Skip to content

Commit f9bbd6d

Browse files
olasaadi99olasaadi99
authored
Merge branch 'main' into 590_refactor
2 parents a9be1c9 + 64b9945 commit f9bbd6d

File tree

83 files changed

+7340
-429
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+7340
-429
lines changed

‎go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ go 1.22.4
44

55
require (
66
github.com/IBM/networking-go-sdk v0.49.0
7-
github.com/IBM/vpc-go-sdk v0.56.0
7+
github.com/IBM/vpc-go-sdk v0.57.0
88
github.com/aws/aws-sdk-go-v2/service/ec2 v1.163.0
99
github.com/np-guard/cloud-resource-collector v0.15.0
10-
github.com/np-guard/models v0.3.4
10+
github.com/np-guard/models v0.4.0
1111
github.com/spf13/cobra v1.8.1
1212
github.com/stretchr/testify v1.9.0
1313
)

‎go.sum

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ github.com/IBM/networking-go-sdk v0.49.0 h1:lPS34u3C0JVrbxH+Ulua76Nwl6Frv8BEfq6L
88
github.com/IBM/networking-go-sdk v0.49.0/go.mod h1:G9CKbmPE8gSLjN+ABh4hIZ1bMx076enl5Eekvj6zQnA=
99
github.com/IBM/platform-services-go-sdk v0.65.0 h1:SAk/Rsn2BLRmeU3z6YJm54TK23/9QJaOPjrjYNGBiPU=
1010
github.com/IBM/platform-services-go-sdk v0.65.0/go.mod h1:6rYd3stLSnotYmZlxclw45EJPaQuLmh5f7c+Mg7rOg4=
11-
github.com/IBM/vpc-go-sdk v0.56.0 h1:GVlehMD2rYxETF2S/OSIgPHW7xZlfNsz1C59YLTVPis=
12-
github.com/IBM/vpc-go-sdk v0.56.0/go.mod h1:BpIOxz9FRDsAY7NQFUYdxiPWjqvcRbBrw8fiAvzNqDE=
11+
github.com/IBM/vpc-go-sdk v0.57.0 h1:E8CPDpUE4z0cvvmFZzqUthMtGJx71Fne6vdvkjZdXfg=
12+
github.com/IBM/vpc-go-sdk v0.57.0/go.mod h1:swmxiYLT+OfBsBYqJWGeRd6NPmBk4u/het2PZdtzIaw=
1313
github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
1414
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
1515
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
@@ -165,12 +165,10 @@ github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
165165
github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
166166
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
167167
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
168-
github.com/np-guard/cloud-resource-collector v0.14.0 h1:MBPtPBYVCQoMfUkn/wODpF7SRpJ9TlOfMszO8N0PePo=
169-
github.com/np-guard/cloud-resource-collector v0.14.0/go.mod h1:klCHnNnuuVcCtGQHA7R1a8fqnvfMCk/5Jdld6V7sN2A=
170168
github.com/np-guard/cloud-resource-collector v0.15.0 h1:jkmxql6D1uBr/qmSOsBzUgeDxlUXSCe7dBKfqfK+QZ4=
171169
github.com/np-guard/cloud-resource-collector v0.15.0/go.mod h1:klCHnNnuuVcCtGQHA7R1a8fqnvfMCk/5Jdld6V7sN2A=
172-
github.com/np-guard/models v0.3.4 h1:HOhVi6wyGvo+KmYBnQ5Km5HYCF+/PQlDs1v7mL1v05g=
173-
github.com/np-guard/models v0.3.4/go.mod h1:mqE2Irf8r+7HWh8fII0fWbWyQRMHGEo2SgSLN/6VKs8=
170+
github.com/np-guard/models v0.4.0 h1:lU9XymcjwOJ5RQdVpziurqBmcLtlKVIQxVUwm+qMczk=
171+
github.com/np-guard/models v0.4.0/go.mod h1:mqE2Irf8r+7HWh8fII0fWbWyQRMHGEo2SgSLN/6VKs8=
174172
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
175173
github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
176174
github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=

