java-topology/defects/neutron/unit/NeutronTrustedPortsAlgorithm.java

package unit;

import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

/**
 * CWE-407 unit test: neutron-0001
 * IptablesFirewallDriver.trusted_ports list vs set membership.
 *
 * Slow path: trusted_ports is a List — O(n) contains + O(n) remove = O(n²) per call.
 * Fast path: trusted_ports is a Set — O(1) contains + O(1) remove = O(n) per call.
 */
public class NeutronTrustedPortsAlgorithm {

    // --- slow: list-backed trusted ports (defective) ---
    static long processTrustedPortsSlow(List<String> trustedPorts, List<String> portIds) {
        long ops = 0;
        for (String port : portIds) {
            ops++;  // loop iteration
            boolean found = false;
            for (String tp : trustedPorts) {  // O(n) scan
                ops++;
                if (tp.equals(port)) { found = true; break; }
            }
            if (!found) {
                trustedPorts.add(port);
            }
        }
        return ops;
    }

    static long removeTrustedPortsSlow(List<String> trustedPorts, List<String> portIds) {
        long ops = 0;
        for (String port : portIds) {
            ops++;
            boolean found = false;
            int idx = -1;
            for (int i = 0; i < trustedPorts.size(); i++) {  // O(n) scan
                ops++;
                if (trustedPorts.get(i).equals(port)) { found = true; idx = i; break; }
            }
            if (found) {
                trustedPorts.remove(idx);  // O(n) shift
                // count the remove scan as ops too
                ops += trustedPorts.size();
            }
        }
        return ops;
    }

    // --- fast: set-backed trusted ports (fixed) ---
    static long processTrustedPortsFast(Set<String> trustedPorts, List<String> portIds) {
        long ops = 0;
        for (String port : portIds) {
            ops++;  // loop iteration + O(1) contains + O(1) add
            if (!trustedPorts.contains(port)) {
                trustedPorts.add(port);
            }
        }
        return ops;
    }

    static long removeTrustedPortsFast(Set<String> trustedPorts, List<String> portIds) {
        long ops = 0;
        for (String port : portIds) {
            ops++;  // O(1) contains + O(1) remove
            trustedPorts.remove(port);
        }
        return ops;
    }

    public static void main(String[] args) {
        int N = 2000;
        int passed = 0;
        int total = 0;

        // Build initial trusted ports list/set
        List<String> slowList = new ArrayList<>();
        Set<String> fastSet = new HashSet<>();
        List<String> portIds = new ArrayList<>();
        for (int i = 0; i < N; i++) {
            String p = "port-" + i;
            slowList.add(p);
            fastSet.add(p);
        }
        // New port_ids — N ports not yet trusted
        List<String> newPortIds = new ArrayList<>();
        for (int i = N; i < 2 * N; i++) {
            newPortIds.add("port-" + i);
        }
        // Remove port_ids — first N ports
        for (int i = 0; i < N; i++) {
            portIds.add("port-" + i);
        }

        // Test 1: process (add) — slow vs fast ops
        List<String> slowListCopy = new ArrayList<>(slowList);
        Set<String> fastSetCopy = new HashSet<>(fastSet);
        long slowOps = processTrustedPortsSlow(slowListCopy, newPortIds);
        long fastOps = processTrustedPortsFast(fastSetCopy, newPortIds);
        total++;
        assert slowOps > fastOps * 10 :
            "process: slow=" + slowOps + " fast=" + fastOps + " speedup insufficient";
        System.out.println("Test 1 PASS: process_trusted_ports slow=" + slowOps +
            " ops, fast=" + fastOps + " ops, speedup=" + (slowOps / Math.max(1, fastOps)) + "x");
        passed++;

        // Test 2: remove — slow vs fast ops
        List<String> slowListRemove = new ArrayList<>(slowList);
        Set<String> fastSetRemove = new HashSet<>(fastSet);
        long slowRemOps = removeTrustedPortsSlow(slowListRemove, portIds);
        long fastRemOps = removeTrustedPortsFast(fastSetRemove, portIds);
        total++;
        assert slowRemOps > fastRemOps * 10 :
            "remove: slow=" + slowRemOps + " fast=" + fastRemOps + " speedup insufficient";
        System.out.println("Test 2 PASS: remove_trusted_ports slow=" + slowRemOps +
            " ops, fast=" + fastRemOps + " ops, speedup=" + (slowRemOps / Math.max(1, fastRemOps)) + "x");
        passed++;

        // Test 3: correctness — same elements result
        List<String> corSlow = new ArrayList<>(slowList);
        Set<String> corFast = new HashSet<>(fastSet);
        processTrustedPortsSlow(corSlow, newPortIds);
        processTrustedPortsFast(corFast, newPortIds);
        total++;
        assert new HashSet<>(corSlow).equals(corFast) :
            "process: slow and fast produce different results";
        System.out.println("Test 3 PASS: process_trusted_ports slow and fast agree");
        passed++;

        // Test 4: remove correctness
        List<String> remSlow = new ArrayList<>(slowList);
        Set<String> remFast = new HashSet<>(fastSet);
        removeTrustedPortsSlow(remSlow, portIds);
        removeTrustedPortsFast(remFast, portIds);
        total++;
        assert new HashSet<>(remSlow).equals(remFast) :
            "remove: slow and fast produce different results";
        System.out.println("Test 4 PASS: remove_trusted_ports slow and fast agree");
        passed++;

        System.out.println(passed + "/" + total + " PASS");
    }
}