Examples with AclDeny org.batfish.z3.state.AclDeny used on opensource projects

Example 1 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGeneratorTest method testVisitAclDeny.

@Test
public void testVisitAclDeny() {
    SynthesizerInput input = MockSynthesizerInput.builder().setAclActions(aclActions()).build();
    Set<RuleStatement> rules = ImmutableSet.copyOf(DefaultTransitionGenerator.generateTransitions(input, ImmutableSet.of(AclDeny.State.INSTANCE)));
    // MatchDenyLine
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE1, ACL1, 1), new AclDeny(NODE1, ACL1))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE1, ACL1, 3), new AclDeny(NODE1, ACL1))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE1, ACL2, 0), new AclDeny(NODE1, ACL2))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE1, ACL2, 2), new AclDeny(NODE1, ACL2))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE2, ACL1, 1), new AclDeny(NODE2, ACL1))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE2, ACL1, 3), new AclDeny(NODE2, ACL1))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE2, ACL2, 0), new AclDeny(NODE2, ACL2))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineMatch(NODE2, ACL2, 2), new AclDeny(NODE2, ACL2))));
    // MatchNoLines
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineNoMatch(NODE1, ACL1, 3), new AclDeny(NODE1, ACL1))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineNoMatch(NODE1, ACL2, 3), new AclDeny(NODE1, ACL2))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclDeny(NODE1, ACL3))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineNoMatch(NODE2, ACL1, 3), new AclDeny(NODE2, ACL1))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclLineNoMatch(NODE2, ACL2, 3), new AclDeny(NODE2, ACL2))));
    assertThat(rules, hasItem(new BasicRuleStatement(new AclDeny(NODE1, ACL3))));
}

Example 2 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGenerator method visitPreOutEdgePostNat_generateNoMatchSourceNatRules.

private void visitPreOutEdgePostNat_generateNoMatchSourceNatRules(String node1, String iface1, String node2, String iface2) {
    List<Entry<AclPermit, BooleanExpr>> sourceNats = _input.getSourceNats().getOrDefault(node1, ImmutableMap.of()).getOrDefault(iface1, ImmutableList.of());
    ImmutableSet.Builder<StateExpr> preStates = ImmutableSet.builder();
    preStates.add(new PreOutEdge(node1, iface1, node2, iface2));
    sourceNats.stream().map(Entry::getKey).map(aclPermit -> new AclDeny(aclPermit.getHostname(), aclPermit.getAcl())).forEach(preStates::add);
    _rules.add(new TransformationRuleStatement(new EqExpr(new VarIntExpr(TransformationHeaderField.NEW_SRC_IP), new VarIntExpr(TransformationHeaderField.NEW_SRC_IP.getCurrent())), preStates.build(), ImmutableSet.of(), new PreOutEdgePostNat(node1, iface1, node2, iface2)));
}

Example 3 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGeneratorTest method testVisitPreOutEdgePostNat_topologyInterfaceWithNAT.

/**
 * Test the transitions generated for PreOutEdgePostNat for an edge with a source nat.
 */
@Test
public void testVisitPreOutEdgePostNat_topologyInterfaceWithNAT() {
    SynthesizerInput input = MockSynthesizerInput.builder().setEnabledEdges(ImmutableSet.of(new Edge(NODE1, INTERFACE1, NODE2, INTERFACE2))).setTopologyInterfaces(ImmutableMap.of(NODE1, ImmutableSet.of(INTERFACE1))).setSourceNats(ImmutableMap.of(NODE1, ImmutableMap.of(INTERFACE1, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL1), B1))))).build();
    List<RuleStatement> rules = DefaultTransitionGenerator.generateTransitions(input, ImmutableSet.of(PreOutEdgePostNat.State.INSTANCE));
    RuleStatement permitRule = new TransformationRuleStatement(B1, ImmutableSet.of(new PreOutEdge(NODE1, INTERFACE1, NODE2, INTERFACE2), new AclPermit(NODE1, NAT_ACL1)), ImmutableSet.of(), new PreOutEdgePostNat(NODE1, INTERFACE1, NODE2, INTERFACE2));
    RuleStatement denyRule = new TransformationRuleStatement(new EqExpr(new VarIntExpr(TransformationHeaderField.NEW_SRC_IP), new VarIntExpr(TransformationHeaderField.NEW_SRC_IP.getCurrent())), ImmutableSet.of(new PreOutEdge(NODE1, INTERFACE1, NODE2, INTERFACE2), new AclDeny(NODE1, NAT_ACL1)), ImmutableSet.of(), new PreOutEdgePostNat(NODE1, INTERFACE1, NODE2, INTERFACE2));
    assertThat(rules, containsInAnyOrder(permitRule, denyRule));
}

Example 4 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGeneratorTest method testVisitNodeDropAclOut.

