@Test public void testPreInInterfaceEdges() { BDD sessionHeaders = PKT.getDstIp().value(10L); BDD srcFwI1 = _fwSrcMgr.getSourceInterfaceBDD(FW_I1); BDD validSrc = _fwSrcMgr.isValidValue(); BDD lastHop1 = _lastHopMgr.getLastHopOutgoingInterfaceBdd(SOURCE1, SOURCE1_IFACE, FW, FW_I1); BDD noLastHop = _lastHopMgr.getNoLastHopOutgoingInterfaceBdd(FW, FW_I1); BDD fakeIface = _source1SrcMgr.getSourceInterfaceBDD(FAKE_IFACE); BDD source1Iface = _source1SrcMgr.getSourceInterfaceBDD(SOURCE1_IFACE); BDDFirewallSessionTraceInfo sessionInfo = new BDDFirewallSessionTraceInfo( FW, ImmutableSet.of(FW_I1), new ForwardOutInterface(FW_I1, NodeInterfacePair.of(SOURCE1, SOURCE1_IFACE)), sessionHeaders, IDENTITY); assertThat( preInInterfaceEdges(sessionInfo), contains( edge( new PreInInterface(FW, FW_I1), new PreInInterface(SOURCE1, SOURCE1_IFACE), allOf( mapsForward(srcFwI1, sessionHeaders.and(source1Iface)), mapsForward(srcFwI1.and(noLastHop), sessionHeaders.and(source1Iface)), mapsForward(srcFwI1.and(lastHop1), sessionHeaders.and(source1Iface)), mapsBackward(source1Iface, validSrc.and(sessionHeaders)), mapsBackward(fakeIface, ZERO))))); _fwI1.setFirewallSessionInterfaceInfo( new FirewallSessionInterfaceInfo(false, ImmutableList.of(FW_I1), PERMIT_TCP, null)); assertThat( preInInterfaceEdges(sessionInfo), contains( edge( new PreInInterface(FW, FW_I1), new PreInInterface(SOURCE1, SOURCE1_IFACE), allOf( mapsForward(srcFwI1, sessionHeaders.and(_permitTcpBdd).and(source1Iface)), mapsForward( srcFwI1.and(noLastHop), sessionHeaders.and(_permitTcpBdd).and(source1Iface)), mapsForward( srcFwI1.and(lastHop1), sessionHeaders.and(_permitTcpBdd).and(source1Iface)), mapsBackward(source1Iface, validSrc.and(sessionHeaders).and(_permitTcpBdd)), mapsBackward(fakeIface, ZERO))))); _fwI1.setFirewallSessionInterfaceInfo(null); _fwI1.setFirewallSessionInterfaceInfo( new FirewallSessionInterfaceInfo(false, ImmutableList.of(FW_I1), null, PERMIT_TCP)); assertThat( preInInterfaceEdges(sessionInfo), contains( edge( new PreInInterface(FW, FW_I1), new PreInInterface(SOURCE1, SOURCE1_IFACE), allOf( mapsForward(srcFwI1, sessionHeaders.and(_permitTcpBdd).and(source1Iface)), mapsForward( srcFwI1.and(noLastHop), sessionHeaders.and(_permitTcpBdd).and(source1Iface)), mapsForward( srcFwI1.and(lastHop1), sessionHeaders.and(_permitTcpBdd).and(source1Iface)), mapsBackward(source1Iface, validSrc.and(sessionHeaders).and(_permitTcpBdd)), mapsBackward(fakeIface, ZERO))))); _fwI1.setFirewallSessionInterfaceInfo(null); { BDD poolBdd = PKT.getSrcIp().value(10L); Transition nat = Transitions.eraseAndSet(PKT.getSrcIp(), poolBdd); BDDFirewallSessionTraceInfo natSessionInfo = new BDDFirewallSessionTraceInfo( FW, ImmutableSet.of(FW_I1), new ForwardOutInterface(FW_I1, NodeInterfacePair.of(SOURCE1, SOURCE1_IFACE)), sessionHeaders, nat); assertThat( preInInterfaceEdges(natSessionInfo), contains( edge( new PreInInterface(FW, FW_I1), new PreInInterface(SOURCE1, SOURCE1_IFACE), allOf( mapsForward(srcFwI1, sessionHeaders.and(poolBdd).and(source1Iface)), mapsForward( srcFwI1.and(noLastHop), sessionHeaders.and(poolBdd).and(source1Iface)), mapsForward( srcFwI1.and(lastHop1), sessionHeaders.and(poolBdd).and(source1Iface)), mapsBackward(source1Iface, validSrc.and(sessionHeaders)), mapsBackward(source1Iface.and(poolBdd.not()), ZERO), mapsBackward(fakeIface, ZERO))))); } }
@VisibleForTesting Stream<Edge> preInInterfaceEdges(BDDFirewallSessionTraceInfo sessionInfo) { SessionAction action = sessionInfo.getAction(); checkArgument( action instanceof ForwardOutInterface, "Unsupported session action for PreInInterface->PreInInterface edge: %s", action); ForwardOutInterface forwardOutInterface = (ForwardOutInterface) action; NodeInterfacePair nextHop = forwardOutInterface.getNextHop(); checkArgument(nextHop != null, "Not a PreInInterface session"); String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new PreInInterface(nextHop.getHostname(), nextHop.getInterface()); Transition outAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface)); Transition addSourceIfaceConstraint = addSourceInterfaceConstraint(_srcMgrs.get(nextHop.getHostname()), nextHop.getInterface()); Transition addLastHop = addLastHopConstraint( _lastHopMgr, hostname, outIface, nextHop.getHostname(), nextHop.getInterface()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD sessionFlows = sessionInfo.getSessionFlows(); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), outAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr), addSourceIfaceConstraint, addLastHop); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); }
SessionInstrumentation { @VisibleForTesting Stream<Edge> preInInterfaceEdges(BDDFirewallSessionTraceInfo sessionInfo) { SessionAction action = sessionInfo.getAction(); checkArgument( action instanceof ForwardOutInterface, "Unsupported session action for PreInInterface->PreInInterface edge: %s", action); ForwardOutInterface forwardOutInterface = (ForwardOutInterface) action; NodeInterfacePair nextHop = forwardOutInterface.getNextHop(); checkArgument(nextHop != null, "Not a PreInInterface session"); String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new PreInInterface(nextHop.getHostname(), nextHop.getInterface()); Transition outAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface)); Transition addSourceIfaceConstraint = addSourceInterfaceConstraint(_srcMgrs.get(nextHop.getHostname()), nextHop.getInterface()); Transition addLastHop = addLastHopConstraint( _lastHopMgr, hostname, outIface, nextHop.getHostname(), nextHop.getInterface()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD sessionFlows = sessionInfo.getSessionFlows(); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), outAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr), addSourceIfaceConstraint, addLastHop); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } }
