@Test public void testDropAclOutEdges() { BDD sessionHeaders = PKT.getDstIp().value(10L); BDD srcFwI1 = _fwSrcMgr.getSourceInterfaceBDD(FW_I1); BDD validSrc = _fwSrcMgr.isValidValue(); BDDFirewallSessionTraceInfo sessionInfo = new BDDFirewallSessionTraceInfo( FW, ImmutableSet.of(FW_I1), new ForwardOutInterface(FW_I1, null), sessionHeaders, IDENTITY); assertThat(nodeDropAclOutEdges(sessionInfo), empty()); _fwI1.setFirewallSessionInterfaceInfo( new FirewallSessionInterfaceInfo(false, ImmutableList.of(FW_I1), null, PERMIT_TCP)); assertThat( nodeDropAclOutEdges(sessionInfo), contains( edge( new PreInInterface(FW, FW_I1), new NodeDropAclOut(FW), allOf( mapsForward(srcFwI1, sessionHeaders.and(_permitTcpBdd.not())), mapsBackward(ONE, validSrc.and(sessionHeaders).and(_permitTcpBdd.not())))))); _fwI1.setFirewallSessionInterfaceInfo(null); }
@VisibleForTesting Stream<Edge> nodeDropAclOutEdges(BDDFirewallSessionTraceInfo sessionInfo) { if (_filterBdds == null) { return Stream.of(); } return sessionInfo .getAction() .accept( new SessionActionVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitAcceptVrf(Accept acceptVrf) { return Stream.of(); } @Override public Stream<Edge> visitFibLookup(FibLookup fibLookup) { return Stream.of(); } @Override public Stream<Edge> visitForwardOutInterface( ForwardOutInterface forwardOutInterface) { String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new NodeDropAclOut(hostname); BDD sessionFlows = sessionInfo.getSessionFlows(); Transition denyOutAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface).not()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), denyOutAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr)); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } }); }
SessionInstrumentation { @VisibleForTesting Stream<Edge> nodeDropAclOutEdges(BDDFirewallSessionTraceInfo sessionInfo) { if (_filterBdds == null) { return Stream.of(); } return sessionInfo .getAction() .accept( new SessionActionVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitAcceptVrf(Accept acceptVrf) { return Stream.of(); } @Override public Stream<Edge> visitFibLookup(FibLookup fibLookup) { return Stream.of(); } @Override public Stream<Edge> visitForwardOutInterface( ForwardOutInterface forwardOutInterface) { String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new NodeDropAclOut(hostname); BDD sessionFlows = sessionInfo.getSessionFlows(); Transition denyOutAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface).not()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), denyOutAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr)); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } }); } }
SessionInstrumentation { @VisibleForTesting Stream<Edge> nodeDropAclOutEdges(BDDFirewallSessionTraceInfo sessionInfo) { if (_filterBdds == null) { return Stream.of(); } return sessionInfo .getAction() .accept( new SessionActionVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitAcceptVrf(Accept acceptVrf) { return Stream.of(); } @Override public Stream<Edge> visitFibLookup(FibLookup fibLookup) { return Stream.of(); } @Override public Stream<Edge> visitForwardOutInterface( ForwardOutInterface forwardOutInterface) { String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new NodeDropAclOut(hostname); BDD sessionFlows = sessionInfo.getSessionFlows(); Transition denyOutAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface).not()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), denyOutAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr)); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } }); } @VisibleForTesting  SessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      @Nullable Map<String, Map<String, Supplier<BDD>>> filterBdds); }
SessionInstrumentation { @VisibleForTesting Stream<Edge> nodeDropAclOutEdges(BDDFirewallSessionTraceInfo sessionInfo) { if (_filterBdds == null) { return Stream.of(); } return sessionInfo .getAction() .accept( new SessionActionVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitAcceptVrf(Accept acceptVrf) { return Stream.of(); } @Override public Stream<Edge> visitFibLookup(FibLookup fibLookup) { return Stream.of(); } @Override public Stream<Edge> visitForwardOutInterface( ForwardOutInterface forwardOutInterface) { String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new NodeDropAclOut(hostname); BDD sessionFlows = sessionInfo.getSessionFlows(); Transition denyOutAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface).not()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), denyOutAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr)); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } }); } @VisibleForTesting  SessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      @Nullable Map<String, Map<String, Supplier<BDD>>> filterBdds); static Stream<Edge> sessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      Map<String, Map<String, Supplier<BDD>>> filterBdds,
      Stream<Edge> originalEdges,
      Map<String, List<BDDFirewallSessionTraceInfo>> initializedSessions,
      BDDFibGenerator bddFibGenerator); }
SessionInstrumentation { @VisibleForTesting Stream<Edge> nodeDropAclOutEdges(BDDFirewallSessionTraceInfo sessionInfo) { if (_filterBdds == null) { return Stream.of(); } return sessionInfo .getAction() .accept( new SessionActionVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitAcceptVrf(Accept acceptVrf) { return Stream.of(); } @Override public Stream<Edge> visitFibLookup(FibLookup fibLookup) { return Stream.of(); } @Override public Stream<Edge> visitForwardOutInterface( ForwardOutInterface forwardOutInterface) { String outIface = forwardOutInterface.getOutgoingInterface(); String hostname = sessionInfo.getHostname(); BDDSourceManager srcMgr = _srcMgrs.get(hostname); BDDOutgoingOriginalFlowFilterManager outgoingOriginalFlowFilterMgr = _outgoingOriginalFlowFilterMgrs.get(hostname); StateExpr postState = new NodeDropAclOut(hostname); BDD sessionFlows = sessionInfo.getSessionFlows(); Transition denyOutAcl = constraint(getOutgoingSessionFilterBdd(hostname, outIface).not()); return sessionInfo .getSessionScope() .accept( new SessionScopeVisitor<Stream<Edge>>() { @Override public Stream<Edge> visitIncomingSessionScope( IncomingSessionScope incomingSessionScope) { return incomingSessionScope.getIncomingInterfaces().stream() .map( inIface -> { StateExpr preState = new PreInInterface(hostname, inIface); BDD inAclBdd = getIncomingSessionFilterBdd(hostname, inIface); Transition transition = compose( constraint(sessionFlows.and(inAclBdd)), sessionInfo.getTransformation(), denyOutAcl, removeNodeSpecificConstraints( hostname, _lastHopMgr, outgoingOriginalFlowFilterMgr, srcMgr)); if (transition == Zero.INSTANCE) { return null; } return new Edge(preState, postState, transition); }) .filter(Objects::nonNull); } @Override public Stream<Edge> visitOriginatingSessionScope( OriginatingSessionScope originatingSessionScope) { throw new BatfishException( String.format( "Unexpected SessionScope: Originating from VRF %s", originatingSessionScope.getOriginatingVrf())); } }); } }); } @VisibleForTesting  SessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      @Nullable Map<String, Map<String, Supplier<BDD>>> filterBdds); static Stream<Edge> sessionInstrumentation(
      BDDPacket bddPacket,
      Map<String, Configuration> configs,
      Map<String, BDDSourceManager> srcMgrs,
      LastHopOutgoingInterfaceManager lastHopMgr,
      Map<String, BDDOutgoingOriginalFlowFilterManager> outgoingOriginalFlowFilterMgrs,
      Map<String, Map<String, Supplier<BDD>>> filterBdds,
      Stream<Edge> originalEdges,
      Map<String, List<BDDFirewallSessionTraceInfo>> initializedSessions,
      BDDFibGenerator bddFibGenerator);  }