Skip to content

Commit 1729926

Browse files
ShiriMoranShiriMoran
authored
539 explain subnet name (#858)
add option of providing subnet name/crn as source or destination
1 parent f05d416 commit 1729926

File tree

80 files changed

+447
-191
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+447
-191
lines changed

‎cmd/analyzer/expected_out/acl_testing3_detailed_explain.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 10.240.10.4 to vsi2-ky within test-vpc1-ky
2-
Interpreted source: vsi1-ky[10.240.10.4]
3-
Interpreted destination: vsi2-ky[10.240.20.4]
2+
Interpreted source(s): vsi1-ky[10.240.10.4]
3+
Interpreted destination(s): vsi2-ky[10.240.20.4]
44
=======================================================================
55

66
Connections from vsi1-ky[10.240.10.4] to vsi2-ky[10.240.20.4]: protocol: TCP,UDP

‎cmd/analyzer/subcmds/explain.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ const (
2727
dstMaxPortFlag = "dst-max-port"
2828
detailFlag = "detail"
2929

30-
srcDstUsage = "endpoint; can be specified as a VSI name/CRN or an internal/external IP-address/CIDR;\n" +
31-
"VSI name can be specified as <vsi-name> or <vpc-name>/<vsi-name>"
30+
srcDstUsage = "endpoint; can be specified as a VSI/subnet name/CRN or an internal/external IP-address/CIDR;\n" +
31+
"VSI/subnet name can be specified as <vsi-name/subnet-name> or as <vpc-name>/<vsi-name/subnet-name>"
3232
)
3333

3434
func NewExplainCommand(args *inArgs) *cobra.Command {

‎docs/vpcanalyzer_explain.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,10 @@ vpcanalyzer explain [flags]
2020
### Options
2121

