@Test public void testUserIdGroupTracing() { IpPermissions ipPermissions = new IpPermissions( "tcp", 22, 22, ImmutableList.of(), ImmutableList.of(), ImmutableList.of(new UserIdGroupPair(SG_ID, SG_DESC))); String lineName = "lineName"; ExprAclLine line = ipPermissions.toIpAccessListLine(true, createTestRegion(), lineName, new Warnings()); IpAccessList acl = IpAccessList.builder().setLines(line).setName("acl").build(); Flow flow = Flow.builder() .setIpProtocol(TCP) .setSrcPort(22) .setSrcIp(Ip.parse("1.2.3.4")) .setDstPort(22) .setIngressNode("c") .build(); List<TraceTree> root = AclTracer.trace(acl, flow, null, ImmutableMap.of(), ImmutableMap.of(), ImmutableMap.of()); assertThat( Iterables.getOnlyElement(root), isTraceTree( getTraceElementForRule(SG_DESC), isTraceTree(traceElementForProtocol(TCP)), isTraceTree(traceElementForDstPorts(22, 22)), isTraceTree( traceElementForAddress("source", SG_NAME, AddressType.SECURITY_GROUP), isTraceTree(traceElementEniPrivateIp("eni-123"))))); Flow deniedFlow = Flow.builder() .setIpProtocol(TCP) .setSrcPort(22) .setSrcIp(Ip.parse("1.2.3.5")) .setDstPort(22) .setIngressNode("c") .build(); root = AclTracer.trace( acl, deniedFlow, null, ImmutableMap.of(), ImmutableMap.of(), ImmutableMap.of()); assertThat(root, empty()); }
@Nonnull ExprAclLine toIpAccessListLine(boolean ingress, Region region, String name, Warnings warnings) { if (_ipProtocol.equals("icmpv6")) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } List<AclLineMatchExpr> protocolAndPortExprs = getMatchExprsForProtocolAndPorts(name, warnings); if (protocolAndPortExprs == null) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } ImmutableList.Builder<AclLineMatchExpr> aclLineExprs = ImmutableList.builder(); _ipRanges.stream() .map( ipRange -> new AndMatchExpr( ImmutableList.<AclLineMatchExpr>builder() .addAll(protocolAndPortExprs) .add( exprForSrcOrDstIps( ipRange.getPrefix().toIpSpace(), ipRange.getPrefix().toString(), ingress, AddressType.CIDR_IP)) .build(), getTraceElementForRule(ipRange.getDescription()))) .forEach(aclLineExprs::add); aclLineExprs.addAll(userIdGroupsToAclLineExprs(region, protocolAndPortExprs, ingress)); aclLineExprs.addAll( collectPrefixListsIntoAclLineExprs( collectPrefixLists(region, _prefixList), protocolAndPortExprs, ingress)); return ExprAclLine.accepting() .setMatchCondition(or(aclLineExprs.build())) .setTraceElement(null) .setName(name) .build(); }
IpPermissions implements Serializable { @Nonnull ExprAclLine toIpAccessListLine(boolean ingress, Region region, String name, Warnings warnings) { if (_ipProtocol.equals("icmpv6")) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } List<AclLineMatchExpr> protocolAndPortExprs = getMatchExprsForProtocolAndPorts(name, warnings); if (protocolAndPortExprs == null) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } ImmutableList.Builder<AclLineMatchExpr> aclLineExprs = ImmutableList.builder(); _ipRanges.stream() .map( ipRange -> new AndMatchExpr( ImmutableList.<AclLineMatchExpr>builder() .addAll(protocolAndPortExprs) .add( exprForSrcOrDstIps( ipRange.getPrefix().toIpSpace(), ipRange.getPrefix().toString(), ingress, AddressType.CIDR_IP)) .build(), getTraceElementForRule(ipRange.getDescription()))) .forEach(aclLineExprs::add); aclLineExprs.addAll(userIdGroupsToAclLineExprs(region, protocolAndPortExprs, ingress)); aclLineExprs.addAll( collectPrefixListsIntoAclLineExprs( collectPrefixLists(region, _prefixList), protocolAndPortExprs, ingress)); return ExprAclLine.accepting() .setMatchCondition(or(aclLineExprs.build())) .setTraceElement(null) .setName(name) .build(); } }
IpPermissions implements Serializable { @Nonnull ExprAclLine toIpAccessListLine(boolean ingress, Region region, String name, Warnings warnings) { if (_ipProtocol.equals("icmpv6")) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } List<AclLineMatchExpr> protocolAndPortExprs = getMatchExprsForProtocolAndPorts(name, warnings); if (protocolAndPortExprs == null) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } ImmutableList.Builder<AclLineMatchExpr> aclLineExprs = ImmutableList.builder(); _ipRanges.stream() .map( ipRange -> new AndMatchExpr( ImmutableList.<AclLineMatchExpr>builder() .addAll(protocolAndPortExprs) .add( exprForSrcOrDstIps( ipRange.getPrefix().toIpSpace(), ipRange.getPrefix().toString(), ingress, AddressType.CIDR_IP)) .build(), getTraceElementForRule(ipRange.getDescription()))) .forEach(aclLineExprs::add); aclLineExprs.addAll(userIdGroupsToAclLineExprs(region, protocolAndPortExprs, ingress)); aclLineExprs.addAll( collectPrefixListsIntoAclLineExprs( collectPrefixLists(region, _prefixList), protocolAndPortExprs, ingress)); return ExprAclLine.accepting() .setMatchCondition(or(aclLineExprs.build())) .setTraceElement(null) .setName(name) .build(); } IpPermissions(
