Skip to content

Commit d84416f

Browse files
ShiriMoranShiriMoran
authored
851 lint aws tests (#884)
1 parent 64b9945 commit d84416f

File tree

4 files changed

+136
-0
lines changed

4 files changed

+136
-0
lines changed

‎pkg/awsvpc/examples/out/lint_out/aws_acl1_Lint

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
"Blocked TCP response" issues:
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
In the connection from "prod_vpc/proxy1[10.240.0.9]" to "prod_vpc/proxy2[10.240.2.24]" TCP src-ports: 1-9079,9081-65535 response is blocked
4+
________________________________________________________________________________________________________________________________________________________________________________________________________
5+
6+
"Network ACL rules shadowed by higher priority rules" issues:
7+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
8+
In VPC "VpcId:42", network ACL "NetworkAclId:45" rule is shadowed by a higher priority rule
9+
Rule details: ruleNumber: 32767, action: deny, direction: inbound, cidr: 0.0.0.0/0, protocol: all
10+
Shadowing rule: ruleNumber: 100, action: allow, direction: inbound, cidr: 0.0.0.0/0, protocol: all
11+
12+
In VPC "VpcId:42", network ACL "NetworkAclId:45" rule is shadowed by a higher priority rule
13+
Rule details: ruleNumber: 32767, action: deny, direction: outbound, cidr: 0.0.0.0/0, protocol: all
14+
Shadowing rule: ruleNumber: 100, action: allow, direction: outbound, cidr: 0.0.0.0/0, protocol: all
15+
16+
In VPC "prod_vpc", network ACL "NetworkAclId:54" rule is shadowed by a higher priority rule
17+
Rule details: ruleNumber: 32767, action: deny, direction: inbound, cidr: 0.0.0.0/0, protocol: all
18+
Shadowing rule: ruleNumber: 100, action: allow, direction: inbound, cidr: 0.0.0.0/0, protocol: all
19+
20+
... (1 more)
21+
22+
________________________________________________________________________________________________________________________________________________________________________________________________________
23+
24+
"SG not applied to any resources" issues:
25+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
26+
In VPC "VpcId:42", security group "GroupId:58" has no resources attached to it
27+
In VPC "prod_vpc", security group "GroupId:61" has no resources attached to it

‎pkg/awsvpc/examples/out/lint_out/aws_mixed_Lint

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
"Blocked TCP response" issues:
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
In the connection from "Public Internet 147.235.0.0/16" to "mixed/p1[10.240.3.70]" TCP src-ports: 1-1024,5001-65535 dst-ports: 9080 response is blocked
4+
In the connection from "Public Internet 147.235.0.0/16" to "mixed/p3[10.240.0.96]" TCP src-ports: 1-1024,5001-65535 dst-ports: 9080 response is blocked
5+
In the connection from "mixed/p1[10.240.3.70]" to "Public Internet 147.235.0.0/16" TCP src-ports: 1-9079,9081-65535 dst-ports: 1025-5000 response is blocked
6+
... (1 more)
7+
8+
________________________________________________________________________________________________________________________________________________________________________________________________________
9+
10+
"Network ACL not applied to any resources" issues:
11+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12+
In VPC "mixed", network ACL "NetworkAclId:45" has no resources attached to it
13+
________________________________________________________________________________________________________________________________________________________________________________________________________
14+
15+
"Network ACL rules shadowed by higher priority rules" issues:
16+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
17+
In VPC "VpcId:44", network ACL "NetworkAclId:46" rule is shadowed by a higher priority rule
18+
Rule details: ruleNumber: 32767, action: deny, direction: inbound, cidr: 0.0.0.0/0, protocol: all
19+
Shadowing rule: ruleNumber: 100, action: allow, direction: inbound, cidr: 0.0.0.0/0, protocol: all
20+
21+
In VPC "VpcId:44", network ACL "NetworkAclId:46" rule is shadowed by a higher priority rule
22+
Rule details: ruleNumber: 32767, action: deny, direction: outbound, cidr: 0.0.0.0/0, protocol: all
23+
Shadowing rule: ruleNumber: 100, action: allow, direction: outbound, cidr: 0.0.0.0/0, protocol: all
24+
25+
In VPC "mixed", network ACL "NetworkAclId:45" rule is shadowed by a higher priority rule
26+
Rule details: ruleNumber: 32767, action: deny, direction: inbound, cidr: 0.0.0.0/0, protocol: all
27+
Shadowing rule: ruleNumber: 100, action: allow, direction: inbound, cidr: 0.0.0.0/0, protocol: all
28+
29+
... (1 more)
30+
31+
________________________________________________________________________________________________________________________________________________________________________________________________________
32+
33+
"SG not applied to any resources" issues:
34+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
35+
In VPC "VpcId:44", security group "GroupId:60" has no resources attached to it
36+
In VPC "mixed", security group "GroupId:57" has no resources attached to it

