RDKB-66541 : Initial code changes for gaurdian

[rajkamal-cv]

Initial port of https://gerrit.teamccp.com/#/c/964212/

[github-actions]

📋 PR Format Reminder

• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

🟡 Changes recommended

The new guardian OVS “show” path can mask command failures and config parsing silently truncates over-limit entries, both of which can lead to incorrect/opaque runtime behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an initial native-C “guardian” OpenFlow policy agent to the existing OVS agent build, intended as an early scaffold/port of guardian.sh with incremental follow-up work planned.

Changes:

• Integrates a new source/guardian subdirectory and wires it into Autotools (SUBDIRS, AC_CONFIG_FILES).
• Introduces a guardian CLI binary with basic command parsing and partial flow generation scaffolding.
• Implements initial OVS interaction using ovs-ofctl (clear + add-flows; show via dump-flows).

File summaries

File	Description
source/Makefile.am	Adds guardian to build subdirectories.
source/guardian/Makefile.am	Defines build for the new guardian program.
source/guardian/guardian.h	Adds shared constants and CLI command enum.
source/guardian/guardian_ovs.h	Declares OVS apply/clear/show interface.
source/guardian/guardian_ovs.c	Implements ovs-ofctl-based apply/clear/show.
source/guardian/guardian_main.c	Implements CLI parsing and command dispatch.
source/guardian/guardian_flows.h	Declares flowset representation and generator API.
source/guardian/guardian_flows.c	Adds initial flow generation scaffold.
source/guardian/guardian_config.h	Declares config load/accessor APIs.
source/guardian/guardian_config.c	Implements initial INI-style config parsing scaffold.
configure.ac	Adds guardian Makefile generation to configure.

Review details

Suppressed comments (1)

source/guardian/guardian_config.c:106

• When the number of parsed [devices] entries exceeds MAX_DEVICES, the current logic silently ignores additional entries (because of the cfg->n_devices < MAX_DEVICES guard). That can result in a partially applied policy with no error returned to the caller.

            char mac[MAX_NAME], grp[MAX_NAME];
            if (sscanf(s, "%63s %63s", mac, grp) == 2 && cfg->n_devices < MAX_DEVICES) {
                struct device_entry *d = &cfg->devices[cfg->n_devices++];
                snprintf(d->mac, sizeof d->mac, "%s", mac);
                snprintf(d->group, sizeof d->group, "%s", grp);

• Files reviewed: 11/11 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.