      String ipProtocol,
      @Nullable Integer fromPort,
      @Nullable Integer toPort,
      List<IpRange> ipRanges,
      List<String> prefixList,
      List<UserIdGroupPair> userIdGroupPairs); }
IpPermissions implements Serializable { @Nonnull ExprAclLine toIpAccessListLine(boolean ingress, Region region, String name, Warnings warnings) { if (_ipProtocol.equals("icmpv6")) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } List<AclLineMatchExpr> protocolAndPortExprs = getMatchExprsForProtocolAndPorts(name, warnings); if (protocolAndPortExprs == null) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } ImmutableList.Builder<AclLineMatchExpr> aclLineExprs = ImmutableList.builder(); _ipRanges.stream() .map( ipRange -> new AndMatchExpr( ImmutableList.<AclLineMatchExpr>builder() .addAll(protocolAndPortExprs) .add( exprForSrcOrDstIps( ipRange.getPrefix().toIpSpace(), ipRange.getPrefix().toString(), ingress, AddressType.CIDR_IP)) .build(), getTraceElementForRule(ipRange.getDescription()))) .forEach(aclLineExprs::add); aclLineExprs.addAll(userIdGroupsToAclLineExprs(region, protocolAndPortExprs, ingress)); aclLineExprs.addAll( collectPrefixListsIntoAclLineExprs( collectPrefixLists(region, _prefixList), protocolAndPortExprs, ingress)); return ExprAclLine.accepting() .setMatchCondition(or(aclLineExprs.build())) .setTraceElement(null) .setName(name) .build(); } IpPermissions(
      String ipProtocol,
      @Nullable Integer fromPort,
      @Nullable Integer toPort,
      List<IpRange> ipRanges,
      List<String> prefixList,
      List<UserIdGroupPair> userIdGroupPairs); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString(); @Nullable Integer getFromPort(); @Nonnull String getIpProtocol(); @Nonnull List<IpRange> getIpRanges(); @Nonnull List<String> getPrefixList(); @Nonnull List<UserIdGroupPair> getUserIdGroupPairs(); @Nullable Integer getToPort(); }
IpPermissions implements Serializable { @Nonnull ExprAclLine toIpAccessListLine(boolean ingress, Region region, String name, Warnings warnings) { if (_ipProtocol.equals("icmpv6")) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } List<AclLineMatchExpr> protocolAndPortExprs = getMatchExprsForProtocolAndPorts(name, warnings); if (protocolAndPortExprs == null) { return ExprAclLine.accepting().setMatchCondition(FALSE).setName(name).build(); } ImmutableList.Builder<AclLineMatchExpr> aclLineExprs = ImmutableList.builder(); _ipRanges.stream() .map( ipRange -> new AndMatchExpr( ImmutableList.<AclLineMatchExpr>builder() .addAll(protocolAndPortExprs) .add( exprForSrcOrDstIps( ipRange.getPrefix().toIpSpace(), ipRange.getPrefix().toString(), ingress, AddressType.CIDR_IP)) .build(), getTraceElementForRule(ipRange.getDescription()))) .forEach(aclLineExprs::add); aclLineExprs.addAll(userIdGroupsToAclLineExprs(region, protocolAndPortExprs, ingress)); aclLineExprs.addAll( collectPrefixListsIntoAclLineExprs( collectPrefixLists(region, _prefixList), protocolAndPortExprs, ingress)); return ExprAclLine.accepting() .setMatchCondition(or(aclLineExprs.build())) .setTraceElement(null) .setName(name) .build(); } IpPermissions(
      String ipProtocol,
      @Nullable Integer fromPort,
      @Nullable Integer toPort,
      List<IpRange> ipRanges,
      List<String> prefixList,
      List<UserIdGroupPair> userIdGroupPairs); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString(); @Nullable Integer getFromPort(); @Nonnull String getIpProtocol(); @Nonnull List<IpRange> getIpRanges(); @Nonnull List<String> getPrefixList(); @Nonnull List<UserIdGroupPair> getUserIdGroupPairs(); @Nullable Integer getToPort();  }