468,134 Members | 1,214 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 468,134 developers. It's quick & easy.

C++ OO design question

In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRulefilterRules;
};
However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.

Sep 17 '07 #1
8 1875
in*************@gmail.com wrote:
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRulefilterRules;
};
You mean

std::vector< some_smart_pointer<FilterRule filterRules;
>
However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
I like your idea of representing a filter just as a vector of filter rules.
If you want to actually reduce that to practice, you could use duck typing
instead of inheritance. E.g.:

typedef bool (sig) (Paket const &)
typedef std::tr1::function<sigFilterRule;

Now, FilterRule can hold any value that supports

bool operator() ( Paket const & )

In particular, the concrete classes could be:

class IpFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

class PortFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

and a Filter can now easily be represented as a std::vector< FilterRule >.

Note that there is no coupling between the classes. Should there be common
code, one can incorporate that into the classes using private inheritance.
It would be considered an implementation detail.

Also, the client code would use objects of type FilterRule (or IpFilterrule,
etc) instead of FilterRule* (or IpFilterRule*, etc).
Best

Kai-Uwe Bux
Sep 17 '07 #2
On 2007-09-17 09:24, in*************@gmail.com wrote:
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?
This is really a question for a group discussing object-oriented design
so you should ask in comp.object or perhaps comp.programming.
My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRulefilterRules;
Slicing, you cannot store derived types in a vector parametrised by the
base type, you have to use pointers instead:

std::vector<FilterRulefilterRules;
};
However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter

I assume you forgot
class Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};
This assumes that you can filter multiple IP addresses or ports with a
single FilterByIP object, which might allow some optimisations that are
not possible when you have more than one FilterByIP object (which your
solution allows). However it is also less flexible for the same reasons.
I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.

--
Erik Wikström
Sep 17 '07 #3
Erik Wikström a écrit :
On 2007-09-17 09:24, in*************@gmail.com wrote:
>In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

This is really a question for a group discussing object-oriented design
so you should ask in comp.object or perhaps comp.programming.
>My answer was:
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };
[snip] He prefered
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.
IMO in "either IP address, port number, or both.", the "both" means
ports related to specific IP addresses and not merely applying the rules
independantely; this makes sense with the interviewer's design and with
the field.

Michael
Sep 17 '07 #4
On 2007-09-17 11:24, Michael DOUBEZ wrote:
Erik Wikström a écrit :
>On 2007-09-17 09:24, in*************@gmail.com wrote:
>>In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

This is really a question for a group discussing object-oriented design
so you should ask in comp.object or perhaps comp.programming.
>>My answer was:
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };
[snip] He prefered
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
>Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.

IMO in "either IP address, port number, or both.", the "both" means
ports related to specific IP addresses and not merely applying the rules
independantely; this makes sense with the interviewer's design and with
the field.
That can easily be solved with the OP's design by adding a class like
FilterByIPAndPort, and to be honest I thought that was just an omission
of the OP (just like leaving out a FilterByIPAndPort member in the
interviewer's design. I thought the issue was the question if a
container should be used or members like in the interviewer's design.

--
Erik Wikström
Sep 17 '07 #5
in*************@gmail.com wrote:
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRulefilterRules;
};
However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.
I think the first design, (while the second didn't give any detail)
overlook the one important thing,
The IP/PORT resources should be shared, not owned, we can't have every
instance of XXFilter to own one copy,

std::vector<some_smart_pointer<... as Kai-uwe mentioned else thread
still don't fullfill this purpose

should be
some_smart_ptr<std::vector<...
--
Thanks
Barry
Sep 17 '07 #6
Kai-Uwe Bux wrote:
in*************@gmail.com wrote:
>In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

My answer was:

class FilterRule
{
public:
virtual bool Accept(const Packet&) const = 0; //Packet is a
representation of a network packet
};
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };

class Filter
{
public:
bool Accept(const Packet&) const; //returns true if ALL
filterRules Accept() the Packet
private:
std::vector<FilterRulefilterRules;
};

You mean

std::vector< some_smart_pointer<FilterRule filterRules;
>>
However, the interviewer said that he preferred this solution instead:

class Filter
{
public:
virtual bool Accept(const Packet&) const = 0;
};
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
{
protected:
FilterByIP ipFilter;
FilterByPort portFilter;
/* other members */
};

I reasoned that with his solution, there may be too many class numbers
if down the road we decide to filter packets by methods other than IP
address and Port, but somehow he was not convinced. Oh well, I didn't
get the job, but this question continues to haunt me to this day. What
do you C++ experts think? Or is there another better solution that I
did not consider? Thank you.

