Examples with IpWildcardSetIpSpace org.batfish.datamodel.IpWildcardSetIpSpace used on opensource projects

Example 1 with IpWildcardSetIpSpace

use of org.batfish.datamodel.IpWildcardSetIpSpace in project batfish by batfish.

the class CommonUtil method initRemoteIpsecVpns.

public static void initRemoteIpsecVpns(Map<String, Configuration> configurations) {
    Map<IpsecVpn, Ip> vpnRemoteIps = new IdentityHashMap<>();
    Map<Ip, Set<IpsecVpn>> externalIpVpnMap = new HashMap<>();
    SetMultimap<Ip, IpWildcardSetIpSpace> privateIpsByPublicIp = initPrivateIpsByPublicIp(configurations);
    for (Configuration c : configurations.values()) {
        for (IpsecVpn ipsecVpn : c.getIpsecVpns().values()) {
            Ip remoteIp = ipsecVpn.getIkeGateway().getAddress();
            vpnRemoteIps.put(ipsecVpn, remoteIp);
            Set<InterfaceAddress> externalAddresses = ipsecVpn.getIkeGateway().getExternalInterface().getAllAddresses();
            for (InterfaceAddress address : externalAddresses) {
                Ip ip = address.getIp();
                Set<IpsecVpn> vpnsUsingExternalAddress = externalIpVpnMap.computeIfAbsent(ip, k -> Sets.newIdentityHashSet());
                vpnsUsingExternalAddress.add(ipsecVpn);
            }
        }
    }
    for (Entry<IpsecVpn, Ip> e : vpnRemoteIps.entrySet()) {
        IpsecVpn ipsecVpn = e.getKey();
        Ip remoteIp = e.getValue();
        Ip localIp = ipsecVpn.getIkeGateway().getLocalIp();
        ipsecVpn.initCandidateRemoteVpns();
        Set<IpsecVpn> remoteIpsecVpnCandidates = externalIpVpnMap.get(remoteIp);
        if (remoteIpsecVpnCandidates != null) {
            for (IpsecVpn remoteIpsecVpnCandidate : remoteIpsecVpnCandidates) {
                Ip remoteIpsecVpnLocalAddress = remoteIpsecVpnCandidate.getIkeGateway().getLocalIp();
                if (remoteIpsecVpnLocalAddress != null && !remoteIpsecVpnLocalAddress.equals(remoteIp)) {
                    continue;
                }
                Ip reciprocalRemoteAddress = vpnRemoteIps.get(remoteIpsecVpnCandidate);
                Set<IpsecVpn> reciprocalVpns = externalIpVpnMap.get(reciprocalRemoteAddress);
                if (reciprocalVpns == null) {
                    Set<IpWildcardSetIpSpace> privateIpsBehindReciprocalRemoteAddress = privateIpsByPublicIp.get(reciprocalRemoteAddress);
                    if (privateIpsBehindReciprocalRemoteAddress != null && privateIpsBehindReciprocalRemoteAddress.stream().anyMatch(ipSpace -> ipSpace.containsIp(localIp))) {
                        reciprocalVpns = externalIpVpnMap.get(localIp);
                        ipsecVpn.setRemoteIpsecVpn(remoteIpsecVpnCandidate);
                        ipsecVpn.getCandidateRemoteIpsecVpns().add(remoteIpsecVpnCandidate);
                        remoteIpsecVpnCandidate.initCandidateRemoteVpns();
                        remoteIpsecVpnCandidate.setRemoteIpsecVpn(ipsecVpn);
                        remoteIpsecVpnCandidate.getCandidateRemoteIpsecVpns().add(ipsecVpn);
                    }
                } else if (reciprocalVpns.contains(ipsecVpn)) {
                    ipsecVpn.setRemoteIpsecVpn(remoteIpsecVpnCandidate);
                    ipsecVpn.getCandidateRemoteIpsecVpns().add(remoteIpsecVpnCandidate);
                }
            }
        }
    }
}

Example 2 with IpWildcardSetIpSpace

use of org.batfish.datamodel.IpWildcardSetIpSpace in project batfish by batfish.

the class IpSpaceSimplifierTest method testVisitIpWildcardSetIpSpace.

