@Test public void testComputeAntiSpoofingFilter() { Ip validSourceIp = Ip.parse("10.10.10.10"); Interface iface = Interface.builder() .setName("test") .setAddresses(ConcreteInterfaceAddress.create(validSourceIp, Prefix.MAX_PREFIX_LENGTH)) .build(); AclLine antiSpoofingLine = computeAntiSpoofingFilter(iface); assertThat( new AclLineEvaluator( Flow.builder().setSrcIp(validSourceIp).setIngressNode("aa").build(), "blah", ImmutableMap.of(), ImmutableMap.of()) .visit(antiSpoofingLine), nullValue()); assertThat( new AclLineEvaluator( Flow.builder().setSrcIp(Ip.parse("6.6.6.6")).setIngressNode("aa").build(), "blah", ImmutableMap.of(), ImmutableMap.of()) .visit(antiSpoofingLine), equalTo(LineAction.DENY)); }
@VisibleForTesting static AclLine computeAntiSpoofingFilter(Interface iface) { IpSpace validSourceIpSpace = IpWildcardSetIpSpace.builder() .including( iface.getAllConcreteAddresses().stream() .map(addr -> IpWildcard.create(addr.getIp())) .collect(Collectors.toList())) .build(); return ExprAclLine.builder() .setTraceElement(DENY_SPOOFED_SOURCE_IP_TRACE_ELEMENT) .setMatchCondition( not(new MatchHeaderSpace(HeaderSpace.builder().setSrcIps(validSourceIpSpace).build()))) .setAction(LineAction.DENY) .build(); }
Region implements Serializable { @VisibleForTesting static AclLine computeAntiSpoofingFilter(Interface iface) { IpSpace validSourceIpSpace = IpWildcardSetIpSpace.builder() .including( iface.getAllConcreteAddresses().stream() .map(addr -> IpWildcard.create(addr.getIp())) .collect(Collectors.toList())) .build(); return ExprAclLine.builder() .setTraceElement(DENY_SPOOFED_SOURCE_IP_TRACE_ELEMENT) .setMatchCondition( not(new MatchHeaderSpace(HeaderSpace.builder().setSrcIps(validSourceIpSpace).build()))) .setAction(LineAction.DENY) .build(); } }
Region implements Serializable { @VisibleForTesting static AclLine computeAntiSpoofingFilter(Interface iface) { IpSpace validSourceIpSpace = IpWildcardSetIpSpace.builder() .including( iface.getAllConcreteAddresses().stream() .map(addr -> IpWildcard.create(addr.getIp())) .collect(Collectors.toList())) .build(); return ExprAclLine.builder() .setTraceElement(DENY_SPOOFED_SOURCE_IP_TRACE_ELEMENT) .setMatchCondition( not(new MatchHeaderSpace(HeaderSpace.builder().setSrcIps(validSourceIpSpace).build()))) .setAction(LineAction.DENY) .build(); } Region(String name); private  Region(
      String name,
      Map<String, Address> addresses,
      Map<String, CustomerGateway> customerGateways,
      Map<String, ElasticsearchDomain> elasticsearchDomains,
      Map<String, Instance> instances,
      Map<String, InternetGateway> internetGateways,
      Map<String, LoadBalancer> loadBalancers,
      Map<String, LoadBalancerAttributes> loadBalancerAttributes,
      Map<String, LoadBalancerListener> loadBalancerListeners,
      Map<String, LoadBalancerTargetHealth> loadBalancerTargetHealths,
      Map<String, NatGateway> natGateways,
      Map<String, NetworkAcl> networkAcls,
      Map<String, NetworkInterface> networkInterfaces,
      Map<String, PrefixList> prefixLists,
      Map<String, RdsInstance> rdsInstances,
      Map<String, RouteTable> routeTables,
      Map<String, SecurityGroup> securityGroups,
      Map<String, Subnet> subnets,
      Map<String, TargetGroup> targetGroups,
      Map<String, TransitGatewayAttachment> transitGatewayAttachments,
      Map<String, TransitGatewayPropagations> transitGatewayPropagations,
      Map<String, TransitGatewayRouteTable> transitGatewayRouteTables,
      Map<String, TransitGatewayStaticRoutes> transitGatewayStaticRoutes,
      Map<String, TransitGatewayVpcAttachment> transitGatewayVpcAttachments,
      Map<String, TransitGateway> transitGateways,
      Map<String, VpcEndpoint> vpcEndpoints,
      Map<String, VpcPeeringConnection> vpcPeerings,
      Map<String, Vpc> vpcs,
      Map<String, VpnConnection> vpnConnections,
      Map<String, VpnGateway> vpnGateways); }
Region implements Serializable { @VisibleForTesting static AclLine computeAntiSpoofingFilter(Interface iface) { IpSpace validSourceIpSpace = IpWildcardSetIpSpace.builder() .including( iface.getAllConcreteAddresses().stream() .map(addr -> IpWildcard.create(addr.getIp())) .collect(Collectors.toList())) .build(); return ExprAclLine.builder() .setTraceElement(DENY_SPOOFED_SOURCE_IP_TRACE_ELEMENT) .setMatchCondition( not(new MatchHeaderSpace(HeaderSpace.builder().setSrcIps(validSourceIpSpace).build()))) .setAction(LineAction.DENY) .build(); } Region(String name); private  Region(
      String name,
      Map<String, Address> addresses,
      Map<String, CustomerGateway> customerGateways,
      Map<String, ElasticsearchDomain> elasticsearchDomains,
      Map<String, Instance> instances,
      Map<String, InternetGateway> internetGateways,
      Map<String, LoadBalancer> loadBalancers,
      Map<String, LoadBalancerAttributes> loadBalancerAttributes,
      Map<String, LoadBalancerListener> loadBalancerListeners,
