Make mapstate modifiers private. This helps later when modifiers need to
have selector cache locked.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Remove the initMap from newMapState() and add withState(), and the same
for the interface returning versions (NewMapState() and WithState()). This
helps reducing refactor changes from the next commit.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Copy the L4-key when creating new L3/L4 entries due to policy precedence
rules and copy the Identity from the L3-only key. This way the code is
simpler and less error prone.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Use the type mapStateMap directly rather than via mapState when adding
l3l4 entries for Auth policies.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Add CIDR index to mapStateMap alongside the ID map. This allows for more
efficient lookup of super/sub-set entries for deny rule insertion.

This requires passing Identities interface along so that the CIDR can be
gotten from the selector cache.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Use PortProto and CIDR tries instead of scanning all entries when
preserving precedence for deny rules.

On a test benchmark with 1000 random allow and deny CIDR rules each, this
speeds up MapState generation by >1800x, hopefully making deny policies
useful in practical situations.

Optional validator interface is added to mapState so that we can keep the
existing identityIsSupersetOf logic in unit tests as additional
validation that the ancestor and descendats logic is visiting only
expeted entries.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

The added L3/L4 entries were created with 0 proxy port, while the proxy
port should be copied from the L4 rule.

Auth type should propagate from a L3 rule with protocol and wildcard port
when another L3-wildcard rule without auth type has the same protocol and
a specific port. In this case a new entry with the L3 and proto from the
L3-rule and the port (and the same protocol) from the L4-only rule should
be created.

Add unit testing to validate the above.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Use the port/proto trie index to exclude uninteresing keys from the scan
needed for propagating auth properties from more general rules to more
specific ones.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Use the cidr index to find interesting items for visibility key injection
without ranging over all entries in the MapState.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Currently there are no users so it is a good time to remove these.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>