policy: add aggregation test

This ensures that the userspace and bpf implementation of identity
aggregation match exactly.

The userspace test outputs a C array of inputs and outputs. The C test
includes this and verifies that the results match.

Signed-off-by: Casey Callendrello <cdc@isovalent.com>

Author: squeed

bpf/tests/aggregate_nid_in.txt

@@ -0,0 +1,12 @@
+0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 
+10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 
+20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 
+30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 
+40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 
+50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 
+60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 
+70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 
+80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 
+90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 
+100, 101, 102, 1023, 1024, 1025, 65534, 65535, 65536, 16777215, 
+16777216, 16777217, 33554431, 33554432, 33554433, 

bpf/tests/aggregate_nid_out.txt

@@ -0,0 +1,12 @@
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 11, 12, 13, 14, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 
+11, 11, 11, 11, 11, 11, 11, 11, 12, 12, 
+13, 13, 13, 14, 14, 

bpf/tests/network_policy.c

@@ -12,6 +12,7 @@
 #include <lib/policy.h>
 
 #include "lib/policy.h"
+#include "network_policy_tuples.h"
 
 #define REMOTE_IDENTITY		112233
 
@@ -268,5 +269,11 @@ int network_policy_egress_allow_check(struct __ctx_buff *ctx)
 		assert(aggregate_for_identity(33554432) == n);
 	});
 
+    /* tests that aggregates match the userspace implementation */
+	TEST("aggregate-for-id-userspace", {
+		for (unsigned long i = 0; i < ARRAY_SIZE(aggregate_nid_in); i++)
+			assert(aggregate_for_identity(aggregate_nid_in[i]) == aggregate_nid_out[i]);
+	});
+
 	test_finish();
 }

bpf/tests/network_policy_tuples.h

@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/* Copyright Authors of Cilium */
+
+#pragma once
+
+/* Arrays are generated in pkg/policy/aggregate_test.go */
+
+static __u32 aggregate_nid_in[] = {
+#include "aggregate_nid_in.txt"
+};
+
+static __u32 aggregate_nid_out[] = {
+#include "aggregate_nid_out.txt"
+};

pkg/policy/aggregate_test.go

@@ -4,6 +4,8 @@
 package policy
 
 import (
+	"fmt"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -19,19 +21,75 @@ func TestAllAggregates(t *testing.T) {
 		require.True(t, isAggregate(nid))
 	}
 
-	// check all identities
-	// Should only take a second or two.
-	// Validates that all aggregate identities are known.
-	for i := range (identity.IdentityScopeRemoteNode | identity.MaxAllocatorLocalIdentity) / 100 {
-		nid := i * 100
+	c := identity.ReservedIdentityAggregateCluster
+	m := identity.ReservedIdentityAggregateClusterMesh
+	n := identity.ReservedIdentityAggregateRemoteNode
+	w := identity.ReservedIdentityAggregateWorld
+
+	// Gather results, we will optionally write them
+	// to C test literals to ensure we produce reasonable results
+	var expectedIn, expectedOut []identity.NumericIdentity
+	// set to True to update C test literals
+	writeOutput := false
+
+	check := func(nid identity.NumericIdentity) {
 		// duplicate of AllAggregates for efficiency.
 		switch nid {
-		case 0, 6, 2, 11, 12:
+		case 0, c, m, n, w:
 			require.True(t, isAggregate(nid))
 		default:
 			require.False(t, isAggregate(nid))
 		}
+
+		if writeOutput {
+			expectedIn = append(expectedIn, nid)
+			expectedOut = append(expectedOut, aggregateFor(nid))
+		}
+	}
+
+	// check all interesting identities
+	// Should only take a second or two.
+	// Validates that all aggregate identities are known.
+	for i := range 100 {
+		check(identity.NumericIdentity(i))
+	}
+	for _, nid := range []identity.NumericIdentity{
+		101,
+		1024,
+		0xFFFF,
+		identity.IdentityScopeLocal,
+		identity.IdentityScopeRemoteNode,
+	} {
+		check(nid - 1)
+		check(nid)
+		check(nid + 1)
+	}
+
+	if writeOutput {
+		err := writeCArray("../../bpf/tests/aggregate_nid_in.txt", expectedIn)
+		fmt.Printf("wrote %d entries", len(expectedIn))
+		require.NoError(t, err)
+		err = writeCArray("../../bpf/tests/aggregate_nid_out.txt", expectedOut)
+		require.NoError(t, err)
+	}
+}
+
+func writeCArray(path string, nids []identity.NumericIdentity) error {
+	fp, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	for i, nid := range nids {
+		if _, err := fmt.Fprintf(fp, "%d, ", nid); err != nil {
+			return err
+		}
+		if i%10 == 9 {
+			if _, err := fmt.Fprintln(fp, ""); err != nil {
+				return err
+			}
+		}
 	}
+	return fp.Close()
 }
 
 func TestIsAggregate(t *testing.T) {