2222
```
23-
--src string source endpoint for explanation; can be specified as a VSI name/CRN or an internal/external IP-address/CIDR;
24-
VSI name can be specified as <vsi-name> or <vpc-name>/<vsi-name>
25-
--dst string destination endpoint for explanation; can be specified as a VSI name/CRN or an internal/external IP-address/CIDR;
26-
VSI name can be specified as <vsi-name> or <vpc-name>/<vsi-name>
23+
--src string source endpoint for explanation; can be specified as a VSI/subnet name/CRN or as an internal/external IP-address/CIDR;
24+
VSI/subnet name can be specified as <vsi-name/subnet-name> or as <vpc-name>/<vsi-name/subnet-name>
25+
--dst string destination endpoint for explanation; can be specified as a VSI/subnet name/CRN or as an internal/external IP-address/CIDR;
26+
VSI/subnet name can be specified as <vsi-name/subnet-name> or as <vpc-name>/<vsi-name/subnet-name>
2727
--protocol string protocol for connection description
2828
--src-min-port int minimum source port for connection description (default 1)
2929
--src-max-port int maximum source port for connection description (default 65535)

‎pkg/awsvpc/examples/out/explain_out/from_external_public_subnet_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 147.235.0.0/16 to 10.240.0.96 within mixed
2-
Interpreted source: 147.235.0.0/16 (external)
3-
Interpreted destination: p3[10.240.0.96]
2+
Interpreted source(s): 147.235.0.0/16 (external)
3+
Interpreted destination(s): p3[10.240.0.96]
44
=======================================================================
55

66
Connections from Public Internet 147.235.0.0/16 to p3[10.240.0.96]: protocol: TCP dst-ports: 9080

‎pkg/awsvpc/examples/out/explain_out/ip_to_ip_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 10.240.40.217 to 10.240.20.43 within vpc0
2-
Interpreted source: dashboard[10.240.40.217]
3-
Interpreted destination: app2[10.240.20.43]
2+
Interpreted source(s): dashboard[10.240.40.217]
3+
Interpreted destination(s): app2[10.240.20.43]
44
======================================================================
55

66
Connections from dashboard[10.240.40.217] to app2[10.240.20.43]: All Connections

‎pkg/awsvpc/examples/out/explain_out/nacl_blocking_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 10.240.2.28 to 10.240.32.122 within mixed
2-
Interpreted source: p2[10.240.2.28]
3-
Interpreted destination: q2[10.240.32.122]
2+
Interpreted source(s): p2[10.240.2.28]
3+
Interpreted destination(s): q2[10.240.32.122]
44
======================================================================
55

66
No connections from p2[10.240.2.28] to q2[10.240.32.122];

‎pkg/awsvpc/examples/out/explain_out/same_subnet_partial_connection_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 10.240.32.122 to 10.240.32.91 within mixed
2-
Interpreted source: q2[10.240.32.122]
3-
Interpreted destination: q1[10.240.32.91]
2+
Interpreted source(s): q2[10.240.32.122]
3+
Interpreted destination(s): q1[10.240.32.91]
44
=======================================================================
55

66
Connections from q2[10.240.32.122] to q1[10.240.32.91]: protocol: UDP

‎pkg/awsvpc/examples/out/explain_out/subnet_to_subnet_all_vpcs_explain_detail.txt

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
Explaining connectivity from private2 to private1 within mixed
2+
Interpreted source(s): r1[10.240.48.198]
3+
Interpreted destination(s): q2[10.240.32.122], q1[10.240.32.91]
4+
==============================================================
5+
6+
Connections from r1[10.240.48.198] to q1[10.240.32.91]: No Connections
7+
8+
Path:
9+
r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 ->
10+
subnet private1 -> network ACL acl1 -> security group GroupId:15 -> q1[10.240.32.91]
11+
12+
13+
Details:
14+
~~~~~~~~
15+
Path is disabled; The relevant rules are:
16+
Egress:
17+
security group GroupId:22 allows connection with the following allow rules
18+
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: tcp, dstPorts: 9080-9080
19+
network ACL acl1 allows connection with the following allow rules
20+
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
21+
22+
Ingress:
23+
network ACL acl1 allows connection with the following allow rules
24+
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
25+
security group GroupId:15 allows connection with the following allow rules
26+
Inbound index: 0, direction: inbound, target: 0.0.0.0/0, protocol: udp, dstPorts: 0-65535
27+
28+
------------------------------------------------------------------------------------------------------------------------
29+
30+
Connections from r1[10.240.48.198] to q2[10.240.32.122]: protocol: TCP dst-ports: 9080
31+
32+
Path:
33+
r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 ->
34+
subnet private1 -> network ACL acl1 -> security group GroupId:9 -> q2[10.240.32.122]
35+
36+
37+
Details:
38+
~~~~~~~~
39+
Path is enabled; The relevant rules are:
40+
Egress:
41+
security group GroupId:22 allows connection with the following allow rules
42+
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: tcp, dstPorts: 9080-9080
43+
network ACL acl1 allows connection with the following allow rules
44+
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
45+
46+
Ingress:
47+
network ACL acl1 allows connection with the following allow rules
48+
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
49+
security group GroupId:9 allows connection with the following allow rules
50+
Inbound index: 0, direction: inbound, target: 10.240.0.0/18, protocol: all
51+
52+
TCP response is enabled; The relevant rules are:
53+
Egress:
54+
network ACL acl1 allows connection with the following allow rules
55+
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
56+
57+
Ingress:
58+
network ACL acl1 allows connection with the following allow rules
59+
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
60+
61+
------------------------------------------------------------------------------------------------------------------------
62+

‎pkg/awsvpc/examples/out/explain_out/to_external_blocked_only_private_subnet_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 10.240.20.245 to 161.26.0.0 within vpc0
2-
Interpreted source: app1[10.240.20.245]
3-
Interpreted destination: 161.26.0.0 (external)
2+
Interpreted source(s): app1[10.240.20.245]
3+
Interpreted destination(s): 161.26.0.0 (external)
44
====================================================================
55

66
No connections from app1[10.240.20.245] to Public Internet 161.26.0.0/32;

‎pkg/awsvpc/examples/out/explain_out/to_external_private_subnet_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Explaining connectivity from 10.240.20.245 to 161.26.0.0 within vpc0
2-
Interpreted source: app1[10.240.20.245]
3-
Interpreted destination: 161.26.0.0 (external)
2+
Interpreted source(s): app1[10.240.20.245]
3+
Interpreted destination(s): 161.26.0.0 (external)
44
====================================================================
55

66
No connections from app1[10.240.20.245] to Public Internet 161.26.0.0/32;

0 commit comments

Comments
 (0)