@Test public void testComputeListenerFilter() { DefaultAction action = new DefaultAction(1, "tgArn", ActionType.FORWARD); List<Listener> listeners = ImmutableList.of(new Listener("listener1Arn", ImmutableList.of(action), Protocol.TCP, 80)); IpAccessList ipAccessList = computeListenerFilter(listeners); Flow allowedFlow = getTcpFlow(Ip.parse("1.1.1.1")); assertThat( ipAccessList.filter(allowedFlow, null, ImmutableMap.of(), ImmutableMap.of()).getAction(), equalTo(LineAction.PERMIT)); assertThat( AclTracer.trace( ipAccessList, allowedFlow, null, ImmutableMap.of(), ImmutableMap.of(), ImmutableMap.of()), contains(hasTraceElement(getTraceElementForMatchedListener("listener1Arn")))); Flow deniedTcpFlow = Flow.builder() .setIngressNode("a") .setSrcPort(89) .setDstPort(81) .setIpProtocol(IpProtocol.TCP) .build(); assertThat( ipAccessList.filter(deniedTcpFlow, null, ImmutableMap.of(), ImmutableMap.of()).getAction(), equalTo(LineAction.DENY)); assertThat( AclTracer.trace( ipAccessList, deniedTcpFlow, null, ImmutableMap.of(), ImmutableMap.of(), ImmutableMap.of()), contains(hasTraceElement(getTraceElementForNoMatchedListener()))); assertThat( ipAccessList .filter( Flow.builder() .setIngressNode("a") .setSrcPort(89) .setDstPort(80) .setIpProtocol(IpProtocol.UDP) .build(), null, ImmutableMap.of(), ImmutableMap.of()) .getAction(), equalTo(LineAction.DENY)); }
@VisibleForTesting static IpAccessList computeListenerFilter(List<Listener> listeners) { List<AclLine> aclLines = listeners.stream() .filter( listener -> listener.getDefaultActions().stream() .anyMatch(action -> action.getType() == ActionType.FORWARD)) .map( listener -> ExprAclLine.builder() .setTraceElement(getTraceElementForMatchedListener(listener.getId())) .setMatchCondition(new MatchHeaderSpace(listener.getMatchingHeaderSpace())) .setAction(LineAction.PERMIT) .setName("Listener " + listener.getId()) .build()) .collect(ImmutableList.toImmutableList()); return IpAccessList.builder() .setName(LISTENER_FILTER_NAME) .setLines( new ImmutableList.Builder<AclLine>() .addAll(aclLines) .add( ExprAclLine.builder() .setTraceElement(getTraceElementForNoMatchedListener()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.DENY) .setName("Default deny") .build()) .build()) .build(); }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeListenerFilter(List<Listener> listeners) { List<AclLine> aclLines = listeners.stream() .filter( listener -> listener.getDefaultActions().stream() .anyMatch(action -> action.getType() == ActionType.FORWARD)) .map( listener -> ExprAclLine.builder() .setTraceElement(getTraceElementForMatchedListener(listener.getId())) .setMatchCondition(new MatchHeaderSpace(listener.getMatchingHeaderSpace())) .setAction(LineAction.PERMIT) .setName("Listener " + listener.getId()) .build()) .collect(ImmutableList.toImmutableList()); return IpAccessList.builder() .setName(LISTENER_FILTER_NAME) .setLines( new ImmutableList.Builder<AclLine>() .addAll(aclLines) .add( ExprAclLine.builder() .setTraceElement(getTraceElementForNoMatchedListener()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.DENY) .setName("Default deny") .build()) .build()) .build(); } }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeListenerFilter(List<Listener> listeners) { List<AclLine> aclLines = listeners.stream() .filter( listener -> listener.getDefaultActions().stream() .anyMatch(action -> action.getType() == ActionType.FORWARD)) .map( listener -> ExprAclLine.builder() .setTraceElement(getTraceElementForMatchedListener(listener.getId())) .setMatchCondition(new MatchHeaderSpace(listener.getMatchingHeaderSpace())) .setAction(LineAction.PERMIT) .setName("Listener " + listener.getId()) .build()) .collect(ImmutableList.toImmutableList()); return IpAccessList.builder() .setName(LISTENER_FILTER_NAME) .setLines( new ImmutableList.Builder<AclLine>() .addAll(aclLines) .add( ExprAclLine.builder() .setTraceElement(getTraceElementForNoMatchedListener()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.DENY) .setName("Default deny") .build()) .build()) .build(); } LoadBalancer(
      String arn,
      List<AvailabilityZone> availabilityZones,
      String dnsName,
      String name,
      Scheme scheme,
      Type type,
      String vpcId); }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeListenerFilter(List<Listener> listeners) { List<AclLine> aclLines = listeners.stream() .filter( listener -> listener.getDefaultActions().stream() .anyMatch(action -> action.getType() == ActionType.FORWARD)) .map( listener -> ExprAclLine.builder() .setTraceElement(getTraceElementForMatchedListener(listener.getId())) .setMatchCondition(new MatchHeaderSpace(listener.getMatchingHeaderSpace())) .setAction(LineAction.PERMIT) .setName("Listener " + listener.getId()) .build()) .collect(ImmutableList.toImmutableList()); return IpAccessList.builder() .setName(LISTENER_FILTER_NAME) .setLines( new ImmutableList.Builder<AclLine>() .addAll(aclLines) .add( ExprAclLine.builder() .setTraceElement(getTraceElementForNoMatchedListener()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.DENY) .setName("Default deny") .build()) .build()) .build(); } LoadBalancer(
      String arn,
      List<AvailabilityZone> availabilityZones,
      String dnsName,
      String name,
      Scheme scheme,
      Type type,
      String vpcId); @Override String getId(); @Nonnull List<AvailabilityZone> getAvailabilityZones(); @Nonnull String getDnsName(); @Nonnull String getName(); @Nonnull Scheme getScheme(); @Nonnull Type getType(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString(); }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeListenerFilter(List<Listener> listeners) { List<AclLine> aclLines = listeners.stream() .filter( listener -> listener.getDefaultActions().stream() .anyMatch(action -> action.getType() == ActionType.FORWARD)) .map( listener -> ExprAclLine.builder() .setTraceElement(getTraceElementForMatchedListener(listener.getId())) .setMatchCondition(new MatchHeaderSpace(listener.getMatchingHeaderSpace())) .setAction(LineAction.PERMIT) .setName("Listener " + listener.getId()) .build()) .collect(ImmutableList.toImmutableList()); return IpAccessList.builder() .setName(LISTENER_FILTER_NAME) .setLines( new ImmutableList.Builder<AclLine>() .addAll(aclLines) .add( ExprAclLine.builder() .setTraceElement(getTraceElementForNoMatchedListener()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.DENY) .setName("Default deny") .build()) .build()) .build(); } LoadBalancer(
      String arn,
      List<AvailabilityZone> availabilityZones,
      String dnsName,
      String name,
      Scheme scheme,
      Type type,
      String vpcId); @Override String getId(); @Nonnull List<AvailabilityZone> getAvailabilityZones(); @Nonnull String getDnsName(); @Nonnull String getName(); @Nonnull Scheme getScheme(); @Nonnull Type getType(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString();  }