Skip to content

Commit c38b012

Browse files
ShiriMoranShiriMoran
authored
859 explain empty intersection (#872)
1 parent 5194443 commit c38b012

File tree

39 files changed

+186
-148
lines changed

39 files changed

+186
-148
lines changed

‎pkg/awsvpc/examples/out/explain_out/nacl_blocking_all_vpcs_explain_detail.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): p2[10.240.2.28]
33
Interpreted destination(s): q2[10.240.32.122]
44
======================================================================
55

6-
No connections from p2[10.240.2.28] to q2[10.240.32.122];
6+
No connectivity from p2[10.240.2.28] to q2[10.240.32.122];
77
connection is blocked at ingress
88

99
Egress: security group GroupId:9 allows connection; network ACL acl1 allows connection

‎pkg/awsvpc/examples/out/explain_out/subnet_to_subnet_all_vpcs_explain_detail.txt

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,16 @@ Interpreted source(s): r1[10.240.48.198]
33
Interpreted destination(s): q2[10.240.32.122], q1[10.240.32.91]
44
==============================================================
55

6-
Connections from r1[10.240.48.198] to q1[10.240.32.91]: No Connections
6+
Connections from r1[10.240.48.198] to q2[10.240.32.122]: protocol: TCP dst-ports: 9080
77

88
Path:
99
r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 ->
10-
subnet private1 -> network ACL acl1 -> security group GroupId:15 -> q1[10.240.32.91]
10+
subnet private1 -> network ACL acl1 -> security group GroupId:9 -> q2[10.240.32.122]
1111

1212

1313
Details:
1414
~~~~~~~~
15-
Path is disabled; The relevant rules are:
15+
Path is enabled; The relevant rules are:
1616
Egress:
1717
security group GroupId:22 allows connection with the following allow rules
1818
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: tcp, dstPorts: 9080-9080
@@ -22,21 +22,32 @@ Path is disabled; The relevant rules are:
2222
Ingress:
2323
network ACL acl1 allows connection with the following allow rules
2424
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
25-
security group GroupId:15 allows connection with the following allow rules
26-
Inbound index: 0, direction: inbound, target: 0.0.0.0/0, protocol: udp, dstPorts: 0-65535
25+
security group GroupId:9 allows connection with the following allow rules
26+
Inbound index: 0, direction: inbound, target: 10.240.0.0/18, protocol: all
27+
28+
TCP response is enabled; The relevant rules are:
29+
Egress:
30+
network ACL acl1 allows connection with the following allow rules
31+
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
32+
33+
Ingress:
34+
network ACL acl1 allows connection with the following allow rules
35+
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
2736

2837
------------------------------------------------------------------------------------------------------------------------
2938

30-
Connections from r1[10.240.48.198] to q2[10.240.32.122]: protocol: TCP dst-ports: 9080
39+
No connectivity from r1[10.240.48.198] to q1[10.240.32.91];
40+
connectivity is blocked since traffic patterns allowed at ingress are disjoint from the traffic patterns allowed at egress.
41+
allowed egress traffic: protocol: TCP dst-ports: 9080, allowed ingress traffic: protocol: UDP
42+
43+
Egress: security group GroupId:22 allows connection; network ACL acl1 allows connection
44+
Ingress: network ACL acl1 allows connection; security group GroupId:15 allows connection
3145

32-
Path:
33-
r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 ->
34-
subnet private1 -> network ACL acl1 -> security group GroupId:9 -> q2[10.240.32.122]
3546

3647

3748
Details:
3849
~~~~~~~~
39-
Path is enabled; The relevant rules are:
50+
Path is disabled; The relevant rules are:
4051
Egress:
4152
security group GroupId:22 allows connection with the following allow rules
4253
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: tcp, dstPorts: 9080-9080
@@ -46,17 +57,8 @@ Path is enabled; The relevant rules are:
4657
Ingress:
4758
network ACL acl1 allows connection with the following allow rules
4859
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
49-
security group GroupId:9 allows connection with the following allow rules
50-
Inbound index: 0, direction: inbound, target: 10.240.0.0/18, protocol: all
51-
52-
TCP response is enabled; The relevant rules are:
53-
Egress:
54-
network ACL acl1 allows connection with the following allow rules
55-
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
56-
57-
Ingress:
58-
network ACL acl1 allows connection with the following allow rules
59-
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
60+
security group GroupId:15 allows connection with the following allow rules
61+
Inbound index: 0, direction: inbound, target: 0.0.0.0/0, protocol: udp, dstPorts: 0-65535
6062

6163
------------------------------------------------------------------------------------------------------------------------
6264

‎pkg/awsvpc/examples/out/explain_out/to_external_blocked_only_private_subnet_all_vpcs_explain_detail.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): app1[10.240.20.245]
33
Interpreted destination(s): 161.26.0.0 (external)
44
====================================================================
55

6-
No connections from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
6+
No connectivity from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
77
connection is blocked at egress
88

99
External traffic via InternetGateway: internet_gw

‎pkg/awsvpc/examples/out/explain_out/to_external_private_subnet_all_vpcs_explain_detail.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): app1[10.240.20.245]
33
Interpreted destination(s): 161.26.0.0 (external)
44
====================================================================
55

