACLEntry
+		ErrorAssertion assert.ErrorAssertionFunc
+	}{
+		"No entry": {
+			ErrorAssertion: assert.Error,
+		},
+		"Entry without rule": {
+			Entries:        []*ACLEntry{{Action: Allow}},
+			ErrorAssertion: assert.NoError,
+		},
+	}
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := NewACL(test.Entries...)
+			test.ErrorAssertion(t, err)
+		})
+	}
+}
+
 func TestACLEntryLoadFromString(t *testing.T) {
 	tests := map[string]struct {
 		String         string

go/lib/pathpol/hop_pred.go

@@ -105,6 +105,14 @@ func (hp *HopPredicate) pathIFMatch(pi PathInterface, in bool) bool {
 	return true
 }
 
+func (hp *HopPredicate) matchesAll() bool {
+	if hp == nil {
+		return true
+	}
+	// hp.AS == 0 implies that there is exactly one 0 interface.
+	return hp.ISD == 0 && hp.AS == 0
+}
+
 func (hp HopPredicate) String() string {
 	var s []string
 	for _, ifid := range hp.IfIDs {

go/sciond/internal/fetcher/BUILD.bazel

@@ -1,8 +1,11 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "go_default_library",
-    srcs = ["fetcher.go"],
+    srcs = [
+        "fetcher.go",
+        "filter.go",
+    ],
     importpath = "github.com/scionproto/scion/go/sciond/internal/fetcher",
     visibility = ["//go/sciond:__subpackages__"],
     deps = [
@@ -20,6 +23,7 @@ go_library(
         "//go/lib/log:go_default_library",
         "//go/lib/pathdb:go_default_library",
         "//go/lib/pathdb/query:go_default_library",
+        "//go/lib/pathpol:go_default_library",
         "//go/lib/revcache:go_default_library",
         "//go/lib/sciond:go_default_library",
         "//go/lib/snet:go_default_library",
@@ -31,3 +35,20 @@ go_library(
         "@com_github_opentracing_opentracing_go//:go_default_library",
     ],
 )
+
+go_test(
+    name = "go_default_test",
+    srcs = ["filter_test.go"],
+    embed = [":go_default_library"],
+    deps = [
+        "//go/lib/addr:go_default_library",
+        "//go/lib/common:go_default_library",
+        "//go/lib/ctrl/seg:go_default_library",
+        "//go/lib/infra/modules/combinator:go_default_library",
+        "//go/lib/pathpol:go_default_library",
+        "//go/lib/xtest:go_default_library",
+        "//go/lib/xtest/graph:go_default_library",
+        "@com_github_golang_mock//gomock:go_default_library",
+        "@com_github_stretchr_testify//assert:go_default_library",
+    ],
+)

go/sciond/internal/fetcher/filter.go

@@ -0,0 +1,73 @@
+// Copyright 2019 Anapaya Systems
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fetcher
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/scionproto/scion/go/lib/infra/modules/combinator"
+	"github.com/scionproto/scion/go/lib/pathpol"
+)
+
+// Filter filters the given paths with the given policy. Note that this
+// function might change the order of elements.
+func Filter(paths []*combinator.Path, policy *pathpol.Policy) []*combinator.Path {
+	if policy == nil {
+		return paths
+	}
+	return psToPaths(policy.Act(pathsToPs(paths)))
+}
+
+func pathsToPs(paths []*combinator.Path) pathpol.PathSet {
+	ps := make(pathpol.PathSet, len(paths))
+	for _, path := range paths {
+		wp := newPathWrap(path)
+		ps[wp.Key()] = wp
+	}
+	return ps
+}
+
+func psToPaths(ps pathpol.PathSet) []*combinator.Path {
+	paths := make([]*combinator.Path, 0, len(ps))
+	for _, wp := range ps {
+		paths = append(paths, wp.(pathWrap).origPath)
+	}
+	return paths
+}
+
+type pathWrap struct {
+	key      string
+	intfs    []pathpol.PathInterface
+	origPath *combinator.Path
+}
+
+func newPathWrap(p *combinator.Path) pathWrap {
+	intfs := make([]pathpol.PathInterface, 0, len(p.Interfaces))
+	keyParts := make([]string, 0, len(p.Interfaces))
+	for _, intf := range p.Interfaces {
+		intfs = append(intfs, intf)
+		keyParts = append(keyParts, fmt.Sprintf("%s#%d", intf.IA(), intf.IfId()))
+	}
+	return pathWrap{
+		key:      strings.Join(keyParts, " "),
+		intfs:    intfs,
+		origPath: p,
+	}
+}
+
+func (p pathWrap) Interfaces() []pathpol.PathInterface { return p.intfs }
+func (p pathWrap) IsPartial() bool                     { return false }
+func (p pathWrap) Key() string                         { return p.key }