I like your idea of representing a filter just as a vector of filter
rules. If you want to actually reduce that to practice, you could use duck
typing instead of inheritance. E.g.:

typedef bool (sig) (Paket const &)
typedef std::tr1::function<sigFilterRule;

Now, FilterRule can hold any value that supports

bool operator() ( Paket const & )

In particular, the concrete classes could be:

class IpFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

class PortFilterRule {
...
public:

bool operator() ( Paket const & p ) {
}

};

and a Filter can now easily be represented as a std::vector< FilterRule >.

Note that there is no coupling between the classes. Should there be common
code, one can incorporate that into the classes using private inheritance.
It would be considered an implementation detail.

Also, the client code would use objects of type FilterRule (or
IpFilterrule, etc) instead of FilterRule* (or IpFilterRule*, etc).
I just realized that one can go even further with this idea:
#include <tr1/functional>
#include <vector>
#include <iostream>

typedef unsigned int Paket;

// machinery for predicates
// ========================

typedef bool(sig)(Paket const &);
typedef std::tr1::function<sigPaketPredicate;

class AndPredicate {

PaketPredicate the_lhs;
PaketPredicate the_rhs;

AndPredicate ( PaketPredicate const & lhs,
PaketPredicate const & rhs )
: the_lhs ( lhs )
, the_rhs ( rhs )
{}

public:

friend
AndPredicate operator&& ( PaketPredicate const & lhs,
PaketPredicate const & rhs );

bool operator() ( Paket const & p ) const {
return ( the_lhs(p) && the_rhs(p) );
}

};

AndPredicate operator&& ( PaketPredicate const & lhs,
PaketPredicate const & rhs ) {
return ( AndPredicate( lhs, rhs ) );
}

class OrPredicate {

PaketPredicate the_lhs;
PaketPredicate the_rhs;

OrPredicate ( PaketPredicate const & lhs,
PaketPredicate const & rhs )
: the_lhs ( lhs )
, the_rhs ( rhs )
{}

public:

friend
OrPredicate operator|| ( PaketPredicate const & lhs,
PaketPredicate const & rhs );

bool operator() ( Paket const & p ) const {
return ( the_lhs(p) || the_rhs(p) );
}

};

OrPredicate operator|| ( PaketPredicate const & lhs,
PaketPredicate const & rhs ) {
return ( OrPredicate( lhs, rhs ) );
}

class NotPredicate {

PaketPredicate the_lhs;

NotPredicate ( PaketPredicate const & lhs )
: the_lhs ( lhs )
{}

public:

friend
NotPredicate operator! ( PaketPredicate const & lhs );

bool operator() ( Paket const & p ) const {
return ( ! the_lhs(p) );
}

};

NotPredicate operator! ( PaketPredicate const & lhs ) {
return ( NotPredicate( lhs ) );
}

class ForallPredicate
// [should use private inheritance]
: public std::vector< PaketPredicate >
{

typedef std::vector< PaketPredicate base;

public:

bool operator() ( Paket const & p ) const {
for ( base::const_iterator iter = this->begin();
iter != this->end(); ++iter ) {
if ( ! (*iter)(p) ) {
return ( false );
}
}
return ( true );
}

};

class ExistsPredicate
// [should use private inheritance]
: public std::vector< PaketPredicate >
{

typedef std::vector< PaketPredicate base;

public:

bool operator() ( Paket const & p ) const {
for ( base::const_iterator iter = this->begin();
iter != this->end(); ++iter ) {
if ( (*iter)(p) ) {
return ( true );
}
}
return ( false );
}

};
// basic paket properties
// ======================

class Divisible {

unsigned int the_modulus;

public:

Divisible ( unsigned int m )
: the_modulus ( m )
{}

bool operator() ( Paket const & p ) const {
return ( p % the_modulus == 0 );
}

};

// sanity check
// ============
int main ( void ) {
for ( unsigned int i = 0; i < 100; ++i ) {
std::cout << i << " "
<< ((Divisible(2) && Divisible(3)) || Divisible(5))(i)
<< '\n';
}
std::cout << '\n';
Divisible even ( 2 );
Divisible five ( 5 );
PaketPredicate ten = even && five;
for ( unsigned int i = 0; i < 20; ++i ) {
std::cout << i << " " << ten(i) << '\n';
}
std::cout << '\n';
ForallPredicate rare;
rare.push_back( ten );
rare.push_back( ! Divisible( 7 ) );
for ( unsigned int i = 60; i < 100; ++i ) {
std::cout << i << " " << rare(i) << '\n';
}

}
/*
For actual paket filtering, you may have Predicates that
check whether IP addresses are inside a specified range.
*/
// E.g.:

class DestinationIpInRange {};
class SourcePortInRange {};

/*
Other predicates can then be defined in terms of these
basic paket properties using the logic machinery. In the
end, a filter would be just a ForallPredicate.
*/

Best

Kai-Uwe Bux
Sep 17 '07 #7
Erik Wikström a écrit :
On 2007-09-17 11:24, Michael DOUBEZ wrote:
>Erik Wikström a écrit :
>>On 2007-09-17 09:24, in*************@gmail.com wrote:
In a recent job interview, the interviewer asked me how I'd design
classes for the following problem: let's consider a hypothetical
firewall, which filters network packets by either IP address, port
number, or both. How should we design the classes to represent these
filters?

This is really a question for a group discussing object-oriented
design so you should ask in comp.object or perhaps comp.programming.

My answer was:
class FilterByIP: public FilterRule { /* members here */ };
class FilterByPort: public FilterRule { /* members here */ };
[snip] He prefered
class FilterByIP: public Filter { /* members here */ }
class FilterByPort: public Filter { /* members here */ }
class FilterByIPAndPort: public Filter
>>Yes, I also prefer your design, it is more flexible and more easily
extended, however I've never thought much about firewall design and
there might be some other reasons to use his design.

IMO in "either IP address, port number, or both.", the "both" means
ports related to specific IP addresses and not merely applying the
rules independantely; this makes sense with the interviewer's design
and with the field.

That can easily be solved with the OP's design by adding a class like
FilterByIPAndPort, and to be honest I thought that was just an omission
of the OP (just like leaving out a FilterByIPAndPort member in the
interviewer's design. I thought the issue was the question if a
container should be used or members like in the interviewer's design.
And IMHO it is the same misunderstanding that happened during the
interview: whether thinking in terms of C++ design or field idiom. Only
the OP and the interviewer can tell.

Michael
Sep 17 '07 #8
That can easily be solved with the OP's design by adding a class like
FilterByIPAndPort, and to be honest I thought that was just an omission
of the OP (just like leaving out a FilterByIPAndPort member in the
interviewer's design. I thought the issue was the question if a
container should be used or members like in the interviewer's design.

And IMHO it is the same misunderstanding that happened during the
interview: whether thinking in terms of C++ design or field idiom. Only
the OP and the interviewer can tell.
Thanks for all the replies. To be honest, the thought that filtering
by IP address and port can correlate never crossed my mind during the
interview. I always thought that they are independent of each other,
as probably can be seen on my solution to the problem. Maybe it's true
that the interviewer and I understood the problems differently, which
explains his dissatisfaction with my answer. As Erik has mentioned, my
oversight can easily be solved by adding a FilterByIPAndPort to my
design. Had I done that, I might've gotten the job :P

Sep 17 '07 #9

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

5 posts views Thread by Don Vaillancourt | last post: by
2 posts views Thread by Test User | last post: by
6 posts views Thread by rodchar | last post: by
17 posts views Thread by tshad | last post: by
17 posts views Thread by roN | last post: by
6 posts views Thread by JoeC | last post: by
19 posts views Thread by neelsmail | last post: by
27 posts views Thread by didacticone | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.