SessionInstrumentation { @VisibleForTesting Stream<Edge> preInInterfaceEdges(BDDFirewallSessionTraceInfo sessionInfo) { SessionAction action = sessionInfo.getAction(); checkArgument( action instanceof ForwardOutInterface, "Unsupported session action for PreInInterface->PreInInterface edge: %s", action); ForwardOutInterface forwardOutInterface = (ForwardOutInterface) action; NodeInterfacePair nextHop = forwardOutInterface.getNextHop(); checkArgument(nextHop != null, "Not a PreInInterface session"); String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new PreInInterface(nextHop.getHostname(), nextHop.getInterface()); Transition outAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface)); Transition addSourceIfaceConstraint = addSourceInterfaceConstraint(_srcMgrs.get(nextHop.getHostname()), nextHop.getInterface()); Transition addLastHop = addLastHopConstraint( _lastHopMgr, hostname, outIface, nextHop.getHostname(), nextHop.getInterface()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD sessionFlows = sessionInfo.getSessionFlows(); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), outAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr), addSourceIfaceConstraint, addLastHop); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } @VisibleForTesting  SessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      @Nullable Map<String, Map<String, Supplier<BDD>>> filterBdds); }
SessionInstrumentation { @VisibleForTesting Stream<Edge> preInInterfaceEdges(BDDFirewallSessionTraceInfo sessionInfo) { SessionAction action = sessionInfo.getAction(); checkArgument( action instanceof ForwardOutInterface, "Unsupported session action for PreInInterface->PreInInterface edge: %s", action); ForwardOutInterface forwardOutInterface = (ForwardOutInterface) action; NodeInterfacePair nextHop = forwardOutInterface.getNextHop(); checkArgument(nextHop != null, "Not a PreInInterface session"); String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new PreInInterface(nextHop.getHostname(), nextHop.getInterface()); Transition outAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface)); Transition addSourceIfaceConstraint = addSourceInterfaceConstraint(_srcMgrs.get(nextHop.getHostname()), nextHop.getInterface()); Transition addLastHop = addLastHopConstraint( _lastHopMgr, hostname, outIface, nextHop.getHostname(), nextHop.getInterface()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD sessionFlows = sessionInfo.getSessionFlows(); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), outAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr), addSourceIfaceConstraint, addLastHop); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } @VisibleForTesting  SessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      @Nullable Map<String, Map<String, Supplier<BDD>>> filterBdds); static Stream<Edge> sessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      Map<String, Map<String, Supplier<BDD>>> filterBdds,
      Stream<Edge> originalEdges,
      Map<String, List<BDDFirewallSessionTraceInfo>> initializedSessions,
      BDDFibGenerator bddFibGenerator); }
SessionInstrumentation { @VisibleForTesting Stream<Edge> preInInterfaceEdges(BDDFirewallSessionTraceInfo sessionInfo) { SessionAction action = sessionInfo.getAction(); checkArgument( action instanceof ForwardOutInterface, "Unsupported session action for PreInInterface->PreInInterface edge: %s", action); ForwardOutInterface forwardOutInterface = (ForwardOutInterface) action; NodeInterfacePair nextHop = forwardOutInterface.getNextHop(); checkArgument(nextHop != null, "Not a PreInInterface session"); String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new PreInInterface(nextHop.getHostname(), nextHop.getInterface()); Transition outAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface)); Transition addSourceIfaceConstraint = addSourceInterfaceConstraint(_srcMgrs.get(nextHop.getHostname()), nextHop.getInterface()); Transition addLastHop = addLastHopConstraint( _lastHopMgr, hostname, outIface, nextHop.getHostname(), nextHop.getInterface()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD sessionFlows = sessionInfo.getSessionFlows(); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), outAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr), addSourceIfaceConstraint, addLastHop); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } @VisibleForTesting  SessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      @Nullable Map<String, Map<String, Supplier<BDD>>> filterBdds); static Stream<Edge> sessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      Map<String, Map<String, Supplier<BDD>>> filterBdds,
      Stream<Edge> originalEdges,
      Map<String, List<BDDFirewallSessionTraceInfo>> initializedSessions,
      BDDFibGenerator bddFibGenerator);  }