Examples with IpAccessListLine org.batfish.datamodel.IpAccessListLine used on opensource projects

Example 31 with IpAccessListLine

use of org.batfish.datamodel.IpAccessListLine in project batfish by batfish.

the class SecurityGroupsTest method testStatefulTcpRules.

@Test
public void testStatefulTcpRules() throws JSONException {
    SecurityGroup sg = new SecurityGroup(_securityGroups.getJSONObject(8), null);
    List<IpAccessListLine> inboundRules = new LinkedList<>();
    List<IpAccessListLine> outboundRules = new LinkedList<>();
    sg.addInOutAccessLines(inboundRules, outboundRules, _region);
    assertThat(inboundRules, equalTo(ImmutableList.of(IpAccessListLine.builder().setAction(LineAction.ACCEPT).setIpProtocols(Sets.newHashSet(IpProtocol.TCP)).setSrcIps(Sets.newHashSet(new IpWildcard("1.2.3.4/32"))).setDstPorts(Sets.newHashSet(new SubRange(22, 22))).build(), _rejectSynOnly, // reverse of outbound rule
    IpAccessListLine.builder().setAction(LineAction.ACCEPT).setIpProtocols(Sets.newHashSet(IpProtocol.TCP)).setSrcIps(Sets.newHashSet(new IpWildcard("5.6.7.8/32"))).setSrcPorts(Sets.newHashSet(new SubRange(80, 80))).build())));
    assertThat(outboundRules, equalTo(ImmutableList.of(IpAccessListLine.builder().setAction(LineAction.ACCEPT).setIpProtocols(Sets.newHashSet(IpProtocol.TCP)).setDstIps(Sets.newHashSet(new IpWildcard("5.6.7.8/32"))).setDstPorts(Sets.newHashSet(new SubRange(80, 80))).build(), _rejectSynOnly, // reverse of inbound rule
    IpAccessListLine.builder().setAction(LineAction.ACCEPT).setIpProtocols(Sets.newHashSet(IpProtocol.TCP)).setDstIps(Sets.newHashSet(new IpWildcard("1.2.3.4/32"))).setSrcPorts(Sets.newHashSet(new SubRange(22, 22))).build())));
}

Example 32 with IpAccessListLine

use of org.batfish.datamodel.IpAccessListLine in project batfish by batfish.

the class SecurityGroupsTest method testDeniedSynOnlyResponse.

@Test
public void testDeniedSynOnlyResponse() throws JSONException {
    SecurityGroup sg = new SecurityGroup(_securityGroups.getJSONObject(8), null);
    List<IpAccessListLine> inboundRules = new LinkedList<>();
    List<IpAccessListLine> outboundRules = new LinkedList<>();
    sg.addInOutAccessLines(inboundRules, outboundRules, _region);
    IpAccessList outFilter = new IpAccessList(TEST_ACL, outboundRules);
    // flow containing SYN and ~ACK should be rejected
    _flowBuilder.setDstIp(new Ip("1.2.3.4"));
    _flowBuilder.setSrcPort(22);
    _flowBuilder.setTcpFlagsAck(0);
    _flowBuilder.setTcpFlagsSyn(1);
    assertThat(outFilter.filter(_flowBuilder.build()).getAction(), equalTo(LineAction.REJECT));
}

Example 33 with IpAccessListLine

use of org.batfish.datamodel.IpAccessListLine in project batfish by batfish.

the class SecurityGroupsTest method testBeginningHalfOpenInterval.

@Test
public void testBeginningHalfOpenInterval() throws JSONException {
    SecurityGroup sg = new SecurityGroup(_securityGroups.getJSONObject(1), null);
    List<IpAccessListLine> inboundRules = new LinkedList<>();
    List<IpAccessListLine> outboundRules = new LinkedList<>();
    sg.addInOutAccessLines(inboundRules, outboundRules, _region);
    assertThat(inboundRules, equalTo(ImmutableList.of(IpAccessListLine.builder().setAction(LineAction.ACCEPT).setIpProtocols(Sets.newHashSet(IpProtocol.TCP)).setSrcIps(Sets.newHashSet(new IpWildcard("1.2.3.4/32"))).setDstPorts(Sets.newHashSet(new SubRange(0, 22))).build(), _rejectSynOnly, _allowAllReverseOutboundRule)));
}

Example 34 with IpAccessListLine

use of org.batfish.datamodel.IpAccessListLine in project batfish by batfish.

the class SecurityGroupsTest method testAllowedSynAckResponse.

@Test
public void testAllowedSynAckResponse() throws JSONException {
    SecurityGroup sg = new SecurityGroup(_securityGroups.getJSONObject(8), null);
    List<IpAccessListLine> inboundRules = new LinkedList<>();
    List<IpAccessListLine> outboundRules = new LinkedList<>();
    sg.addInOutAccessLines(inboundRules, outboundRules, _region);
    IpAccessList outFilter = new IpAccessList(TEST_ACL, outboundRules);
    // flow containing SYN and ACK should be accepted
    _flowBuilder.setDstIp(new Ip("1.2.3.4"));
    _flowBuilder.setSrcPort(22);
    _flowBuilder.setTcpFlagsAck(1);
    _flowBuilder.setTcpFlagsSyn(1);
    assertThat(outFilter.filter(_flowBuilder.build()).getAction(), equalTo(LineAction.ACCEPT));
}

Example 35 with IpAccessListLine

use of org.batfish.datamodel.IpAccessListLine in project batfish by batfish.

the class SecurityGroupsTest method testInvalidEndInterval.

@Test
public void testInvalidEndInterval() throws JSONException {
    SecurityGroup sg = new SecurityGroup(_securityGroups.getJSONObject(7), null);
    List<IpAccessListLine> inboundRules = new LinkedList<>();
    List<IpAccessListLine> outboundRules = new LinkedList<>();
    sg.addInOutAccessLines(inboundRules, outboundRules, _region);
    assertThat(inboundRules, equalTo(ImmutableList.of(IpAccessListLine.builder().setAction(LineAction.ACCEPT).setIpProtocols(Sets.newHashSet(IpProtocol.TCP)).setSrcIps(Sets.newHashSet(new IpWildcard("1.2.3.4/32"))).setDstPorts(Sets.newHashSet(new SubRange(30, 65535))).build(), _rejectSynOnly, _allowAllReverseOutboundRule)));
}