C++ OO design question

I

indrawati.yahya

In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRule> filterRules;
};


However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
 
K

Kai-Uwe Bux

In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRule> filterRules;
};
Click to expand...

You mean

std::vector said:
However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
Click to expand...

I like your idea of representing a filter just as a vector of filter rules.
If you want to actually reduce that to practice, you could use duck typing
instead of inheritance. E.g.:

typedef bool (sig) (Paket const &)
typedef std::tr1::function<sig> FilterRule;

Now, FilterRule can hold any value that supports

bool operator() ( Paket const & )

In particular, the concrete classes could be:

class IpFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

class PortFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

and a Filter can now easily be represented as a std::vector< FilterRule >.

Note that there is no coupling between the classes. Should there be common
code, one can incorporate that into the classes using private inheritance.
It would be considered an implementation detail.

Also, the client code would use objects of type FilterRule (or IpFilterrule,
etc) instead of FilterRule* (or IpFilterRule*, etc).


Best

Kai-Uwe Bux
 
?

=?ISO-8859-1?Q?Erik_Wikstr=F6m?=

In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?
Click to expand...

This is really a question for a group discussing object-oriented design
so you should ask in comp.object or perhaps comp.programming.
My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRule> filterRules;
Click to expand...

Slicing, you cannot store derived types in a vector parametrised by the
base type, you have to use pointers instead:

std::vector said:
};


However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
Click to expand...


I assume you forgot
class Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};
Click to expand...

This assumes that you can filter multiple IP addresses or ports with a
single FilterByIP object, which might allow some optimisations that are
not possible when you have more than one FilterByIP object (which your
solution allows). However it is also less flexible for the same reasons.
I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
Click to expand...

Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.
 
M

Michael DOUBEZ

Erik Wikström a écrit :
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?
Click to expand...

This is really a question for a group discussing object-oriented design
so you should ask in comp.object or perhaps comp.programming.
My answer was:
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };
[snip] He prefered
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
Click to expand...
Click to expand...
Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.
Click to expand...

IMO in "either IP address, port number, or both.", the "both" means
ports related to specific IP addresses and not merely applying the rules
independantely; this makes sense with the interviewer's design and with
the field.

Michael
 
?

=?ISO-8859-1?Q?Erik_Wikstr=F6m?=

Erik Wikström a écrit :
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?
Click to expand...

This is really a question for a group discussing object-oriented design
so you should ask in comp.object or perhaps comp.programming.
My answer was:
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };
[snip] He prefered
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
Click to expand...
Click to expand...
Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.
Click to expand...

IMO in "either IP address, port number, or both.", the "both" means
ports related to specific IP addresses and not merely applying the rules
independantely; this makes sense with the interviewer's design and with
the field.
Click to expand...

That can easily be solved with the OP's design by adding a class like
FilterByIPAndPort, and to be honest I thought that was just an omission
of the OP (just like leaving out a FilterByIPAndPort member in the
interviewer's design. I thought the issue was the question if a
container should be used or members like in the interviewer's design.
 
K

Kai-Uwe Bux

Kai-Uwe Bux said:
You mean



I like your idea of representing a filter just as a vector of filter
rules. If you want to actually reduce that to practice, you could use duck
typing instead of inheritance. E.g.:

typedef bool (sig) (Paket const &)
typedef std::tr1::function<sig> FilterRule;

Now, FilterRule can hold any value that supports

bool operator() ( Paket const & )

In particular, the concrete classes could be:

class IpFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

class PortFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

and a Filter can now easily be represented as a std::vector< FilterRule >.

Note that there is no coupling between the classes. Should there be common
code, one can incorporate that into the classes using private inheritance.
It would be considered an implementation detail.

Also, the client code would use objects of type FilterRule (or
IpFilterrule, etc) instead of FilterRule* (or IpFilterRule*, etc).
Click to expand...

I just realized that one can go even further with this idea:


#include <tr1/functional>
#include <vector>
#include <iostream>

typedef unsigned int Paket;

// machinery for predicates
// ========================

typedef bool(sig)(Paket const &);
typedef std::tr1::function<sig> PaketPredicate;

class AndPredicate {

PaketPredicate the_lhs;
PaketPredicate the_rhs;

AndPredicate ( PaketPredicate const & lhs,
PaketPredicate const & rhs )
: the_lhs ( lhs )
, the_rhs ( rhs )
{}

public:

friend
AndPredicate operator&& ( PaketPredicate const & lhs,
PaketPredicate const & rhs );

bool operator() ( Paket const & p ) const {
return ( the_lhs(p) && the_rhs(p) );
}

};

AndPredicate operator&& ( PaketPredicate const & lhs,
PaketPredicate const & rhs ) {
return ( AndPredicate( lhs, rhs ) );
}

class OrPredicate {

PaketPredicate the_lhs;
PaketPredicate the_rhs;

OrPredicate ( PaketPredicate const & lhs,
PaketPredicate const & rhs )
: the_lhs ( lhs )
, the_rhs ( rhs )
{}

public:

friend
OrPredicate operator|| ( PaketPredicate const & lhs,
PaketPredicate const & rhs );

bool operator() ( Paket const & p ) const {
return ( the_lhs(p) || the_rhs(p) );
}

};

