policy: Create derivative policy for EgressDeny rules

pkg/policy/api/rule.go

@@ -210,6 +210,11 @@ func (r *Rule) RequiresDerivative() bool {
 			return true
 		}
 	}
+	for _, rule := range r.EgressDeny {
+		if rule.RequiresDerivative() {
+			return true
+		}
+	}
 	return false
 }
 
@@ -218,6 +223,7 @@ func (r *Rule) RequiresDerivative() bool {
 func (r *Rule) CreateDerivative(ctx context.Context) (*Rule, error) {
 	newRule := r.DeepCopy()
 	newRule.Egress = []EgressRule{}
+	newRule.EgressDeny = []EgressDenyRule{}
 
 	for _, egressRule := range r.Egress {
 		derivativeEgressRule, err := egressRule.CreateDerivative(ctx)
@@ -226,5 +232,13 @@ func (r *Rule) CreateDerivative(ctx context.Context) (*Rule, error) {
 		}
 		newRule.Egress = append(newRule.Egress, *derivativeEgressRule)
 	}
+
+	for _, egressDenyRule := range r.EgressDeny {
+		derivativeEgressDenyRule, err := egressDenyRule.CreateDerivative(ctx)
+		if err != nil {
+			return newRule, err
+		}
+		newRule.EgressDeny = append(newRule.EgressDeny, *derivativeEgressDenyRule)
+	}
 	return newRule, nil
 }

pkg/policy/api/rule_test.go

@@ -4,6 +4,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 
 	. "gopkg.in/check.v1"
@@ -34,3 +35,66 @@ func (s *PolicyAPITestSuite) TestJSONMarshalling(c *C) {
 	}
 	checkMarshalUnmarshal(c, &validNodeRule)
 }
+
+func getEgressRuleWithToGroups() *Rule {
+	return &Rule{
+		Egress: []EgressRule{
+			{
+				EgressCommonRule: EgressCommonRule{
+					ToGroups: []ToGroups{
+						GetToGroupsRule(),
+					},
+				},
+			},
+		},
+	}
+}
+
+func getEgressDenyRuleWithToGroups() *Rule {
+	return &Rule{
+		EgressDeny: []EgressDenyRule{
+			{
+				EgressCommonRule: EgressCommonRule{
+					ToGroups: []ToGroups{
+						GetToGroupsRule(),
+					},
+				},
+			},
+		},
+	}
+}
+
+func (s *PolicyAPITestSuite) TestRequiresDerivative(c *C) {
+	egressWithoutToGroups := Rule{}
+	c.Assert(egressWithoutToGroups.RequiresDerivative(), Equals, false)
+
+	egressRuleWithToGroups := getEgressRuleWithToGroups()
+	c.Assert(egressRuleWithToGroups.RequiresDerivative(), Equals, true)
+
+	egressDenyRuleWithToGroups := getEgressDenyRuleWithToGroups()
+	c.Assert(egressDenyRuleWithToGroups.RequiresDerivative(), Equals, true)
+}
+
+func (s *PolicyAPITestSuite) TestCreateDerivative(c *C) {
+	egressWithoutToGroups := Rule{}
+	newRule, err := egressWithoutToGroups.CreateDerivative(context.TODO())
+	c.Assert(err, IsNil)
+	c.Assert(len(newRule.Egress), Equals, 0)
+	c.Assert(len(newRule.EgressDeny), Equals, 0)
+
+	RegisterToGroupsProvider(AWSProvider, GetCallBackWithRule("192.168.1.1"))
+
+	egressRuleWithToGroups := getEgressRuleWithToGroups()
+	newRule, err = egressRuleWithToGroups.CreateDerivative(context.TODO())
+	c.Assert(err, IsNil)
+	c.Assert(len(newRule.EgressDeny), Equals, 0)
+	c.Assert(len(newRule.Egress), Equals, 1)
+	c.Assert(len(newRule.Egress[0].ToCIDRSet), Equals, 1)
+
+	egressDenyRuleWithToGroups := getEgressDenyRuleWithToGroups()
+	newRule, err = egressDenyRuleWithToGroups.CreateDerivative(context.TODO())
+	c.Assert(err, IsNil)
+	c.Assert(len(newRule.Egress), Equals, 0)
+	c.Assert(len(newRule.EgressDeny), Equals, 1)
+	c.Assert(len(newRule.EgressDeny[0].ToCIDRSet), Equals, 1)
+}