@Test
public void testVisitIpWildcardSetIpSpace() {
    assertThat(IpSpaceSimplifier.simplify(IpWildcardSetIpSpace.builder().build()), equalTo(EmptyIpSpace.INSTANCE));
    assertThat(IpSpaceSimplifier.simplify(IpWildcardSetIpSpace.builder().excluding(new IpWildcard("1.2.3.0/24")).build()), equalTo(EmptyIpSpace.INSTANCE));
    assertThat(IpSpaceSimplifier.simplify(IpWildcardSetIpSpace.builder().including(IpWildcard.ANY).build()), equalTo(UniverseIpSpace.INSTANCE));
    assertThat(IpSpaceSimplifier.simplify(IpWildcardSetIpSpace.builder().including(IpWildcard.ANY).excluding(IpWildcard.ANY).build()), equalTo(EmptyIpSpace.INSTANCE));
    // whitelisted wildcards that are covered by a blacklisted wildcard are removed
    IpWildcardSetIpSpace ipSpace = IpWildcardSetIpSpace.builder().including(new IpWildcard("1.2.1.0/24"), new IpWildcard("2.2.2.2")).excluding(new IpWildcard("1.2.0.0/16")).build();
    IpWildcard simplifiedIpSpace = new IpWildcard("2.2.2.2");
    assertThat(IpSpaceSimplifier.simplify(ipSpace), equalTo(simplifiedIpSpace));
    // blacklisted wildcards that don't overlap whitelisted wildcards are removed
    ipSpace = IpWildcardSetIpSpace.builder().including(new IpWildcard("2.2.2.2")).excluding(new IpWildcard("1.0.0.0/8")).build();
    assertThat(IpSpaceSimplifier.simplify(ipSpace), equalTo(simplifiedIpSpace));
}

Example 3 with IpWildcardSetIpSpace

use of org.batfish.datamodel.IpWildcardSetIpSpace in project batfish by batfish.

the class IpSpaceBooleanExprTransformerTest method testVisitIpWildcardSetIpSpace.

@Test
public void testVisitIpWildcardSetIpSpace() {
    IpWildcard includeWildcard = new IpWildcard("1.1.1.1");
    IpWildcard excludeWildcard = new IpWildcard("2.2.2.2");
    IpWildcardSetIpSpace ipSpace = IpWildcardSetIpSpace.builder().including(includeWildcard).excluding(excludeWildcard).build();
    BooleanExpr expr = ipSpace.accept(SRC_IP_SPACE_BOOLEAN_EXPR_TRANSFORMER);
    BooleanExpr includeExpr = includeWildcard.accept(SRC_IP_SPACE_BOOLEAN_EXPR_TRANSFORMER);
    BooleanExpr excludeExpr = excludeWildcard.accept(SRC_IP_SPACE_BOOLEAN_EXPR_TRANSFORMER);
    assertThat(expr, equalTo(new AndExpr(ImmutableList.of(new NotExpr(excludeExpr), includeExpr))));
}

Example 4 with IpWildcardSetIpSpace

use of org.batfish.datamodel.IpWildcardSetIpSpace in project batfish by batfish.

the class IpSpaceSpecializerTest method testSpecializeIpWildcardSetIpSpace.

@Test
public void testSpecializeIpWildcardSetIpSpace() {
    IpWildcardSetIpSpace ipSpace = IpWildcardSetIpSpace.builder().including(new IpWildcard("1.1.1.0/24")).including(new IpWildcard("1.2.0.0/24")).excluding(new IpWildcard("1.1.1.4/30")).build();
    assertThat(trivialSpecializer.visitIpWildcardSetIpSpace(ipSpace), equalTo(ipSpace));
    assertThat(whitelistAnySpecializer.visitIpWildcardSetIpSpace(ipSpace), equalTo(ipSpace));
    assertThat(blacklistAnySpecializer.visitIpWildcardSetIpSpace(ipSpace), equalTo(EmptyIpSpace.INSTANCE));
    IpSpaceSpecializer specializer = new IpSpaceSpecializer(ImmutableSortedSet.of(new IpWildcard("1.1.1.0/24")), ImmutableSortedSet.of());
    assertThat(specializer.visitIpWildcardSetIpSpace(ipSpace), equalTo(IpWildcardSetIpSpace.builder().including(IpWildcard.ANY).excluding(new IpWildcard("1.1.1.4/30")).build()));
    /*
     * Entire headerspace is contained in ipSpace, to specialize to UniverseIpSpace
     */
    specializer = new IpSpaceSpecializer(ImmutableSortedSet.of(new IpWildcard("1.2.0.0/30")), ImmutableSortedSet.of());
    assertThat(specializer.visitIpWildcardSetIpSpace(ipSpace), equalTo(UniverseIpSpace.INSTANCE));
    /*
     * ipSpace contains only a portion of the headerspace, but we can remove parts of ipSpace
     * that are irrelevant.
     */
    specializer = new IpSpaceSpecializer(ImmutableSortedSet.of(new IpWildcard("1.2.0.0/16")), ImmutableSortedSet.of());
    assertThat(specializer.visitIpWildcardSetIpSpace(ipSpace), equalTo(IpWildcardSetIpSpace.builder().including(new IpWildcard("1.2.0.0/24")).build()));
}