‎pkg/awsvpc/examples/out/explain_out/from_external_public_subnet_all_vpcs_explain_detail.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ Path is enabled; The relevant rules are:
2121
ruleNumber: 32767, action: deny, direction: inbound, cidr: 0.0.0.0/0, protocol: all
2222
security group GroupId:35 allows connection with the following allow rules
2323
Inbound index: 0, direction: inbound, target: 147.0.0.0/8, protocol: tcp, dstPorts: 0-65535
24-
security group GroupId:9 has no relevant allow rules
25-
Ingress to public internet is allowed since subnet public is public
24+
security group GroupId:9 has no relevant rules
25+
Ingress from public internet is allowed since subnet public is public
2626

2727
TCP response is partly enabled; The relevant rules are:
2828
Egress:
29-
network ACL acl1 allows connection with the following allow and deny rules
29+
network ACL acl1 partly allows connection with the following allow and deny rules
3030
ruleNumber: 10, action: allow, direction: outbound, cidr: 147.235.0.0/16, protocol: tcp, dstPorts: 1025-5000
3131
ruleNumber: 32767, action: deny, direction: outbound, cidr: 0.0.0.0/0, protocol: all
3232

‎pkg/awsvpc/examples/out/explain_out/nacl_blocking_all_vpcs_explain_detail.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): p2[10.240.2.28]
33
Interpreted destination(s): q2[10.240.32.122]
44
======================================================================
55

6-
No connections from p2[10.240.2.28] to q2[10.240.32.122];
6+
No connectivity from p2[10.240.2.28] to q2[10.240.32.122];
77
connection is blocked at ingress
88

99
Egress: security group GroupId:9 allows connection; network ACL acl1 allows connection

‎pkg/awsvpc/examples/out/explain_out/subnet_to_subnet_all_vpcs_explain_detail.txt

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,16 @@ Interpreted source(s): r1[10.240.48.198]
33
Interpreted destination(s): q2[10.240.32.122], q1[10.240.32.91]
44
==============================================================
55

6-
Connections from r1[10.240.48.198] to q1[10.240.32.91]: No Connections
6+
Connections from r1[10.240.48.198] to q2[10.240.32.122]: protocol: TCP dst-ports: 9080
77

88
Path:
99
r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 ->
10-
subnet private1 -> network ACL acl1 -> security group GroupId:15 -> q1[10.240.32.91]
10+
subnet private1 -> network ACL acl1 -> security group GroupId:9 -> q2[10.240.32.122]
1111