6-
No connections from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
6+
No connectivity from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
77
connection is blocked at egress
88

99
External traffic via InternetGateway: internet_gw

‎pkg/commonvpc/vpc.go

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -367,9 +367,9 @@ func (nl *NaclLayer) RulesInConnectivity(src, dst vpcmodel.Node,
367367
if err2 != nil {
368368
return nil, nil, err2
369369
}
370-
tableHasEffect := getTableEffect(connQuery, conn)
371-
appendToRulesInFilter(&allowRes, &allowRules, index, tableHasEffect, true)
372-
appendToRulesInFilter(&denyRes, &denyRules, index, tableHasEffect, false)
370+
tableConn, tableHasEffect := getTableConnEffect(connQuery, conn)
371+
appendToRulesInFilter(&allowRes, &allowRules, index, tableConn, tableHasEffect, true)
372+
appendToRulesInFilter(&denyRes, &denyRules, index, tableConn, tableHasEffect, false)
373373
}
374374
return allowRes, denyRes, nil
375375
}
@@ -379,7 +379,7 @@ func (nl *NaclLayer) Name() string {
379379
}
380380

381381
func appendToRulesInFilter(resRulesInFilter *[]vpcmodel.RulesInTable, rules *[]int, filterIndex int,
382-
tableEffect vpcmodel.TableEffect, isAllow bool) {
382+
tableConn *connection.Set, tableEffect vpcmodel.TableEffect, isAllow bool) {
383383
var rType vpcmodel.RulesType
384384
switch {
385385
case len(*rules) == 0:
@@ -393,6 +393,7 @@ func appendToRulesInFilter(resRulesInFilter *[]vpcmodel.RulesInTable, rules *[]i
393393
TableIndex: filterIndex,
394394
Rules: *rules,
395395
RulesOfType: rType,
396+
TableConn: tableConn,
396397
TableHasEffect: tableEffect,
397398
}
398399
*resRulesInFilter = append(*resRulesInFilter, rulesInNacl)
@@ -594,11 +595,13 @@ func (sgl *SecurityGroupLayer) RulesInConnectivity(src, dst vpcmodel.Node,
594595
rType = vpcmodel.NoRules
595596
}
596597
conn := sg.AllowedConnectivity(src, dst, isIngress)
598+
tableConn, tableHasEffect := getTableConnEffect(connQuery, conn)
597599
rulesInSg := vpcmodel.RulesInTable{
598600
TableIndex: index,
599601
Rules: sgRules,
600602
RulesOfType: rType,
601-
TableHasEffect: getTableEffect(connQuery, conn),
603+
TableConn: tableConn,
604+
TableHasEffect: tableHasEffect,
602605
}
603606
allowRes = append(allowRes, rulesInSg)
604607
}
@@ -718,19 +721,19 @@ func (sg *SecurityGroup) getMemberTargetStrAddress(src, dst vpcmodel.Node,
718721
return member.IPBlock(), target.IPBlock(), member.CidrOrAddress()
719722
}
720723

721-
func getTableEffect(connQuery, conn *connection.Set) vpcmodel.TableEffect {
724+
func getTableConnEffect(connQuery, conn *connection.Set) (*connection.Set, vpcmodel.TableEffect) {
722725
switch {
723726
case connQuery == nil: // connection not part of query
724727
if !conn.IsEmpty() {
725-
return vpcmodel.Allow
728+
return conn, vpcmodel.Allow
726729
} else {
727-
return vpcmodel.Deny
730+
return conn, vpcmodel.Deny
728731
}
729732
case conn.Intersect(connQuery).IsEmpty():
730-
return vpcmodel.Deny
733+
return connection.None(), vpcmodel.Deny
731734
case connQuery.ContainedIn(conn):
732-
return vpcmodel.Allow
735+
return connQuery, vpcmodel.Allow
733736
default:
734-
return vpcmodel.PartlyAllow
737+
return conn.Intersect(connQuery), vpcmodel.PartlyAllow
735738
}
736739
}

‎pkg/ibmvpc/examples/out/explain_out/GroupingExternalSG1_all_vpcs_explain.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Path:
1212

1313
------------------------------------------------------------------------------------------------------------------------
1414

15-
No connections from vsi1-ky[10.240.10.4] to Public Internet 161.0.0.0-161.25.255.255,161.27.0.0-161.255.255.255;
15+
No connectivity from vsi1-ky[10.240.10.4] to Public Internet 161.0.0.0-161.25.255.255,161.27.0.0-161.255.255.255;
1616
connection is blocked at egress
1717

1818
External traffic via PublicGateway: public-gw-ky

‎pkg/ibmvpc/examples/out/explain_out/GroupingExternalSG1_all_vpcs_explain_detail.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Path is enabled; The relevant rules are:
2222

2323
------------------------------------------------------------------------------------------------------------------------
2424

25-
No connections from vsi1-ky[10.240.10.4] to Public Internet 161.0.0.0-161.25.255.255,161.27.0.0-161.255.255.255;
25+
No connectivity from vsi1-ky[10.240.10.4] to Public Internet 161.0.0.0-161.25.255.255,161.27.0.0-161.255.255.255;
2626
connection is blocked at egress
2727