Example 5 with IpWildcardSetIpSpace

use of org.batfish.datamodel.IpWildcardSetIpSpace in project batfish by batfish.

the class IpAccessListSpecializer method specialize.

public Optional<IpAccessListLine> specialize(IpAccessListLine ipAccessListLine) {
    IpWildcardSetIpSpace.Builder srcIpSpaceBuilder = IpWildcardSetIpSpace.builder().excluding(ipAccessListLine.getNotSrcIps());
    if (ipAccessListLine.getSrcIps().isEmpty() && ipAccessListLine.getSrcOrDstIps().isEmpty()) {
        srcIpSpaceBuilder.including(IpWildcard.ANY);
    } else {
        srcIpSpaceBuilder.including(ipAccessListLine.getSrcIps());
        srcIpSpaceBuilder.including(ipAccessListLine.getSrcOrDstIps());
    }
    IpSpace specializedSrcIpSpace = _srcIpSpaceSpecializer.specialize(srcIpSpaceBuilder.build());
    IpWildcardSetIpSpace.Builder dstIpSpaceBuilder = IpWildcardSetIpSpace.builder().excluding(ipAccessListLine.getNotDstIps());
    if (ipAccessListLine.getDstIps().isEmpty() && ipAccessListLine.getSrcOrDstIps().isEmpty()) {
        dstIpSpaceBuilder.including(IpWildcard.ANY);
    } else {
        dstIpSpaceBuilder.including(ipAccessListLine.getDstIps());
        dstIpSpaceBuilder.including(ipAccessListLine.getSrcOrDstIps());
    }
    IpSpace specializedDstIpSpace = _dstIpSpaceSpecializer.specialize(dstIpSpaceBuilder.build());
    if (specializedDstIpSpace instanceof EmptyIpSpace || specializedSrcIpSpace instanceof EmptyIpSpace) {
        return Optional.empty();
    }
    Set<IpWildcard> specializedDstIps;
    Set<IpWildcard> specializedNotDstIps;
    if (specializedDstIpSpace instanceof UniverseIpSpace) {
        // for a HeaderSpace, empty dstIps means Universe
        specializedDstIps = ImmutableSet.of();
        specializedNotDstIps = ImmutableSet.of();
    } else if (specializedDstIpSpace instanceof IpWildcardSetIpSpace) {
        IpWildcardSetIpSpace dstIpWildcardSetIpSpace = (IpWildcardSetIpSpace) specializedDstIpSpace;
        specializedDstIps = dstIpWildcardSetIpSpace.getWhitelist();
        specializedNotDstIps = dstIpWildcardSetIpSpace.getBlacklist();
    } else if (specializedDstIpSpace instanceof IpWildcard) {
        specializedDstIps = ImmutableSet.of((IpWildcard) specializedDstIpSpace);
        specializedNotDstIps = ImmutableSet.of();
    } else {
        throw new BatfishException("unexpected specializedDstIpSpace type");
    }
    Set<IpWildcard> specializedSrcIps;
    Set<IpWildcard> specializedNotSrcIps;
    if (specializedSrcIpSpace instanceof UniverseIpSpace) {
        specializedSrcIps = ImmutableSet.of();
        specializedNotSrcIps = ImmutableSet.of();
    } else if (specializedSrcIpSpace instanceof IpWildcardSetIpSpace) {
        IpWildcardSetIpSpace srcIpWildcardSetIpSpace = (IpWildcardSetIpSpace) specializedSrcIpSpace;
        specializedSrcIps = srcIpWildcardSetIpSpace.getWhitelist();
        specializedNotSrcIps = srcIpWildcardSetIpSpace.getBlacklist();
    } else if (specializedSrcIpSpace instanceof IpWildcard) {
        specializedSrcIps = ImmutableSet.of((IpWildcard) specializedSrcIpSpace);
        specializedNotSrcIps = ImmutableSet.of();
    } else {
        throw new BatfishException("unexpected specializedSrcIpSpace type");
    }
    return Optional.of(ipAccessListLine.rebuild().setDstIps(specializedDstIps).setNotDstIps(specializedNotDstIps).setSrcIps(specializedSrcIps).setNotSrcIps(specializedNotSrcIps).build());
}