go/sciond/internal/fetcher/filter_test.go

@@ -0,0 +1,89 @@
+// Copyright 2019 Anapaya Systems
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fetcher
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/scionproto/scion/go/lib/addr"
+	"github.com/scionproto/scion/go/lib/common"
+	"github.com/scionproto/scion/go/lib/ctrl/seg"
+	"github.com/scionproto/scion/go/lib/infra/modules/combinator"
+	"github.com/scionproto/scion/go/lib/pathpol"
+	"github.com/scionproto/scion/go/lib/xtest"
+	"github.com/scionproto/scion/go/lib/xtest/graph"
+)
+
+func TestFilter(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	g := graph.NewDefaultGraph(ctrl)
+	ia110 := xtest.MustParseIA("1-ff00:0:110")
+	ia120 := xtest.MustParseIA("1-ff00:0:120")
+	ia111 := xtest.MustParseIA("1-ff00:0:111")
+	seg110To120 := g.Beacon([]common.IFIDType{graph.If_110_X_120_A})
+	seg110To130 := g.Beacon([]common.IFIDType{graph.If_110_X_130_A})
+	seg120To111 := g.Beacon([]common.IFIDType{graph.If_120_X_111_B})
+	seg130To111 := g.Beacon([]common.IFIDType{graph.If_130_B_111_A})
+
+	paths111To110 := combinator.Combine(ia111, ia110,
+		[]*seg.PathSegment{seg120To111, seg130To111},
+		[]*seg.PathSegment{seg110To120, seg110To130},
+		nil)
+
+	tests := map[string]struct {
+		Paths         []*combinator.Path
+		Policy        func(t *testing.T) *pathpol.Policy
+		ExpectedPaths []*combinator.Path
+	}{
+		"Test without policy": {
+			Paths:         paths111To110,
+			Policy:        func(t *testing.T) *pathpol.Policy { return nil },
+			ExpectedPaths: paths111To110,
+		},
+		"Test with policy": {
+			Paths: paths111To110,
+			Policy: func(t *testing.T) *pathpol.Policy {
+				return &pathpol.Policy{ACL: acl(t, ia120)}
+			},
+			ExpectedPaths: combinator.Combine(ia111, ia110,
+				[]*seg.PathSegment{seg130To111},
+				[]*seg.PathSegment{seg110To130},
+				nil),
+		},
+	}
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			filtered := Filter(test.Paths, test.Policy(t))
+			assert.ElementsMatch(t, test.ExpectedPaths, filtered)
+		})
+	}
+}
+
+func acl(t testing.TB, disallow addr.IA) *pathpol.ACL {
+	var disallowEntry pathpol.ACLEntry
+	err := disallowEntry.LoadFromString(fmt.Sprintf("- %s", disallow))
+	xtest.FailOnErr(t, err)
+	var allowEntry pathpol.ACLEntry
+	err = allowEntry.LoadFromString("+")
+	xtest.FailOnErr(t, err)
+	acl, err := pathpol.NewACL(&disallowEntry, &allowEntry)
+	xtest.FailOnErr(t, err)
+	return acl
+}