1212

1313
Details:
1414
~~~~~~~~
15-
Path is disabled; The relevant rules are:
15+
Path is enabled; The relevant rules are:
1616
Egress:
1717
security group GroupId:22 allows connection with the following allow rules
1818
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: tcp, dstPorts: 9080-9080
@@ -22,21 +22,32 @@ Path is disabled; The relevant rules are:
2222
Ingress:
2323
network ACL acl1 allows connection with the following allow rules
2424
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
25-
security group GroupId:15 allows connection with the following allow rules
26-
Inbound index: 0, direction: inbound, target: 0.0.0.0/0, protocol: udp, dstPorts: 0-65535
25+
security group GroupId:9 allows connection with the following allow rules
26+
Inbound index: 0, direction: inbound, target: 10.240.0.0/18, protocol: all
27+
28+
TCP response is enabled; The relevant rules are:
29+
Egress:
30+
network ACL acl1 allows connection with the following allow rules
31+
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
32+
33+
Ingress:
34+
network ACL acl1 allows connection with the following allow rules
35+
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
2736

2837
------------------------------------------------------------------------------------------------------------------------
2938

30-
Connections from r1[10.240.48.198] to q2[10.240.32.122]: protocol: TCP dst-ports: 9080
39+
No connectivity from r1[10.240.48.198] to q1[10.240.32.91];
40+
connectivity is blocked since traffic patterns allowed at ingress are disjoint from the traffic patterns allowed at egress.
41+
allowed egress traffic: protocol: TCP dst-ports: 9080, allowed ingress traffic: protocol: UDP
42+
43+
Egress: security group GroupId:22 allows connection; network ACL acl1 allows connection
44+
Ingress: network ACL acl1 allows connection; security group GroupId:15 allows connection
3145

32-
Path:
33-
r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 ->
34-
subnet private1 -> network ACL acl1 -> security group GroupId:9 -> q2[10.240.32.122]
3546

3647

3748
Details:
3849
~~~~~~~~
39-
Path is enabled; The relevant rules are:
50+
Path is disabled; The relevant rules are:
4051
Egress:
4152
security group GroupId:22 allows connection with the following allow rules
4253
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: tcp, dstPorts: 9080-9080
@@ -46,17 +57,8 @@ Path is enabled; The relevant rules are:
4657
Ingress:
4758
network ACL acl1 allows connection with the following allow rules
4859
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
49-
security group GroupId:9 allows connection with the following allow rules
50-
Inbound index: 0, direction: inbound, target: 10.240.0.0/18, protocol: all
51-
52-
TCP response is enabled; The relevant rules are:
53-
Egress:
54-
network ACL acl1 allows connection with the following allow rules
55-
ruleNumber: 20, action: allow, direction: outbound, cidr: 10.240.32.0/19, protocol: all
56-
57-
Ingress:
58-
network ACL acl1 allows connection with the following allow rules
59-
ruleNumber: 20, action: allow, direction: inbound, cidr: 10.240.32.0/19, protocol: all
60+
security group GroupId:15 allows connection with the following allow rules
61+
Inbound index: 0, direction: inbound, target: 0.0.0.0/0, protocol: udp, dstPorts: 0-65535
6062

6163
------------------------------------------------------------------------------------------------------------------------
6264

‎pkg/awsvpc/examples/out/explain_out/to_external_blocked_only_private_subnet_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): app1[10.240.20.245]
33
Interpreted destination(s): 161.26.0.0 (external)
44
====================================================================
55

6-
No connections from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
6+
No connectivity from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
77
connection is blocked at egress
88

99
External traffic via InternetGateway: internet_gw
@@ -20,7 +20,7 @@ Path is disabled; The relevant rules are:
2020
Egress to public internet is blocked since subnet application is private
2121
security group GroupId:35 allows connection with the following allow rules
2222
Outbound index: 0, direction: outbound, target: 0.0.0.0/0, protocol: all
23-
security group GroupId:42 has no relevant allow rules
23+
security group GroupId:42 has no relevant rules
2424
network ACL NetworkAclId:65 allows connection with the following allow rules
2525
ruleNumber: 100, action: allow, direction: outbound, cidr: 0.0.0.0/0, protocol: all
2626

‎pkg/awsvpc/examples/out/explain_out/to_external_private_subnet_all_vpcs_explain_detail.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Interpreted source(s): app1[10.240.20.245]
33
Interpreted destination(s): 161.26.0.0 (external)
44
====================================================================
55

6-
No connections from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
6+
No connectivity from app1[10.240.20.245] to Public Internet 161.26.0.0/32;
77
connection is blocked at egress
88

99
External traffic via InternetGateway: internet_gw
@@ -18,7 +18,7 @@ Details:
1818
Path is disabled; The relevant rules are:
1919
Egress:
2020
Egress to public internet is blocked since subnet application is private
21-
security group GroupId:42 has no relevant allow rules
21+
security group GroupId:42 has no relevant rules
2222
network ACL NetworkAclId:65 allows connection with the following allow rules
2323
ruleNumber: 100, action: allow, direction: outbound, cidr: 0.0.0.0/0, protocol: all
2424

‎pkg/awsvpc/vpc.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,10 @@ func (igw *InternetGateway) StringOfRouterRules(listRulesInFilter []vpcmodel.Rul
8888
return "", nil
8989
}
9090

