@Test public void testBuildSecurityPolicyAcl_traceElement_fromZone() { JuniperConfiguration config = createConfig(); Zone zone = new Zone("toZone", null); ConcreteFirewallFilter crossZoneFilter = new ConcreteFirewallFilter("crossZonePolicy", Family.INET); crossZoneFilter.setFromZone("fromZone"); zone.getFromZonePolicies().put("crossZonePolicy", crossZoneFilter); config.buildSecurityPolicyAcl("acl", zone); IpAccessList acl = config._c.getIpAccessLists().get("acl"); assertNotNull(acl); assertThat(acl.getLines(), hasSize(3)); assertThat( acl.getLines().get(0).getTraceElement(), equalTo(TraceElement.of("Matched Juniper semantics on traffic originated from device"))); assertThat( acl.getLines().get(1).getTraceElement(), equalTo( TraceElement.builder() .add("Matched ") .add( "security policy from zone fromZone to zone toZone", new VendorStructureId( config.getFilename(), SECURITY_POLICY.getDescription(), zoneToZoneFilter("fromZone", "toZone"))) .build())); assertThat( acl.getLines().get(2).getTraceElement(), equalTo(TraceElement.of("Matched default policy"))); }
@VisibleForTesting IpAccessList buildSecurityPolicyAcl(String name, @Nullable Zone zone) { List<AclLine> zoneAclLines = new LinkedList<>(); zoneAclLines.add( new ExprAclLine( LineAction.PERMIT, OriginatingFromDevice.INSTANCE, "HOST_OUTBOUND", TraceElement.of("Matched Juniper semantics on traffic originated from device"))); if (zone != null && !zone.getFromZonePolicies().isEmpty()) { String toZone = zone.getName(); for (Entry<String, FirewallFilter> e : zone.getFromZonePolicies().entrySet()) { String filterName = e.getKey(); FirewallFilter filter = e.getValue(); String fromDesc = filter.getFromZone().map(s -> String.format("zone %s", s)).orElse("junos-host"); String policyDesc = String.format("security policy from %s to zone %s", fromDesc, toZone); String policyName = zoneToZoneFilter(filter.getFromZone().orElse("junos-host"), toZone); TraceElement traceElement = TraceElement.builder() .add("Matched ") .add( policyDesc, new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), policyName)) .build(); zoneAclLines.add(new AclAclLine("Match " + policyDesc, filterName, traceElement)); } } if (_masterLogicalSystem.getSecurityPolicies().get(ACL_NAME_GLOBAL_POLICY) != null) { zoneAclLines.add( new AclAclLine( "Match global security policy", ACL_NAME_GLOBAL_POLICY, TraceElement.builder() .add("Matched ") .add( "global security policy", new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), ACL_NAME_GLOBAL_POLICY)) .build())); } zoneAclLines.add( new ExprAclLine( _masterLogicalSystem.getDefaultCrossZoneAction(), TrueExpr.INSTANCE, "DEFAULT_POLICY", TraceElement.of("Matched default policy"))); IpAccessList zoneAcl = IpAccessList.builder().setName(name).setLines(zoneAclLines).build(); _c.getIpAccessLists().put(name, zoneAcl); return zoneAcl; }
JuniperConfiguration extends VendorConfiguration { @VisibleForTesting IpAccessList buildSecurityPolicyAcl(String name, @Nullable Zone zone) { List<AclLine> zoneAclLines = new LinkedList<>(); zoneAclLines.add( new ExprAclLine( LineAction.PERMIT, OriginatingFromDevice.INSTANCE, "HOST_OUTBOUND", TraceElement.of("Matched Juniper semantics on traffic originated from device"))); if (zone != null && !zone.getFromZonePolicies().isEmpty()) { String toZone = zone.getName(); for (Entry<String, FirewallFilter> e : zone.getFromZonePolicies().entrySet()) { String filterName = e.getKey(); FirewallFilter filter = e.getValue(); String fromDesc = filter.getFromZone().map(s -> String.format("zone %s", s)).orElse("junos-host"); String policyDesc = String.format("security policy from %s to zone %s", fromDesc, toZone); String policyName = zoneToZoneFilter(filter.getFromZone().orElse("junos-host"), toZone); TraceElement traceElement = TraceElement.builder() .add("Matched ") .add( policyDesc, new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), policyName)) .build(); zoneAclLines.add(new AclAclLine("Match " + policyDesc, filterName, traceElement)); } } if (_masterLogicalSystem.getSecurityPolicies().get(ACL_NAME_GLOBAL_POLICY) != null) { zoneAclLines.add( new AclAclLine( "Match global security policy", ACL_NAME_GLOBAL_POLICY, TraceElement.builder() .add("Matched ") .add( "global security policy", new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), ACL_NAME_GLOBAL_POLICY)) .build())); } zoneAclLines.add( new ExprAclLine( _masterLogicalSystem.getDefaultCrossZoneAction(), TrueExpr.INSTANCE, "DEFAULT_POLICY", TraceElement.of("Matched default policy"))); IpAccessList zoneAcl = IpAccessList.builder().setName(name).setLines(zoneAclLines).build(); _c.getIpAccessLists().put(name, zoneAcl); return zoneAcl; } }