2828
External traffic via PublicGateway: public-gw-ky

‎pkg/ibmvpc/examples/out/explain_out/LBToResIPNode_all_vpcs_explain_detail.txt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potenti
33
Interpreted destination(s): iks-clusterid:1[192.168.32.5]
44
=================================================================================================================
55

6-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LB private IP][192.168.36.6] to iks-clusterid:1[192.168.32.5];
6+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LB private IP][192.168.36.6] to iks-clusterid:1[192.168.32.5];
77
connection is blocked by load balancer
88

99
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -36,7 +36,7 @@ Path is disabled; The relevant rules are:
3636

3737
------------------------------------------------------------------------------------------------------------------------
3838

39-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LB private IP][192.168.40.6] to iks-clusterid:1[192.168.32.5];
39+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LB private IP][192.168.40.6] to iks-clusterid:1[192.168.32.5];
4040
connection is blocked by load balancer
4141

4242
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -69,7 +69,7 @@ Path is disabled; The relevant rules are:
6969

7070
------------------------------------------------------------------------------------------------------------------------
7171

72-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.0.0/22] to iks-clusterid:1[192.168.32.5];
72+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.0.0/22] to iks-clusterid:1[192.168.32.5];
7373
connection is blocked by load balancer
7474

7575
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -102,7 +102,7 @@ Path is disabled; The relevant rules are:
102102

103103
------------------------------------------------------------------------------------------------------------------------
104104

105-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.16.0/22] to iks-clusterid:1[192.168.32.5];
105+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.16.0/22] to iks-clusterid:1[192.168.32.5];
106106
connection is blocked by load balancer
107107

108108
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -135,7 +135,7 @@ Path is disabled; The relevant rules are:
135135

136136
------------------------------------------------------------------------------------------------------------------------
137137

138-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.20.0/22] to iks-clusterid:1[192.168.32.5];
138+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.20.0/22] to iks-clusterid:1[192.168.32.5];
139139
connection is blocked by load balancer
140140

141141
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -168,7 +168,7 @@ Path is disabled; The relevant rules are:
168168

169169
------------------------------------------------------------------------------------------------------------------------
170170

171-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.24.0/22] to iks-clusterid:1[192.168.32.5];
171+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.24.0/22] to iks-clusterid:1[192.168.32.5];
172172
connection is blocked by load balancer
173173

174174
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -201,7 +201,7 @@ Path is disabled; The relevant rules are:
201201

202202
------------------------------------------------------------------------------------------------------------------------
203203

204-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.32.0-192.168.32.4,192.168.32.6-192.168.35.255] to iks-clusterid:1[192.168.32.5];
204+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.32.0-192.168.32.4,192.168.32.6-192.168.35.255] to iks-clusterid:1[192.168.32.5];
205205
connection is blocked by load balancer
206206

207207
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -230,7 +230,7 @@ Path is disabled; The relevant rules are:
230230

231231
------------------------------------------------------------------------------------------------------------------------
232232

233-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.4.0/22] to iks-clusterid:1[192.168.32.5];
233+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.4.0/22] to iks-clusterid:1[192.168.32.5];
234234
connection is blocked by load balancer
235235

236236
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member
@@ -263,7 +263,7 @@ Path is disabled; The relevant rules are:
263263

264264
------------------------------------------------------------------------------------------------------------------------
265265

266-
No connections from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.8.0/22] to iks-clusterid:1[192.168.32.5];
266+
No connectivity from kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[Potential LB private IP][192.168.8.0/22] to iks-clusterid:1[192.168.32.5];
267267
connection is blocked by load balancer
268268

269269
Load Balancer: kube-clusterid:1-8fdd1d0a2ce34deba99d0f885451b1ca[LoadBalancer] will not connect to iks-clusterid:1[192.168.32.5], since it is not its pool member

‎pkg/ibmvpc/examples/out/explain_out/NACLExternal2_all_vpcs_explain_detail.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): vsi1-ky[10.240.10.4]
33
Interpreted destination(s): 100.128.0.0/32 (external)
44
==========================================================================
55

6-
No connections from vsi1-ky[10.240.10.4] to Public Internet 100.128.0.0/32;
6+
No connectivity from vsi1-ky[10.240.10.4] to Public Internet 100.128.0.0/32;
77
connection is blocked at egress
88

99
External traffic via PublicGateway: public-gw-ky

‎pkg/ibmvpc/examples/out/explain_out/NACLExternal3_all_vpcs_explain.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): 100.128.0.0/32 (external)
33
Interpreted destination(s): vsi1-ky[10.240.10.4]
44
==========================================================================
55

6-
No connections from Public Internet 100.128.0.0/32 to vsi1-ky[10.240.10.4];
6+
No connectivity from Public Internet 100.128.0.0/32 to vsi1-ky[10.240.10.4];
77
connection is blocked at ingress and because there is no resource for external connectivity
88

99
Ingress: network ACL acl1-ky blocks connection; security group sg1-ky allows connection

0 commit comments

Comments
 (0)