OrPredicate operator|| ( PaketPredicate const & lhs,
PaketPredicate const & rhs ) {
return ( OrPredicate( lhs, rhs ) );
}

class NotPredicate {

PaketPredicate the_lhs;

NotPredicate ( PaketPredicate const & lhs )
: the_lhs ( lhs )
{}

public:

friend
NotPredicate operator! ( PaketPredicate const & lhs );

bool operator() ( Paket const & p ) const {
return ( ! the_lhs(p) );
}

};

NotPredicate operator! ( PaketPredicate const & lhs ) {
return ( NotPredicate( lhs ) );
}



class ForallPredicate
// [should use private inheritance]
: public std::vector< PaketPredicate >
{

typedef std::vector< PaketPredicate > base;

public:

bool operator() ( Paket const & p ) const {
for ( base::const_iterator iter = this->begin();
iter != this->end(); ++iter ) {
if ( ! (*iter)(p) ) {
return ( false );
}
}
return ( true );
}

};

class ExistsPredicate
// [should use private inheritance]
: public std::vector< PaketPredicate >
{

typedef std::vector< PaketPredicate > base;

public:

bool operator() ( Paket const & p ) const {
for ( base::const_iterator iter = this->begin();
iter != this->end(); ++iter ) {
if ( (*iter)(p) ) {
return ( true );
}
}
return ( false );
}

};


// basic paket properties
// ======================

class Divisible {

unsigned int the_modulus;

public:

Divisible ( unsigned int m )
: the_modulus ( m )
{}

bool operator() ( Paket const & p ) const {
return ( p % the_modulus == 0 );
}

};

// sanity check
// ============


int main ( void ) {
for ( unsigned int i = 0; i < 100; ++i ) {
std::cout << i << " "
<< ((Divisible(2) && Divisible(3)) || Divisible(5))(i)
<< '\n';
}
std::cout << '\n';
Divisible even ( 2 );
Divisible five ( 5 );
PaketPredicate ten = even && five;
for ( unsigned int i = 0; i < 20; ++i ) {
std::cout << i << " " << ten(i) << '\n';
}
std::cout << '\n';
ForallPredicate rare;
rare.push_back( ten );
rare.push_back( ! Divisible( 7 ) );
for ( unsigned int i = 60; i < 100; ++i ) {
std::cout << i << " " << rare(i) << '\n';
}

}


/*
For actual paket filtering, you may have Predicates that
check whether IP addresses are inside a specified range.
*/
// E.g.:

class DestinationIpInRange {};
class SourcePortInRange {};

/*
Other predicates can then be defined in terms of these
basic paket properties using the logic machinery. In the
end, a filter would be just a ForallPredicate.
*/



Best

Kai-Uwe Bux
 
B

Barry

In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRule> filterRules;
};


However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
Click to expand...

I think the first design, (while the second didn't give any detail)
overlook the one important thing,
The IP/PORT resources should be shared, not owned, we can't have every
instance of XXFilter to own one copy,

std::vector<some_smart_pointer<...> > as Kai-uwe mentioned else thread
still don't fullfill this purpose

should be
some_smart_ptr<std::vector<...> >
 
M

Michael DOUBEZ

Erik Wikström a écrit :
Erik Wikström a écrit :
On 2007-09-17 09:24, (e-mail address removed) wrote:
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

This is really a question for a group discussing object-oriented
design so you should ask in comp.object or perhaps comp.programming.

My answer was:
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };
[snip] He prefered
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
Click to expand...
Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.
Click to expand...

IMO in "either IP address, port number, or both.", the "both" means
ports related to specific IP addresses and not merely applying the
rules independantely; this makes sense with the interviewer's design
and with the field.
Click to expand...

That can easily be solved with the OP's design by adding a class like
FilterByIPAndPort, and to be honest I thought that was just an omission
of the OP (just like leaving out a FilterByIPAndPort member in the
interviewer's design. I thought the issue was the question if a
container should be used or members like in the interviewer's design.
Click to expand...

And IMHO it is the same misunderstanding that happened during the
interview: whether thinking in terms of C++ design or field idiom. Only
the OP and the interviewer can tell.

Michael
 
I

indrawati.yahya

That can easily be solved with the OP's design by adding a class like
And IMHO it is the same misunderstanding that happened during the
interview: whether thinking in terms of C++ design or field idiom. Only
the OP and the interviewer can tell.
Click to expand...

Thanks for all the replies. To be honest, the thought that filtering
by IP address and port can correlate never crossed my mind during the
interview. I always thought that they are independent of each other,
as probably can be seen on my solution to the problem. Maybe it's true
that the interviewer and I understood the problems differently, which
explains his dissatisfaction with my answer. As Erik has mentioned, my
oversight can easily be solved by adding a FilterByIPAndPort to my
design. Had I done that, I might've gotten the job :p
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Good design question 2
Interface design question 4
OO Programming Question: Global Object in C++ 2
A design question .... 1
Design Question 13
on a design question using C++ 17
feedback on code design 23
std iostreams design question, why not like java stream wrappers? 18

Members online

No members online now.
Total: 57 (members: 1, guests: 56)
Robots: 399

Forum statistics

Threads
473,982
Messages
2,570,186
Members
46,744
Latest member
CortneyMcK

Latest Threads

Top