JuniperConfiguration extends VendorConfiguration { @VisibleForTesting IpAccessList buildSecurityPolicyAcl(String name, @Nullable Zone zone) { List<AclLine> zoneAclLines = new LinkedList<>(); zoneAclLines.add( new ExprAclLine( LineAction.PERMIT, OriginatingFromDevice.INSTANCE, "HOST_OUTBOUND", TraceElement.of("Matched Juniper semantics on traffic originated from device"))); if (zone != null && !zone.getFromZonePolicies().isEmpty()) { String toZone = zone.getName(); for (Entry<String, FirewallFilter> e : zone.getFromZonePolicies().entrySet()) { String filterName = e.getKey(); FirewallFilter filter = e.getValue(); String fromDesc = filter.getFromZone().map(s -> String.format("zone %s", s)).orElse("junos-host"); String policyDesc = String.format("security policy from %s to zone %s", fromDesc, toZone); String policyName = zoneToZoneFilter(filter.getFromZone().orElse("junos-host"), toZone); TraceElement traceElement = TraceElement.builder() .add("Matched ") .add( policyDesc, new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), policyName)) .build(); zoneAclLines.add(new AclAclLine("Match " + policyDesc, filterName, traceElement)); } } if (_masterLogicalSystem.getSecurityPolicies().get(ACL_NAME_GLOBAL_POLICY) != null) { zoneAclLines.add( new AclAclLine( "Match global security policy", ACL_NAME_GLOBAL_POLICY, TraceElement.builder() .add("Matched ") .add( "global security policy", new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), ACL_NAME_GLOBAL_POLICY)) .build())); } zoneAclLines.add( new ExprAclLine( _masterLogicalSystem.getDefaultCrossZoneAction(), TrueExpr.INSTANCE, "DEFAULT_POLICY", TraceElement.of("Matched default policy"))); IpAccessList zoneAcl = IpAccessList.builder().setName(name).setLines(zoneAclLines).build(); _c.getIpAccessLists().put(name, zoneAcl); return zoneAcl; } JuniperConfiguration(); }
JuniperConfiguration extends VendorConfiguration { @VisibleForTesting IpAccessList buildSecurityPolicyAcl(String name, @Nullable Zone zone) { List<AclLine> zoneAclLines = new LinkedList<>(); zoneAclLines.add( new ExprAclLine( LineAction.PERMIT, OriginatingFromDevice.INSTANCE, "HOST_OUTBOUND", TraceElement.of("Matched Juniper semantics on traffic originated from device"))); if (zone != null && !zone.getFromZonePolicies().isEmpty()) { String toZone = zone.getName(); for (Entry<String, FirewallFilter> e : zone.getFromZonePolicies().entrySet()) { String filterName = e.getKey(); FirewallFilter filter = e.getValue(); String fromDesc = filter.getFromZone().map(s -> String.format("zone %s", s)).orElse("junos-host"); String policyDesc = String.format("security policy from %s to zone %s", fromDesc, toZone); String policyName = zoneToZoneFilter(filter.getFromZone().orElse("junos-host"), toZone); TraceElement traceElement = TraceElement.builder() .add("Matched ") .add( policyDesc, new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), policyName)) .build(); zoneAclLines.add(new AclAclLine("Match " + policyDesc, filterName, traceElement)); } } if (_masterLogicalSystem.getSecurityPolicies().get(ACL_NAME_GLOBAL_POLICY) != null) { zoneAclLines.add( new AclAclLine( "Match global security policy", ACL_NAME_GLOBAL_POLICY, TraceElement.builder() .add("Matched ") .add( "global security policy", new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), ACL_NAME_GLOBAL_POLICY)) .build())); } zoneAclLines.add( new ExprAclLine( _masterLogicalSystem.getDefaultCrossZoneAction(), TrueExpr.INSTANCE, "DEFAULT_POLICY", TraceElement.of("Matched default policy"))); IpAccessList zoneAcl = IpAccessList.builder().setName(name).setLines(zoneAclLines).build(); _c.getIpAccessLists().put(name, zoneAcl); return zoneAcl; } JuniperConfiguration(); static @Nonnull String computeFirewallFilterTermName(
      @Nonnull String filterName, @Nonnull String termName); static @Nonnull String computeSecurityPolicyTermName(
      @Nonnull String policyName, @Nonnull String termName); @VisibleForTesting static TraceElement matchingFirewallFilter(String filename, String filterName); @VisibleForTesting static TraceElement matchingFirewallFilterTerm(
      String filename, String filterName, String termName); @VisibleForTesting static TraceElement matchingSecurityPolicyTerm(
