pan: add ACL policy (#212)

Add an ACL policy following the ACL pattern in https://scion.docs.anapaya.net/en/latest/PathPolicy.html#acl

Author: JordiSubira

pkg/pan/policy.go

@@ -15,6 +15,7 @@
 package pan
 
 import (
+	"fmt"
 	"net"
 	"sort"
 
@@ -118,6 +119,45 @@ func (s Sequence) Filter(paths []*Path) []*Path {
 	return ps
 }
 
+// ACL is a policy filtering paths matching an ACL pattern. The ACL pattern is
+// an ordered list of allow/deny actions over hop predicates.
+// See https://scion.docs.anapaya.net/en/latest/PathPolicy.html#acl.
+type ACL struct {
+	entries *pathpol.ACL
+}
+
+// NewACL creates a new ACL from a string list
+func NewACL(list []string) (ACL, error) {
+	aclEntries := make([]*pathpol.ACLEntry, len(list))
+	for i, entry := range list {
+		aclEntry := &pathpol.ACLEntry{}
+		if err := aclEntry.LoadFromString(entry); err != nil {
+			return ACL{}, fmt.Errorf("parsing ACL entries: %w", err)
+		}
+		aclEntries[i] = aclEntry
+	}
+	acl, err := pathpol.NewACL(aclEntries...)
+	if err != nil {
+		return ACL{}, fmt.Errorf("creating ACL: %w", err)
+	}
+	return ACL{entries: acl}, nil
+}
+
+// Filter evaluates the interface ACL and returns the set of paths
+// that match the list
+func (l ACL) Filter(paths []*Path) []*Path {
+	wps := make([]snet.Path, len(paths))
+	for i := range paths {
+		wps[i] = snetPathWrapper{wrapped: paths[i]}
+	}
+	wps = l.entries.Eval(wps)
+	ps := make([]*Path, len(wps))
+	for i := range wps {
+		ps[i] = wps[i].(snetPathWrapper).wrapped
+	}
+	return ps
+}
+
 // snetPathWrapper wraps a *Path to snet.Path, only supporting the minimal
 // interface to use pathpol.Sequence
 type snetPathWrapper struct {

pkg/pan/policy_test.go

@@ -363,3 +363,109 @@ func TestSequencePolicy(t *testing.T) {
 		})
 	}
 }
+
+// TestACLPolicy checks that the glue logic for invoking the pathpol.ACL
+// works correctly. We do not need to extensively test the sequence
+// language itself here.
+func TestACLPolicy(t *testing.T) {
+	asA := IA{1, 0xff00_0000_000a}
+	asB := IA{1, 0xff00_0000_000b}
+	asC := IA{1, 0xff00_0000_000c}
+	pAB := &Path{
+		Metadata: &PathMetadata{
+			Interfaces: []PathInterface{
+				{IA: asA, IfID: 1},
+				{IA: asB, IfID: 2},
+			},
+		},
+	}
+	pACB := &Path{
+		Metadata: &PathMetadata{
+			Interfaces: []PathInterface{
+				{IA: asA, IfID: 1},
+				{IA: asB, IfID: 2},
+				{IA: asB, IfID: 3},
+				{IA: asC, IfID: 4},
+			},
+		},
+	}
+	cases := []struct {
+		name       string
+		acl        []string
+		in         []*Path
+		out        []*Path
+		assertFunc assert.ErrorAssertionFunc
+	}{
+		{
+			name:       "nil",
+			acl:        nil,
+			in:         nil,
+			out:        []*Path{},
+			assertFunc: assert.Error,
+		},
+		{
+			name:       "empty",
+			acl:        []string{},
+			in:         nil,
+			out:        []*Path{},
+			assertFunc: assert.Error,
+		},
+		{
+			name:       "malformed",
+			acl:        []string{""},
+			in:         nil,
+			out:        []*Path{},
+			assertFunc: assert.Error,
+		},
+		{
+			name:       "any",
+			acl:        []string{"+"},
+			in:         []*Path{pAB, pACB},
+			out:        []*Path{pAB, pACB},
+			assertFunc: assert.NoError,
+		},
+		{
+			name:       "blacklist C",
+			acl:        []string{"- 1-ff00:0:c", "+"},
+			in:         []*Path{pAB, pACB},
+			out:        []*Path{pAB},
+			assertFunc: assert.NoError,
+		},
+		{
+			name:       "blacklist B",
+			acl:        []string{"- 1-ff00:0:B", "+"},
+			in:         []*Path{pAB, pACB},
+			out:        []*Path{},
+			assertFunc: assert.NoError,
+		},
+		{
+			name:       "blacklist C, white ISD 1",
+			acl:        []string{"- 1-ff00:0:C", "+ 1", "-"},
+			in:         []*Path{pAB, pACB},
+			out:        []*Path{pAB},
+			assertFunc: assert.NoError,
+		},
+		{
+			name:       "whitelist only AB",
+			acl:        []string{"+ 1-ff00:0:B", "+ 1-ff00:0:A", "-"},
+			in:         []*Path{pAB, pACB},
+			out:        []*Path{pAB},
+			assertFunc: assert.NoError,
+		},
+		{
+			name:       "none",
+			acl:        []string{"-"},
+			in:         []*Path{pAB, pACB},
+			out:        []*Path{},
+			assertFunc: assert.NoError,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			acl, err := NewACL(c.acl)
+			c.assertFunc(t, err)
+			actual := acl.Filter(c.in)
+			assert.Equal(t, c.out, actual)
+		})
+	}
+}