@Test public void testInstallIncomingFilter() { Configuration cfg = new Configuration("cfg", ConfigurationFormat.AWS); Interface iface = Interface.builder().setName("test").build(); Ip blockedIp = Ip.parse("8.8.8.8"); IpAccessList nacl = IpAccessList.builder() .setName("test") .setLines( ExprAclLine.rejecting( new MatchHeaderSpace( HeaderSpace.builder() .setSrcIps(IpWildcard.create(blockedIp).toIpSpace()) .build()))) .build(); installIncomingFilter(cfg, iface, nacl); assertThat(cfg.getIpAccessLists(), hasKey(INCOMING_NAT_FILTER_NAME)); IpAccessList filter = cfg.getIpAccessLists().get(INCOMING_NAT_FILTER_NAME); assertThat(iface.getIncomingFilter(), equalTo(filter)); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.AN) .setDstIp(Ip.parse("1.1.1.1.")) .build(), "a", ImmutableMap.of(), ImmutableMap.of()) .getAction(), equalTo(LineAction.DENY)); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.TCP) .setSrcIp(blockedIp) .setSrcPort(345) .setDstIp(Ip.parse("1.1.1.1")) .setDstPort(80) .build(), "a", cfg.getIpAccessLists(), ImmutableMap.of()) .getAction(), equalTo(LineAction.DENY)); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.TCP) .setSrcIp(Ip.parse("2.2.2.2")) .setSrcPort(345) .setDstIp(Ip.parse("1.1.1.1")) .setDstPort(80) .build(), "a", cfg.getIpAccessLists(), ImmutableMap.of()) .getAction(), equalTo(LineAction.DENY)); }
@VisibleForTesting static void installIncomingFilter( Configuration cfgNode, Interface ifaceToVpc, IpAccessList ingressAcl) { IpAccessList filter = IpAccessList.builder() .setName(INCOMING_NAT_FILTER_NAME) .setLines( UNSUPPORTED_PROTOCOL_ACL_LINE, new AclAclLine(ingressAcl.getName(), ingressAcl.getName())) .build(); cfgNode.getIpAccessLists().put(ingressAcl.getName(), ingressAcl); cfgNode.getIpAccessLists().put(filter.getName(), filter); ifaceToVpc.setIncomingFilter(filter); }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static void installIncomingFilter( Configuration cfgNode, Interface ifaceToVpc, IpAccessList ingressAcl) { IpAccessList filter = IpAccessList.builder() .setName(INCOMING_NAT_FILTER_NAME) .setLines( UNSUPPORTED_PROTOCOL_ACL_LINE, new AclAclLine(ingressAcl.getName(), ingressAcl.getName())) .build(); cfgNode.getIpAccessLists().put(ingressAcl.getName(), ingressAcl); cfgNode.getIpAccessLists().put(filter.getName(), filter); ifaceToVpc.setIncomingFilter(filter); } }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static void installIncomingFilter( Configuration cfgNode, Interface ifaceToVpc, IpAccessList ingressAcl) { IpAccessList filter = IpAccessList.builder() .setName(INCOMING_NAT_FILTER_NAME) .setLines( UNSUPPORTED_PROTOCOL_ACL_LINE, new AclAclLine(ingressAcl.getName(), ingressAcl.getName())) .build(); cfgNode.getIpAccessLists().put(ingressAcl.getName(), ingressAcl); cfgNode.getIpAccessLists().put(filter.getName(), filter); ifaceToVpc.setIncomingFilter(filter); } NatGateway(
      String natGatewayId,
      String subnetId,
      String vpcId,
      List<NatGatewayAddress> natGatewayAddresses,
      Map<String, String> tags); }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static void installIncomingFilter( Configuration cfgNode, Interface ifaceToVpc, IpAccessList ingressAcl) { IpAccessList filter = IpAccessList.builder() .setName(INCOMING_NAT_FILTER_NAME) .setLines( UNSUPPORTED_PROTOCOL_ACL_LINE, new AclAclLine(ingressAcl.getName(), ingressAcl.getName())) .build(); cfgNode.getIpAccessLists().put(ingressAcl.getName(), ingressAcl); cfgNode.getIpAccessLists().put(filter.getName(), filter); ifaceToVpc.setIncomingFilter(filter); } NatGateway(
      String natGatewayId,
      String subnetId,
      String vpcId,
      List<NatGatewayAddress> natGatewayAddresses,
      Map<String, String> tags); @Override String getId(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode(); }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static void installIncomingFilter( Configuration cfgNode, Interface ifaceToVpc, IpAccessList ingressAcl) { IpAccessList filter = IpAccessList.builder() .setName(INCOMING_NAT_FILTER_NAME) .setLines( UNSUPPORTED_PROTOCOL_ACL_LINE, new AclAclLine(ingressAcl.getName(), ingressAcl.getName())) .build(); cfgNode.getIpAccessLists().put(ingressAcl.getName(), ingressAcl); cfgNode.getIpAccessLists().put(filter.getName(), filter); ifaceToVpc.setIncomingFilter(filter); } NatGateway(
      String natGatewayId,
      String subnetId,
      String vpcId,
      List<NatGatewayAddress> natGatewayAddresses,
      Map<String, String> tags); @Override String getId(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode();  }