Acl { public List<String> toRules(IPVersion ipVersion) { List<String> rules = new LinkedList<>(); rules.add("-P INPUT ACCEPT"); rules.add("-P FORWARD ACCEPT"); rules.add("-P OUTPUT ACCEPT"); rules.add( "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT"); rules.add("-A INPUT -i lo -j ACCEPT"); rules.add("-A INPUT -p " + ipVersion.icmpProtocol() + " -j ACCEPT"); if (!trustedPorts.isEmpty()) { String ports = trustedPorts.stream().map(i -> Integer.toString(i)).sorted().collect(Collectors.joining(",")); rules.add("-A INPUT -p tcp -m multiport --dports " + ports + " -j ACCEPT"); } getTrustedNodes(ipVersion).stream() .map(node -> "-A INPUT -s " + node.inetAddressString() + ipVersion.singleHostCidr() + " -j ACCEPT") .sorted() .forEach(rules::add); addressesOf(ipVersion, trustedNetworks).stream() .map(network -> "-A INPUT -s " + network + " -j ACCEPT") .sorted() .forEach(rules::add); rules.add("-A INPUT -j REJECT --reject-with " + ipVersion.icmpPortUnreachable()); return Collections.unmodifiableList(rules); } Acl(Set<Integer> trustedPorts, Set<Node> trustedNodes, Set<String> trustedNetworks);  Acl(Set<Integer> trustedPorts, Set<Node> trustedNodes); List<String> toRules(IPVersion ipVersion); Set<Node> getTrustedNodes(); Set<Node> getTrustedNodes(IPVersion ipVersion); Set<Integer> getTrustedPorts(); Set<Integer> getTrustedPorts(IPVersion ipVersion); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString(); static final Acl EMPTY; }
@Test public void no_trusted_ports() { String listRulesIpv4 = String.join("\n", aclWithoutPorts.toRules(IPVersion.IPv4)); assertEquals( "-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p icmp -j ACCEPT\n" + "-A INPUT -s 192.1.2.2/32 -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp-port-unreachable", listRulesIpv4); }
@Test public void ipv4_rules() { String listRulesIpv4 = String.join("\n", aclCommon.toRules(IPVersion.IPv4)); assertEquals( "-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p icmp -j ACCEPT\n" + "-A INPUT -p tcp -m multiport --dports 1234,453 -j ACCEPT\n" + "-A INPUT -s 192.1.2.2/32 -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp-port-unreachable", listRulesIpv4); }
@Test public void ipv6_rules() { String listRulesIpv6 = String.join("\n", aclCommon.toRules(IPVersion.IPv6)); assertEquals( "-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p ipv6-icmp -j ACCEPT\n" + "-A INPUT -p tcp -m multiport --dports 1234,453 -j ACCEPT\n" + "-A INPUT -s fb00::1/128 -j ACCEPT\n" + "-A INPUT -s fe80::2/128 -j ACCEPT\n" + "-A INPUT -s fe80::3/128 -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp6-port-unreachable", listRulesIpv6); }
@Test public void ipv6_rules_stable_order() { Acl aclCommonDifferentOrder = new Acl( Set.of(453, 1234), testNodes("fe80::2", "192.1.2.2", "fb00::1", "fe80::3"), Set.of()); for (IPVersion ipVersion: IPVersion.values()) { assertEquals(aclCommon.toRules(ipVersion), aclCommonDifferentOrder.toRules(ipVersion)); } }
@Test public void trusted_networks() { Acl acl = new Acl(Set.of(4080), testNodes("127.0.0.1"), Set.of("10.0.0.0/24", "2001:db8::/32")); assertEquals("-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p icmp -j ACCEPT\n" + "-A INPUT -p tcp -m multiport --dports 4080 -j ACCEPT\n" + "-A INPUT -s 127.0.0.1/32 -j ACCEPT\n" + "-A INPUT -s 10.0.0.0/24 -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp-port-unreachable", String.join("\n", acl.toRules(IPVersion.IPv4))); assertEquals("-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p ipv6-icmp -j ACCEPT\n" + "-A INPUT -p tcp -m multiport --dports 4080 -j ACCEPT\n" + "-A INPUT -s 2001:db8::/32 -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp6-port-unreachable", String.join("\n", acl.toRules(IPVersion.IPv6))); }