      String filename, String policyName, String termName); static String computePeerExportPolicyName(Prefix remoteAddress); static String computeOspfExportPolicyName(String vrfName); Map<String, NodeDevice> getNodeDevices(); @Override void setVendor(ConfigurationFormat format); static String computeContributorRouteFilterListName(Prefix prefix); static String computeAggregatedRouteGenerationPolicyName(Prefix prefix); static String computeGeneratedRouteGenerationPolicyName(Prefix prefix); static String computeIsisExportPolicyName(String routingInstanceName); @Override List<Configuration> toVendorIndependentConfigurations(); static String computeLogicalSystemDefaultHostname(
      String masterHostname, String logicalSystemName); @Nonnull Map<String, LogicalSystem> getLogicalSystems(); LogicalSystem getMasterLogicalSystem(); @Override String getHostname(); @Override void setHostname(String hostname); }
JuniperConfiguration extends VendorConfiguration { @VisibleForTesting IpAccessList buildSecurityPolicyAcl(String name, @Nullable Zone zone) { List<AclLine> zoneAclLines = new LinkedList<>(); zoneAclLines.add( new ExprAclLine( LineAction.PERMIT, OriginatingFromDevice.INSTANCE, "HOST_OUTBOUND", TraceElement.of("Matched Juniper semantics on traffic originated from device"))); if (zone != null && !zone.getFromZonePolicies().isEmpty()) { String toZone = zone.getName(); for (Entry<String, FirewallFilter> e : zone.getFromZonePolicies().entrySet()) { String filterName = e.getKey(); FirewallFilter filter = e.getValue(); String fromDesc = filter.getFromZone().map(s -> String.format("zone %s", s)).orElse("junos-host"); String policyDesc = String.format("security policy from %s to zone %s", fromDesc, toZone); String policyName = zoneToZoneFilter(filter.getFromZone().orElse("junos-host"), toZone); TraceElement traceElement = TraceElement.builder() .add("Matched ") .add( policyDesc, new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), policyName)) .build(); zoneAclLines.add(new AclAclLine("Match " + policyDesc, filterName, traceElement)); } } if (_masterLogicalSystem.getSecurityPolicies().get(ACL_NAME_GLOBAL_POLICY) != null) { zoneAclLines.add( new AclAclLine( "Match global security policy", ACL_NAME_GLOBAL_POLICY, TraceElement.builder() .add("Matched ") .add( "global security policy", new VendorStructureId( _filename, JuniperStructureType.SECURITY_POLICY.getDescription(), ACL_NAME_GLOBAL_POLICY)) .build())); } zoneAclLines.add( new ExprAclLine( _masterLogicalSystem.getDefaultCrossZoneAction(), TrueExpr.INSTANCE, "DEFAULT_POLICY", TraceElement.of("Matched default policy"))); IpAccessList zoneAcl = IpAccessList.builder().setName(name).setLines(zoneAclLines).build(); _c.getIpAccessLists().put(name, zoneAcl); return zoneAcl; } JuniperConfiguration(); static @Nonnull String computeFirewallFilterTermName(
      @Nonnull String filterName, @Nonnull String termName); static @Nonnull String computeSecurityPolicyTermName(
      @Nonnull String policyName, @Nonnull String termName); @VisibleForTesting static TraceElement matchingFirewallFilter(String filename, String filterName); @VisibleForTesting static TraceElement matchingFirewallFilterTerm(
      String filename, String filterName, String termName); @VisibleForTesting static TraceElement matchingSecurityPolicyTerm(
      String filename, String policyName, String termName); static String computePeerExportPolicyName(Prefix remoteAddress); static String computeOspfExportPolicyName(String vrfName); Map<String, NodeDevice> getNodeDevices(); @Override void setVendor(ConfigurationFormat format); static String computeContributorRouteFilterListName(Prefix prefix); static String computeAggregatedRouteGenerationPolicyName(Prefix prefix); static String computeGeneratedRouteGenerationPolicyName(Prefix prefix); static String computeIsisExportPolicyName(String routingInstanceName); @Override List<Configuration> toVendorIndependentConfigurations(); static String computeLogicalSystemDefaultHostname(
      String masterHostname, String logicalSystemName); @Nonnull Map<String, LogicalSystem> getLogicalSystems(); LogicalSystem getMasterLogicalSystem(); @Override String getHostname(); @Override void setHostname(String hostname); static final String ACL_NAME_COMBINED_INCOMING; static final String ACL_NAME_GLOBAL_POLICY; static final String ACL_NAME_SCREEN; static final String ACL_NAME_SCREEN_INTERFACE; static final String ACL_NAME_SCREEN_ZONE; static final String ACL_NAME_SECURITY_POLICY; @VisibleForTesting static final int DEFAULT_ISIS_COST; }