use of org.batfish.z3.state.PreOutEdgePostNat in project batfish by batfish.
the class DefaultTransitionGeneratorTest method testVisitNodeDropAclOut.
@Test
public void testVisitNodeDropAclOut() {
SynthesizerInput input = MockSynthesizerInput.builder().setEnabledEdges(ImmutableSet.of(new Edge(NODE1, INTERFACE1, NODE2, INTERFACE1), new Edge(NODE1, INTERFACE2, NODE2, INTERFACE2), new Edge(NODE2, INTERFACE1, NODE1, INTERFACE1), new Edge(NODE2, INTERFACE2, NODE1, INTERFACE2))).setOutgoingAcls(ImmutableMap.of(NODE1, ImmutableMap.of(INTERFACE1, ACL1), NODE2, ImmutableMap.of(INTERFACE1, ACL1, INTERFACE2, ACL2))).setSourceNats(ImmutableMap.of(NODE1, ImmutableMap.of(INTERFACE1, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL1), TrueExpr.INSTANCE), Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL2), FalseExpr.INSTANCE)), INTERFACE2, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL1), TrueExpr.INSTANCE), Maps.immutableEntry(new AclPermit(NODE1, NAT_ACL2), FalseExpr.INSTANCE))), NODE2, ImmutableMap.of(INTERFACE1, ImmutableList.of(Maps.immutableEntry(new AclPermit(NODE2, NAT_ACL1), TrueExpr.INSTANCE), Maps.immutableEntry(new AclPermit(NODE2, NAT_ACL1), FalseExpr.INSTANCE)), INTERFACE2, ImmutableList.of()))).setTopologyInterfaces(ImmutableMap.of(NODE1, ImmutableSet.of(INTERFACE1, INTERFACE2), NODE2, ImmutableSet.of(INTERFACE1, INTERFACE2))).build();
Set<RuleStatement> rules = ImmutableSet.copyOf(DefaultTransitionGenerator.generateTransitions(input, ImmutableSet.of(NodeDropAclOut.State.INSTANCE)));
// Just test the DropAclOut rules for Node2
Set<RuleStatement> node2DropAclOutRules = rules.stream().map(BasicRuleStatement.class::cast).filter(rule -> rule.getPostconditionState().equals(new NodeDropAclOut(NODE2))).collect(Collectors.toSet());
// FailOutgoingAclNoMatchSrcNat
assertThat(node2DropAclOutRules, containsInAnyOrder(new BasicRuleStatement(TrueExpr.INSTANCE, ImmutableSet.of(new AclDeny(NODE2, ACL1), new PreOutEdgePostNat(NODE2, INTERFACE1, NODE1, INTERFACE1)), new NodeDropAclOut(NODE2)), new BasicRuleStatement(TrueExpr.INSTANCE, ImmutableSet.of(new AclDeny(NODE2, ACL2), new PreOutEdgePostNat(NODE2, INTERFACE2, NODE1, INTERFACE2)), new NodeDropAclOut(NODE2))));
}
use of org.batfish.z3.state.PreOutEdgePostNat in project batfish by batfish.
the class DefaultTransitionGenerator method visitNodeDropAclOut.
@Override
public void visitNodeDropAclOut(NodeDropAclOut.State nodeDropAclOut) {
_input.getEnabledEdges().forEach(edge -> {
String node1 = edge.getNode1();
String iface1 = edge.getInt1();
String node2 = edge.getNode2();
String iface2 = edge.getInt2();
String outAcl = _input.getOutgoingAcls().get(node1).get(iface1);
// There has to be an ACL -- no ACL is an implicit Permit.
if (outAcl != null) {
Set<StateExpr> postTransformationPreStates = ImmutableSet.of(new AclDeny(node1, outAcl), new PreOutEdgePostNat(node1, iface1, node2, iface2));
_rules.add(new BasicRuleStatement(TrueExpr.INSTANCE, postTransformationPreStates, new NodeDropAclOut(node1)));
}
});
}
use of org.batfish.z3.state.PreOutEdgePostNat in project batfish by batfish.
the class DefaultTransitionGenerator method visitPreOutEdgePostNat_generateMatchSourceNatRules.
private void visitPreOutEdgePostNat_generateMatchSourceNatRules(String node1, String iface1, String node2, String iface2) {
List<Entry<AclPermit, BooleanExpr>> sourceNats = _input.getSourceNats().get(node1).get(iface1);
for (int natNumber = 0; natNumber < sourceNats.size(); natNumber++) {
ImmutableSet.Builder<StateExpr> preStates = ImmutableSet.builder();
preStates.add(new PreOutEdge(node1, iface1, node2, iface2));
// does not match any previous source NAT.
sourceNats.subList(0, natNumber).stream().map(Entry::getKey).map(aclPermit -> new AclDeny(aclPermit.getHostname(), aclPermit.getAcl())).forEach(preStates::add);
// does match the current source NAT.
preStates.add(sourceNats.get(natNumber).getKey());
BooleanExpr transformationExpr = sourceNats.get(natNumber).getValue();
_rules.add(new TransformationRuleStatement(transformationExpr, preStates.build(), ImmutableSet.of(), new PreOutEdgePostNat(node1, iface1, node2, iface2)));
}
}
Aggregations