      Map<String, LoadBalancerTargetHealth> loadBalancerTargetHealths,
      Map<String, NatGateway> natGateways,
      Map<String, NetworkAcl> networkAcls,
      Map<String, NetworkInterface> networkInterfaces,
      Map<String, PrefixList> prefixLists,
      Map<String, RdsInstance> rdsInstances,
      Map<String, RouteTable> routeTables,
      Map<String, SecurityGroup> securityGroups,
      Map<String, Subnet> subnets,
      Map<String, TargetGroup> targetGroups,
      Map<String, TransitGatewayAttachment> transitGatewayAttachments,
      Map<String, TransitGatewayPropagations> transitGatewayPropagations,
      Map<String, TransitGatewayRouteTable> transitGatewayRouteTables,
      Map<String, TransitGatewayStaticRoutes> transitGatewayStaticRoutes,
      Map<String, TransitGatewayVpcAttachment> transitGatewayVpcAttachments,
      Map<String, TransitGateway> transitGateways,
      Map<String, VpcEndpoint> vpcEndpoints,
      Map<String, VpcPeeringConnection> vpcPeerings,
      Map<String, Vpc> vpcs,
      Map<String, VpnConnection> vpnConnections,
      Map<String, VpnGateway> vpnGateways); static RegionBuilder builder(String name); @Nonnull Set<Address> getAddresses(); @Nonnull Map<String, Instance> getInstances(); @Nonnull Set<LoadBalancer> getLoadBalancers(); @Nullable LoadBalancerListener getLoadBalancerListener(String loadBalancerArn); @Nullable LoadBalancerTargetHealth getLoadBalancerTargetHealth(String targetGroupArn); @Nonnull String getName(); @Nonnull Map<String, NetworkAcl> getNetworkAcls(); @Nonnull Map<String, PrefixList> getPrefixLists(); @Nonnull Map<String, NetworkInterface> getNetworkInterfaces(); @Nonnull Map<String, SecurityGroup> getSecurityGroups(); @Nonnull Map<String, Subnet> getSubnets(); @Nullable TargetGroup getTargetGroup(String targetGroupArn); @Nonnull Map<String, VpcEndpoint> getVpcEndpoints(); void applyAclsToInterfaceBasedOnSecurityGroups(
      Iterable<String> groups, Configuration c, Interface i); }
Region implements Serializable { @VisibleForTesting static AclLine computeAntiSpoofingFilter(Interface iface) { IpSpace validSourceIpSpace = IpWildcardSetIpSpace.builder() .including( iface.getAllConcreteAddresses().stream() .map(addr -> IpWildcard.create(addr.getIp())) .collect(Collectors.toList())) .build(); return ExprAclLine.builder() .setTraceElement(DENY_SPOOFED_SOURCE_IP_TRACE_ELEMENT) .setMatchCondition( not(new MatchHeaderSpace(HeaderSpace.builder().setSrcIps(validSourceIpSpace).build()))) .setAction(LineAction.DENY) .build(); } Region(String name); private  Region(
      String name,
      Map<String, Address> addresses,
      Map<String, CustomerGateway> customerGateways,
      Map<String, ElasticsearchDomain> elasticsearchDomains,
      Map<String, Instance> instances,
      Map<String, InternetGateway> internetGateways,
      Map<String, LoadBalancer> loadBalancers,
      Map<String, LoadBalancerAttributes> loadBalancerAttributes,
      Map<String, LoadBalancerListener> loadBalancerListeners,
      Map<String, LoadBalancerTargetHealth> loadBalancerTargetHealths,
      Map<String, NatGateway> natGateways,
      Map<String, NetworkAcl> networkAcls,
      Map<String, NetworkInterface> networkInterfaces,
      Map<String, PrefixList> prefixLists,
      Map<String, RdsInstance> rdsInstances,
      Map<String, RouteTable> routeTables,
      Map<String, SecurityGroup> securityGroups,
      Map<String, Subnet> subnets,
      Map<String, TargetGroup> targetGroups,
      Map<String, TransitGatewayAttachment> transitGatewayAttachments,
      Map<String, TransitGatewayPropagations> transitGatewayPropagations,
      Map<String, TransitGatewayRouteTable> transitGatewayRouteTables,
      Map<String, TransitGatewayStaticRoutes> transitGatewayStaticRoutes,
      Map<String, TransitGatewayVpcAttachment> transitGatewayVpcAttachments,
      Map<String, TransitGateway> transitGateways,
      Map<String, VpcEndpoint> vpcEndpoints,
      Map<String, VpcPeeringConnection> vpcPeerings,
      Map<String, Vpc> vpcs,
      Map<String, VpnConnection> vpnConnections,
      Map<String, VpnGateway> vpnGateways); static RegionBuilder builder(String name); @Nonnull Set<Address> getAddresses(); @Nonnull Map<String, Instance> getInstances(); @Nonnull Set<LoadBalancer> getLoadBalancers(); @Nullable LoadBalancerListener getLoadBalancerListener(String loadBalancerArn); @Nullable LoadBalancerTargetHealth getLoadBalancerTargetHealth(String targetGroupArn); @Nonnull String getName(); @Nonnull Map<String, NetworkAcl> getNetworkAcls(); @Nonnull Map<String, PrefixList> getPrefixLists(); @Nonnull Map<String, NetworkInterface> getNetworkInterfaces(); @Nonnull Map<String, SecurityGroup> getSecurityGroups(); @Nonnull Map<String, Subnet> getSubnets(); @Nullable TargetGroup getTargetGroup(String targetGroupArn); @Nonnull Map<String, VpcEndpoint> getVpcEndpoints(); void applyAclsToInterfaceBasedOnSecurityGroups(
      Iterable<String> groups, Configuration c, Interface i);  }