‎pkg/awsvpc/examples/out/lint_out/aws_sg_1_Lint

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
"SGs implying different connectivity for endpoints inside a subnet" issues:
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
In VPC "vpc0", security group "GroupId:27" rule splits subnet "application" (10.240.20.0/24).
4+
Rule details: Inbound index: 0, direction: inbound, target: 10.240.20.43/32, 10.240.20.245/32, 10.240.40.0/24, protocol: all
5+
In VPC "vpc0", security group "GroupId:42" rule splits subnet "db" (10.240.30.0/24).
6+
Rule details: Outbound index: 0, direction: outbound, target: 10.240.30.33, protocol: tcp, dstPorts: 0-65535
7+
In VPC "vpc0", security group "GroupId:42" rule splits subnet "edge" (10.240.10.0/24).
8+
Rule details: Inbound index: 1, direction: inbound, target: 10.240.10.42, protocol: tcp, dstPorts: 9080-9080

‎pkg/awsvpc/lint_test.go

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
Copyright 2023- IBM Inc. All Rights Reserved.
3+
4+
SPDX-License-Identifier: Apache-2.0
5+
*/
6+
7+
package awsvpc
8+
9+
import (
10+
"fmt"
11+
"testing"
12+
13+
"github.com/np-guard/vpc-network-config-analyzer/pkg/commonvpc"
14+
)
15+
16+
var lintTests = []*commonvpc.VpcGeneralTest{
17+
{
18+
Name: "aws_acl1",
19+
InputConfig: "aws_acl_1",
20+
Enable: []string{"sg-split-subnet"},
21+
},
22+
{
23+
Name: "aws_mixed",
24+
InputConfig: "aws_mixed",
25+
Enable: []string{"sg-split-subnet"},
26+
},
27+
{
28+
Name: "aws_sg_1",
29+
InputConfig: "aws_sg_1",
30+
Enable: []string{"sg-split-subnet"},
31+
Disable: []string{"nacl-split-subnet", "subnet-cidr-overlap", "nacl-unattached",
32+
"sg-unattached", "sg-rule-cidr-out-of-range", "nacl-rule-cidr-out-of-range",
33+
"tcp-response-blocked", "sg-rule-implied", "nacl-rule-shadowed"},
34+
},
35+
}
36+
37+
func TestAllLint(t *testing.T) {
38+
// lintTests is the list of tests to run
39+
for testIdx := range lintTests {
40+
tt := lintTests[testIdx]
41+
tt.Mode = commonvpc.OutputComparison
42+
t.Run(tt.Name, func(t *testing.T) {
43+
t.Parallel()
44+
rc := &AWSresourcesContainer{}
45+
commonvpc.RunLintTest(tt, t, rc)
46+
})
47+
}
48+
fmt.Println("done")
49+
}
50+
51+
// uncomment the function below for generating the expected output files instead of comparing
52+
53+
/*func TestAllLintWithGeneration(t *testing.T) {
54+
// tests is the list of tests to run
55+
for testIdx := range lintTests {
56+
tt := lintTests[testIdx]
57+
tt.Mode = commonvpc.OutputGeneration
58+
t.Run(tt.Name, func(t *testing.T) {
59+
t.Parallel()
60+
rc := &AWSresourcesContainer{}
61+
commonvpc.RunLintTest(tt, t, rc)
62+
})
63+
}
64+
fmt.Println("done")
65+
}*/

0 commit comments

Comments
 (0)