@Test public void testComputePostTransformationIllegalPacketFilter() { Ip privateIp = Ip.parse("10.10.10.10"); IpAccessList filter = computePostTransformationIllegalPacketFilter(privateIp); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.TCP) .setSrcIp(privateIp) .setSrcPort(345) .setDstIp(Ip.parse("2.2.2.2")) .setDstPort(80) .build(), "a", ImmutableMap.of(), ImmutableMap.of()) .getAction(), equalTo(LineAction.DENY)); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.TCP) .setSrcIp(Ip.parse("1.1.1.11")) .setSrcPort(345) .setDstIp(privateIp) .setDstPort(80) .build(), "a", ImmutableMap.of(), ImmutableMap.of()) .getAction(), equalTo(LineAction.DENY)); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.TCP) .setSrcIp(Ip.parse("10.10.10.11")) .setSrcPort(345) .setDstIp(Ip.parse("2.2.2.2")) .setDstPort(80) .build(), "a", ImmutableMap.of(), ImmutableMap.of()) .getAction(), equalTo(LineAction.PERMIT)); assertThat( filter .filter( Flow.builder() .setIngressNode("a") .setIpProtocol(IpProtocol.TCP) .setSrcPort(345) .setDstIp(Ip.parse("2.2.2.2")) .setDstPort(80) .build(), "a", ImmutableMap.of(), ImmutableMap.of()) .getAction(), equalTo(LineAction.PERMIT)); }
@VisibleForTesting static IpAccessList computePostTransformationIllegalPacketFilter(Ip privateIp) { return IpAccessList.builder() .setName(ILLEGAL_PACKET_FILTER_NAME) .setLines( ExprAclLine.rejecting( TraceElement.of("Denied packets where source IP is the NAT gateway's private IP"), new MatchHeaderSpace( HeaderSpace.builder() .setSrcIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.rejecting( TraceElement.of("Denied packets that did NOT match an active NAT session"), new MatchHeaderSpace( HeaderSpace.builder() .setDstIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.accepting( TraceElement.of("Permitted packets transformed by the NAT gateway"), TrueExpr.INSTANCE)) .build(); }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computePostTransformationIllegalPacketFilter(Ip privateIp) { return IpAccessList.builder() .setName(ILLEGAL_PACKET_FILTER_NAME) .setLines( ExprAclLine.rejecting( TraceElement.of("Denied packets where source IP is the NAT gateway's private IP"), new MatchHeaderSpace( HeaderSpace.builder() .setSrcIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.rejecting( TraceElement.of("Denied packets that did NOT match an active NAT session"), new MatchHeaderSpace( HeaderSpace.builder() .setDstIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.accepting( TraceElement.of("Permitted packets transformed by the NAT gateway"), TrueExpr.INSTANCE)) .build(); } }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computePostTransformationIllegalPacketFilter(Ip privateIp) { return IpAccessList.builder() .setName(ILLEGAL_PACKET_FILTER_NAME) .setLines( ExprAclLine.rejecting( TraceElement.of("Denied packets where source IP is the NAT gateway's private IP"), new MatchHeaderSpace( HeaderSpace.builder() .setSrcIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.rejecting( TraceElement.of("Denied packets that did NOT match an active NAT session"), new MatchHeaderSpace( HeaderSpace.builder() .setDstIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.accepting( TraceElement.of("Permitted packets transformed by the NAT gateway"), TrueExpr.INSTANCE)) .build(); } NatGateway(
      String natGatewayId,
      String subnetId,
      String vpcId,
      List<NatGatewayAddress> natGatewayAddresses,
      Map<String, String> tags); }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computePostTransformationIllegalPacketFilter(Ip privateIp) { return IpAccessList.builder() .setName(ILLEGAL_PACKET_FILTER_NAME) .setLines( ExprAclLine.rejecting( TraceElement.of("Denied packets where source IP is the NAT gateway's private IP"), new MatchHeaderSpace( HeaderSpace.builder() .setSrcIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.rejecting( TraceElement.of("Denied packets that did NOT match an active NAT session"), new MatchHeaderSpace( HeaderSpace.builder() .setDstIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.accepting( TraceElement.of("Permitted packets transformed by the NAT gateway"), TrueExpr.INSTANCE)) .build(); } NatGateway(
      String natGatewayId,
      String subnetId,
      String vpcId,
      List<NatGatewayAddress> natGatewayAddresses,
      Map<String, String> tags); @Override String getId(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode(); }
NatGateway implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computePostTransformationIllegalPacketFilter(Ip privateIp) { return IpAccessList.builder() .setName(ILLEGAL_PACKET_FILTER_NAME) .setLines( ExprAclLine.rejecting( TraceElement.of("Denied packets where source IP is the NAT gateway's private IP"), new MatchHeaderSpace( HeaderSpace.builder() .setSrcIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.rejecting( TraceElement.of("Denied packets that did NOT match an active NAT session"), new MatchHeaderSpace( HeaderSpace.builder() .setDstIps(ImmutableList.of(IpWildcard.create(privateIp))) .build())), ExprAclLine.accepting( TraceElement.of("Permitted packets transformed by the NAT gateway"), TrueExpr.INSTANCE)) .build(); } NatGateway(
      String natGatewayId,
      String subnetId,
      String vpcId,
      List<NatGatewayAddress> natGatewayAddresses,
      Map<String, String> tags); @Override String getId(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode();  }