Examples with AclDeny org.batfish.z3.state.AclDeny used on opensource projects

Example 6 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGenerator method visitAclDeny.

@Override
public void visitAclDeny(AclDeny.State aclDeny) {
    // MatchDenyLine
    _input.getAclActions().forEach((node, nodeAcls) -> nodeAcls.forEach((acl, linesActions) -> {
        int lineNumber = 0;
        for (LineAction linesAction : linesActions) {
            if (linesAction == LineAction.REJECT) {
                _rules.add(new BasicRuleStatement(new AclLineMatch(node, acl, lineNumber), new AclDeny(node, acl)));
            }
            lineNumber++;
        }
    }));
    // MatchNoLines
    _input.getAclActions().entrySet().stream().flatMap(aclActionsEntryByNode -> {
        String hostname = aclActionsEntryByNode.getKey();
        return aclActionsEntryByNode.getValue().entrySet().stream().map(aclActionsEntryByAclName -> {
            String acl = aclActionsEntryByAclName.getKey();
            List<LineAction> lineActions = aclActionsEntryByAclName.getValue();
            AclDeny deny = new AclDeny(hostname, acl);
            if (lineActions.isEmpty()) {
                return new BasicRuleStatement(deny);
            } else {
                int lastLine = lineActions.size() - 1;
                return new BasicRuleStatement(new AclLineNoMatch(hostname, acl, lastLine), deny);
            }
        });
    }).forEach(_rules::add);
}

Example 7 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGenerator method visitNodeDropAclOut.

@Override
public void visitNodeDropAclOut(NodeDropAclOut.State nodeDropAclOut) {
    _input.getEnabledEdges().forEach(edge -> {
        String node1 = edge.getNode1();
        String iface1 = edge.getInt1();
        String node2 = edge.getNode2();
        String iface2 = edge.getInt2();
        String outAcl = _input.getOutgoingAcls().get(node1).get(iface1);
        // There has to be an ACL -- no ACL is an implicit Permit.
        if (outAcl != null) {
            Set<StateExpr> postTransformationPreStates = ImmutableSet.of(new AclDeny(node1, outAcl), new PreOutEdgePostNat(node1, iface1, node2, iface2));
            _rules.add(new BasicRuleStatement(TrueExpr.INSTANCE, postTransformationPreStates, new NodeDropAclOut(node1)));
        }
    });
}

Example 8 with AclDeny

use of org.batfish.z3.state.AclDeny in project batfish by batfish.

the class DefaultTransitionGenerator method visitPreOutEdgePostNat_generateMatchSourceNatRules.

private void visitPreOutEdgePostNat_generateMatchSourceNatRules(String node1, String iface1, String node2, String iface2) {
    List<Entry<AclPermit, BooleanExpr>> sourceNats = _input.getSourceNats().get(node1).get(iface1);
    for (int natNumber = 0; natNumber < sourceNats.size(); natNumber++) {
        ImmutableSet.Builder<StateExpr> preStates = ImmutableSet.builder();
        preStates.add(new PreOutEdge(node1, iface1, node2, iface2));
        // does not match any previous source NAT.
        sourceNats.subList(0, natNumber).stream().map(Entry::getKey).map(aclPermit -> new AclDeny(aclPermit.getHostname(), aclPermit.getAcl())).forEach(preStates::add);
        // does match the current source NAT.
        preStates.add(sourceNats.get(natNumber).getKey());
        BooleanExpr transformationExpr = sourceNats.get(natNumber).getValue();
        _rules.add(new TransformationRuleStatement(transformationExpr, preStates.build(), ImmutableSet.of(), new PreOutEdgePostNat(node1, iface1, node2, iface2)));
    }
}