Examples with IpWildcard org.batfish.datamodel.IpWildcard used on opensource projects

Example 61 with IpWildcard

use of org.batfish.datamodel.IpWildcard in project batfish by batfish.

the class IpAccessListSpecializer method specialize.

public Optional<IpAccessListLine> specialize(IpAccessListLine ipAccessListLine) {
    IpWildcardSetIpSpace.Builder srcIpSpaceBuilder = IpWildcardSetIpSpace.builder().excluding(ipAccessListLine.getNotSrcIps());
    if (ipAccessListLine.getSrcIps().isEmpty() && ipAccessListLine.getSrcOrDstIps().isEmpty()) {
        srcIpSpaceBuilder.including(IpWildcard.ANY);
    } else {
        srcIpSpaceBuilder.including(ipAccessListLine.getSrcIps());
        srcIpSpaceBuilder.including(ipAccessListLine.getSrcOrDstIps());
    }
    IpSpace specializedSrcIpSpace = _srcIpSpaceSpecializer.specialize(srcIpSpaceBuilder.build());
    IpWildcardSetIpSpace.Builder dstIpSpaceBuilder = IpWildcardSetIpSpace.builder().excluding(ipAccessListLine.getNotDstIps());
    if (ipAccessListLine.getDstIps().isEmpty() && ipAccessListLine.getSrcOrDstIps().isEmpty()) {
        dstIpSpaceBuilder.including(IpWildcard.ANY);
    } else {
        dstIpSpaceBuilder.including(ipAccessListLine.getDstIps());
        dstIpSpaceBuilder.including(ipAccessListLine.getSrcOrDstIps());
    }
    IpSpace specializedDstIpSpace = _dstIpSpaceSpecializer.specialize(dstIpSpaceBuilder.build());
    if (specializedDstIpSpace instanceof EmptyIpSpace || specializedSrcIpSpace instanceof EmptyIpSpace) {
        return Optional.empty();
    }
    Set<IpWildcard> specializedDstIps;
    Set<IpWildcard> specializedNotDstIps;
    if (specializedDstIpSpace instanceof UniverseIpSpace) {
        // for a HeaderSpace, empty dstIps means Universe
        specializedDstIps = ImmutableSet.of();
        specializedNotDstIps = ImmutableSet.of();
    } else if (specializedDstIpSpace instanceof IpWildcardSetIpSpace) {
        IpWildcardSetIpSpace dstIpWildcardSetIpSpace = (IpWildcardSetIpSpace) specializedDstIpSpace;
        specializedDstIps = dstIpWildcardSetIpSpace.getWhitelist();
        specializedNotDstIps = dstIpWildcardSetIpSpace.getBlacklist();
    } else if (specializedDstIpSpace instanceof IpWildcard) {
        specializedDstIps = ImmutableSet.of((IpWildcard) specializedDstIpSpace);
        specializedNotDstIps = ImmutableSet.of();
    } else {
        throw new BatfishException("unexpected specializedDstIpSpace type");
    }
    Set<IpWildcard> specializedSrcIps;
    Set<IpWildcard> specializedNotSrcIps;
    if (specializedSrcIpSpace instanceof UniverseIpSpace) {
        specializedSrcIps = ImmutableSet.of();
        specializedNotSrcIps = ImmutableSet.of();
    } else if (specializedSrcIpSpace instanceof IpWildcardSetIpSpace) {
        IpWildcardSetIpSpace srcIpWildcardSetIpSpace = (IpWildcardSetIpSpace) specializedSrcIpSpace;
        specializedSrcIps = srcIpWildcardSetIpSpace.getWhitelist();
        specializedNotSrcIps = srcIpWildcardSetIpSpace.getBlacklist();
    } else if (specializedSrcIpSpace instanceof IpWildcard) {
        specializedSrcIps = ImmutableSet.of((IpWildcard) specializedSrcIpSpace);
        specializedNotSrcIps = ImmutableSet.of();
    } else {
        throw new BatfishException("unexpected specializedSrcIpSpace type");
    }
    return Optional.of(ipAccessListLine.rebuild().setDstIps(specializedDstIps).setNotDstIps(specializedNotDstIps).setSrcIps(specializedSrcIps).setNotSrcIps(specializedNotSrcIps).build());
}

Example 62 with IpWildcard

use of org.batfish.datamodel.IpWildcard in project batfish by batfish.

the class HeaderSpaceMatchExpr method matchIp.