@Test
public void testVisitNodeDropAclOut() {
    SynthesizerInput input = MockSynthesizerInput.builder().setEnabledEdges(ImmutableSet.of(new Edge(NODE1, INTERFACE1, NODE2, INTERFACE1), new Edge(NODE1, INTERFACE2, NODE2, INTERFACE2), new Edge(NODE2, INTERFACE1, NODE1, INTERFACE1), new Edge(NODE2, INTERFACE2, NODE1, INTERFACE2))).setOutgoingAcls(ImmutableMap.of(NODE1, ImmutableMap.of(INTERFACE1, ACL1), NODE2, ImmutableMap.of(INTERFACE1, ACL1, INTERFACE2, ACL2))).setSourceNats(ImmutableMap.of(NODE1, ImmutableMap.of(INTERFACE1, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL1), TrueExpr.INSTANCE), Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL2), FalseExpr.INSTANCE)), INTERFACE2, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL1), TrueExpr.INSTANCE), Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL2), FalseExpr.INSTANCE))), NODE2, ImmutableMap.of(INTERFACE1, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE2, NAT_ACL1), TrueExpr.INSTANCE), Maps.immutableEntry(new AclPermit(NODE2, NAT_ACL1), FalseExpr.INSTANCE)), INTERFACE2, ImmutableList.of()))).setTopologyInterfaces(ImmutableMap.of(NODE1, ImmutableSet.of(INTERFACE1, INTERFACE2), NODE2, ImmutableSet.of(INTERFACE1, INTERFACE2))).build();
    Set<RuleStatement> rules = ImmutableSet.copyOf(DefaultTransitionGenerator.generateTransitions(input, ImmutableSet.of(NodeDropAclOut.State.INSTANCE)));
    // Just test the DropAclOut rules for Node2
    Set<RuleStatement> node2DropAclOutRules = rules.stream().map(BasicRuleStatement.class::cast).filter(rule -> rule.getPostconditionState().equals(new NodeDropAclOut(NODE2))).collect(Collectors.toSet());
    // FailOutgoingAclNoMatchSrcNat
    assertThat(node2DropAclOutRules, containsInAnyOrder(new BasicRuleStatement(TrueExpr.INSTANCE, ImmutableSet.of(new AclDeny(NODE2, ACL1), new PreOutEdgePostNat(NODE2, INTERFACE1, NODE1, INTERFACE1)), new NodeDropAclOut(NODE2)), new BasicRuleStatement(TrueExpr.INSTANCE, ImmutableSet.of(new AclDeny(NODE2, ACL2), new PreOutEdgePostNat(NODE2, INTERFACE2, NODE1, INTERFACE2)), new NodeDropAclOut(NODE2))));
}

Example 5 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGeneratorTest method testVisitNodeDropAclIn.

@Test
public void testVisitNodeDropAclIn() {
    SynthesizerInput input = MockSynthesizerInput.builder().setIncomingAcls(ImmutableMap.of(NODE1, ImmutableMap.of(INTERFACE1, ACL1, INTERFACE2, ACL2), NODE2, ImmutableMap.of(INTERFACE1, ACL1, INTERFACE2, ACL2))).setTopologyInterfaces(ImmutableMap.of(NODE1, ImmutableSet.of(INTERFACE1, INTERFACE2), NODE2, ImmutableSet.of(INTERFACE1, INTERFACE2))).build();
    Set<RuleStatement> rules = ImmutableSet.copyOf(DefaultTransitionGenerator.generateTransitions(input, ImmutableSet.of(NodeDropAclIn.State.INSTANCE)));
    // FailIncomingAcl
    assertThat(rules, hasItem(new BasicRuleStatement(ImmutableSet.of(new AclDeny(NODE1, ACL1), new PreInInterface(NODE1, INTERFACE1)), new NodeDropAclIn(NODE1))));
    assertThat(rules, hasItem(new BasicRuleStatement(ImmutableSet.of(new AclDeny(NODE1, ACL2), new PreInInterface(NODE1, INTERFACE2)), new NodeDropAclIn(NODE1))));
    assertThat(rules, hasItem(new BasicRuleStatement(ImmutableSet.of(new AclDeny(NODE2, ACL1), new PreInInterface(NODE2, INTERFACE1)), new NodeDropAclIn(NODE2))));
    assertThat(rules, hasItem(new BasicRuleStatement(ImmutableSet.of(new AclDeny(NODE2, ACL2), new PreInInterface(NODE2, INTERFACE2)), new NodeDropAclIn(NODE2))));
}