@Test public void testComputeNotForwardedFilter() { Ip loadBalancerIp = Ip.parse("10.10.10.10"); IpAccessList ipAccessList = computeNotForwardedFilter( ImmutableList.of(new PrivateIpAddress(true, loadBalancerIp, null))); Flow deniedFlow = getTcpFlow(loadBalancerIp); assertThat( ipAccessList.filter(deniedFlow, null, ImmutableMap.of(), ImmutableMap.of()).getAction(), equalTo(LineAction.DENY)); assertThat( AclTracer.trace( ipAccessList, deniedFlow, null, ImmutableMap.of(), ImmutableMap.of(), ImmutableMap.of()), contains(hasTraceElement(getTraceElementForNotForwardedPackets()))); Flow allowedFlow = getTcpFlow(Ip.parse("1.1.1.1")); assertThat( ipAccessList.filter(allowedFlow, null, ImmutableMap.of(), ImmutableMap.of()).getAction(), equalTo(LineAction.PERMIT)); assertThat( AclTracer.trace( ipAccessList, allowedFlow, null, ImmutableMap.of(), ImmutableMap.of(), ImmutableMap.of()), contains(hasTraceElement(getTraceElementForForwardedPackets()))); }
@VisibleForTesting static IpAccessList computeNotForwardedFilter( List<PrivateIpAddress> loadBalancerInterfaceAddresses) { return IpAccessList.builder() .setName(FORWARDED_PACKETS_FILTER_NAME) .setLines( ExprAclLine.builder() .setTraceElement(getTraceElementForNotForwardedPackets()) .setMatchCondition( new MatchHeaderSpace( HeaderSpace.builder() .setDstIps( loadBalancerInterfaceAddresses.stream() .map(privateIp -> IpWildcard.create(privateIp.getPrivateIp())) .collect(ImmutableList.toImmutableList())) .build())) .setAction(LineAction.DENY) .setName("Deny packets without a valid target") .build(), ExprAclLine.builder() .setTraceElement(getTraceElementForForwardedPackets()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.PERMIT) .setName("Permit packets with valid targets") .build()) .build(); }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeNotForwardedFilter( List<PrivateIpAddress> loadBalancerInterfaceAddresses) { return IpAccessList.builder() .setName(FORWARDED_PACKETS_FILTER_NAME) .setLines( ExprAclLine.builder() .setTraceElement(getTraceElementForNotForwardedPackets()) .setMatchCondition( new MatchHeaderSpace( HeaderSpace.builder() .setDstIps( loadBalancerInterfaceAddresses.stream() .map(privateIp -> IpWildcard.create(privateIp.getPrivateIp())) .collect(ImmutableList.toImmutableList())) .build())) .setAction(LineAction.DENY) .setName("Deny packets without a valid target") .build(), ExprAclLine.builder() .setTraceElement(getTraceElementForForwardedPackets()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.PERMIT) .setName("Permit packets with valid targets") .build()) .build(); } }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeNotForwardedFilter( List<PrivateIpAddress> loadBalancerInterfaceAddresses) { return IpAccessList.builder() .setName(FORWARDED_PACKETS_FILTER_NAME) .setLines( ExprAclLine.builder() .setTraceElement(getTraceElementForNotForwardedPackets()) .setMatchCondition( new MatchHeaderSpace( HeaderSpace.builder() .setDstIps( loadBalancerInterfaceAddresses.stream() .map(privateIp -> IpWildcard.create(privateIp.getPrivateIp())) .collect(ImmutableList.toImmutableList())) .build())) .setAction(LineAction.DENY) .setName("Deny packets without a valid target") .build(), ExprAclLine.builder() .setTraceElement(getTraceElementForForwardedPackets()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.PERMIT) .setName("Permit packets with valid targets") .build()) .build(); } LoadBalancer(
      String arn,
      List<AvailabilityZone> availabilityZones,
      String dnsName,
      String name,
      Scheme scheme,
      Type type,
      String vpcId); }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeNotForwardedFilter( List<PrivateIpAddress> loadBalancerInterfaceAddresses) { return IpAccessList.builder() .setName(FORWARDED_PACKETS_FILTER_NAME) .setLines( ExprAclLine.builder() .setTraceElement(getTraceElementForNotForwardedPackets()) .setMatchCondition( new MatchHeaderSpace( HeaderSpace.builder() .setDstIps( loadBalancerInterfaceAddresses.stream() .map(privateIp -> IpWildcard.create(privateIp.getPrivateIp())) .collect(ImmutableList.toImmutableList())) .build())) .setAction(LineAction.DENY) .setName("Deny packets without a valid target") .build(), ExprAclLine.builder() .setTraceElement(getTraceElementForForwardedPackets()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.PERMIT) .setName("Permit packets with valid targets") .build()) .build(); } LoadBalancer(
      String arn,
      List<AvailabilityZone> availabilityZones,
      String dnsName,
      String name,
      Scheme scheme,
      Type type,
      String vpcId); @Override String getId(); @Nonnull List<AvailabilityZone> getAvailabilityZones(); @Nonnull String getDnsName(); @Nonnull String getName(); @Nonnull Scheme getScheme(); @Nonnull Type getType(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString(); }
LoadBalancer implements AwsVpcEntity, Serializable { @VisibleForTesting static IpAccessList computeNotForwardedFilter( List<PrivateIpAddress> loadBalancerInterfaceAddresses) { return IpAccessList.builder() .setName(FORWARDED_PACKETS_FILTER_NAME) .setLines( ExprAclLine.builder() .setTraceElement(getTraceElementForNotForwardedPackets()) .setMatchCondition( new MatchHeaderSpace( HeaderSpace.builder() .setDstIps( loadBalancerInterfaceAddresses.stream() .map(privateIp -> IpWildcard.create(privateIp.getPrivateIp())) .collect(ImmutableList.toImmutableList())) .build())) .setAction(LineAction.DENY) .setName("Deny packets without a valid target") .build(), ExprAclLine.builder() .setTraceElement(getTraceElementForForwardedPackets()) .setMatchCondition(TrueExpr.INSTANCE) .setAction(LineAction.PERMIT) .setName("Permit packets with valid targets") .build()) .build(); } LoadBalancer(
      String arn,
      List<AvailabilityZone> availabilityZones,
      String dnsName,
      String name,
      Scheme scheme,
      Type type,
      String vpcId); @Override String getId(); @Nonnull List<AvailabilityZone> getAvailabilityZones(); @Nonnull String getDnsName(); @Nonnull String getName(); @Nonnull Scheme getScheme(); @Nonnull Type getType(); @Nonnull String getVpcId(); @Override boolean equals(Object o); @Override int hashCode(); @Override String toString();  }