public static BooleanExpr matchIp(Set<IpWildcard> ipWildcards, boolean useSrc, boolean useDst) {
    ImmutableList.Builder<BooleanExpr> matchSomeIpRange = ImmutableList.builder();
    for (IpWildcard ipWildcard : ipWildcards) {
        if (ipWildcard.isPrefix()) {
            Prefix prefix = ipWildcard.toPrefix();
            long ip = prefix.getStartIp().asLong();
            int ipWildcardBits = Prefix.MAX_PREFIX_LENGTH - prefix.getPrefixLength();
            int ipStart = ipWildcardBits;
            int ipEnd = Prefix.MAX_PREFIX_LENGTH - 1;
            if (ipStart < Prefix.MAX_PREFIX_LENGTH) {
                IntExpr extractSrcIp = ExtractExpr.newExtractExpr(BasicHeaderField.SRC_IP, ipStart, ipEnd);
                IntExpr extractDstIp = ExtractExpr.newExtractExpr(BasicHeaderField.DST_IP, ipStart, ipEnd);
                LitIntExpr ipMatchLit = new LitIntExpr(ip, ipStart, ipEnd);
                EqExpr matchSrcIp = new EqExpr(extractSrcIp, ipMatchLit);
                EqExpr matchDstIp = new EqExpr(extractDstIp, ipMatchLit);
                BooleanExpr matchSpecifiedIp;
                if (useSrc) {
                    if (useDst) {
                        matchSpecifiedIp = new OrExpr(ImmutableList.of(matchSrcIp, matchDstIp));
                    } else {
                        matchSpecifiedIp = matchSrcIp;
                    }
                } else if (useDst) {
                    matchSpecifiedIp = matchDstIp;
                } else {
                    throw new BatfishException("useSrc and useDst cannot both be false");
                }
                matchSomeIpRange.add(matchSpecifiedIp);
            } else {
                return TrueExpr.INSTANCE;
            }
        } else {
            long ip = ipWildcard.getIp().asLong();
            long wildcard = ipWildcard.getWildcard().asLong();
            ImmutableList.Builder<BooleanExpr> matchSrcIp = ImmutableList.builder();
            if (useSrc) {
                for (int currentBitIndex = 0; currentBitIndex < Prefix.MAX_PREFIX_LENGTH; currentBitIndex++) {
                    long mask = 1L << currentBitIndex;
                    long currentWildcardBit = mask & wildcard;
                    boolean useBit = currentWildcardBit == 0;
                    if (useBit) {
                        IntExpr extractSrcIp = ExtractExpr.newExtractExpr(BasicHeaderField.SRC_IP, currentBitIndex, currentBitIndex);
                        LitIntExpr srcIpMatchLit = new LitIntExpr(ip, currentBitIndex, currentBitIndex);
                        EqExpr matchSrcIpBit = new EqExpr(extractSrcIp, srcIpMatchLit);
                        matchSrcIp.add(matchSrcIpBit);
                    }
                }
            }
            ImmutableList.Builder<BooleanExpr> matchDstIp = ImmutableList.builder();
            if (useDst) {
                for (int currentBitIndex = 0; currentBitIndex < Prefix.MAX_PREFIX_LENGTH; currentBitIndex++) {
                    long mask = 1L << currentBitIndex;
                    long currentWildcardBit = mask & wildcard;
                    boolean useBit = currentWildcardBit == 0;
                    if (useBit) {
                        IntExpr extractDstIp = ExtractExpr.newExtractExpr(BasicHeaderField.DST_IP, currentBitIndex, currentBitIndex);
                        LitIntExpr dstIpMatchLit = new LitIntExpr(ip, currentBitIndex, currentBitIndex);
                        EqExpr matchDstIpBit = new EqExpr(extractDstIp, dstIpMatchLit);
                        matchDstIp.add(matchDstIpBit);
                    }
                }
            }
            BooleanExpr matchSpecifiedIp;
            if (useSrc) {
                if (useDst) {
                    matchSpecifiedIp = new OrExpr(ImmutableList.of(new AndExpr(matchSrcIp.build()), new AndExpr(matchDstIp.build())));
                } else {
                    matchSpecifiedIp = new AndExpr(matchSrcIp.build());
                }
            } else if (useDst) {
                matchSpecifiedIp = new AndExpr(matchDstIp.build());
            } else {
                throw new BatfishException("useSrc and useDst cannot both be false");
            }
            matchSomeIpRange.add(matchSpecifiedIp);
        }
    }
    return new OrExpr(matchSomeIpRange.build());
}

Example 63 with IpWildcard

use of org.batfish.datamodel.IpWildcard in project batfish by batfish.

the class CommonUtil method initPrivateIpsByPublicIp.

@VisibleForTesting
static SetMultimap<Ip, IpWildcardSetIpSpace> initPrivateIpsByPublicIp(Map<String, Configuration> configurations) {
    /*
     * Very hacky mapping from public IP to set of spaces of possible natted private IPs.
     * Does not currently support source-nat acl.
     *
     * The current implementation just considers every IP in every prefix on a non-masquerading
     * interface (except the local address in each such prefix) to be a possible private IP
     * match for every public IP referred to by every source-nat pool on a masquerading interface.
     */
    ImmutableSetMultimap.Builder<Ip, IpWildcardSetIpSpace> builder = ImmutableSetMultimap.builder();
    for (Configuration c : configurations.values()) {
        Collection<Interface> interfaces = c.getInterfaces().values();
        Set<InterfaceAddress> nonNattedInterfaceAddresses = interfaces.stream().filter(i -> i.getSourceNats().isEmpty()).flatMap(i -> i.getAllAddresses().stream()).collect(ImmutableSet.toImmutableSet());
        Set<IpWildcard> blacklist = nonNattedInterfaceAddresses.stream().map(address -> new IpWildcard(address.getIp(), Ip.ZERO)).collect(ImmutableSet.toImmutableSet());
        Set<IpWildcard> whitelist = nonNattedInterfaceAddresses.stream().map(address -> new IpWildcard(address.getPrefix())).collect(ImmutableSet.toImmutableSet());
        IpWildcardSetIpSpace ipSpace = IpWildcardSetIpSpace.builder().including(whitelist).excluding(blacklist).build();
        interfaces.stream().flatMap(i -> i.getSourceNats().stream()).forEach(sourceNat -> {
            for (long ipAsLong = sourceNat.getPoolIpFirst().asLong(); ipAsLong <= sourceNat.getPoolIpLast().asLong(); ipAsLong++) {
                Ip currentPoolIp = new Ip(ipAsLong);
                builder.put(currentPoolIp, ipSpace);
            }
        });
    }
    return builder.build();
}