Add built-in functions to perform CIDR math

[tsandall]

Admission control policies that constrain the attributes of network policies are an obvious use case for OPA. To improve the user experience for policy authors, we should add built-in functions to perform CIDR math.

For example:

net.cidr_overlap(x, y, output)
net.cidr_supernet(parent, child, output)

• cidr_overlap returns true if cidr x overlaps with cidr y
• cidr_supernet returns true if child is a subnet of parent

[aeneasr]

I'm assuming this should be done here and adding the concrete implementation here?

[tsandall]

Yep, add the declaration to ast/builtins.go like the rest and the put the implementation inside topdown. If you'd like to upstream this that would be awesome. If you can implement it on top of the Go standard library (instead of pulling in a thirdparty library) that would be ideal.

[aeneasr]

If you can implement it on top of the Go standard library (instead of pulling in a thirdparty library) that would be ideal.

stdlib over everything, I don't think supernet is supported by stdlib though, but I'll make sure to verify first!

[aeneasr]

What and where should I add tests for that?

[tsandall]

Take a look at topdown/aggregates_test.go for an example. You can copy that structure more or less.

runTopDownTestCase(t, data, tc.note, tc.rules, tc.expected)

This will execute the test case in a subtest. The test will invoke the the rule p and then assert the result is equal to the expected value.

For these, it should be enough to test the different branches. No overlap, x superset of y, y superset of x, etc.

Also, please add a section to the language reference docs so that we can refer to these and link people to them.

[tsandall]

Closing this now that #959 is merged. We can revisit other cidr built-ins as needed.