91+
func (igw *InternetGateway) IsMultipleVPCs() bool {
92+
return false
93+
}
94+
9195
// ////////////////////////////////////
9296
// todo - these two methods are duplicated from ibm/vpc.go needs to be reunion
9397
func isNodesPair(src, dst vpcmodel.VPCResourceIntf) (res bool, srcNode, dstNode vpcmodel.Node) {

‎pkg/commonvpc/vpc.go

Lines changed: 46 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -239,11 +239,11 @@ func (psr *privateSubnetRule) String(detail bool) string {
239239
return fmt.Sprintf("public subnet %s enables connection", psr.subnet.NameForAnalyzerOut())
240240
}
241241
// detail
242-
prefix := "Egress"
242+
prefix := "Egress to"
243243
if psr.isIngress {
244-
prefix = "Ingress"
244+
prefix = "Ingress from"
245245
}
246-
prefix += " to public internet is"
246+
prefix += " public internet is"
247247

248248
if psr.subnet.IsPrivate() {
249249
return fmt.Sprintf("%s blocked since subnet %s is private\n", prefix, psr.subnet.NameForAnalyzerOut())
@@ -353,18 +353,23 @@ func (nl *NaclLayer) AllowedConnectivity(src, dst vpcmodel.Node, isIngress bool)
353353

354354
// RulesInConnectivity list of NACL rules contributing to the connectivity
355355
func (nl *NaclLayer) RulesInConnectivity(src, dst vpcmodel.Node,
356-
conn *connection.Set, isIngress bool) (allowRes []vpcmodel.RulesInTable,
356+
connQuery *connection.Set, isIngress bool) (allowRes []vpcmodel.RulesInTable,
357357
denyRes []vpcmodel.RulesInTable, err error) {
358358
for index, nacl := range nl.NaclList {
359-
tableRelevant, allowRules, denyRules, err1 := nacl.rulesFilterInConnectivity(src, dst, conn, isIngress)
359+
tableRelevant, allowRules, denyRules, err1 := nacl.rulesFilterInConnectivity(src, dst, connQuery, isIngress)
360360
if err1 != nil {
361361
return nil, nil, err1
362362
}
363363
if !tableRelevant {
364364
continue
365365
}
366-
appendToRulesInFilter(&allowRes, &allowRules, index, true)
367-
appendToRulesInFilter(&denyRes, &denyRules, index, false)
366+
conn, err2 := nacl.AllowedConnectivity(src, dst, isIngress)
367+
if err2 != nil {
368+
return nil, nil, err2
369+
}
370+
tableConn, tableHasEffect := getTableConnEffect(connQuery, conn)
371+
appendToRulesInFilter(&allowRes, &allowRules, index, tableConn, tableHasEffect, true)
372+
appendToRulesInFilter(&denyRes, &denyRules, index, tableConn, tableHasEffect, false)
368373
}
369374
return allowRes, denyRes, nil
370375
}
@@ -373,7 +378,8 @@ func (nl *NaclLayer) Name() string {
373378
return ""
374379
}
375380

376-
func appendToRulesInFilter(resRulesInFilter *[]vpcmodel.RulesInTable, rules *[]int, filterIndex int, isAllow bool) {
381+
func appendToRulesInFilter(resRulesInFilter *[]vpcmodel.RulesInTable, rules *[]int, filterIndex int,
382+
tableConn *connection.Set, tableEffect vpcmodel.TableEffect, isAllow bool) {
377383
var rType vpcmodel.RulesType
378384
switch {
379385
case len(*rules) == 0:
@@ -384,9 +390,11 @@ func appendToRulesInFilter(resRulesInFilter *[]vpcmodel.RulesInTable, rules *[]i
384390
rType = vpcmodel.OnlyDeny
385391
}
386392
rulesInNacl := vpcmodel.RulesInTable{
387-
TableIndex: filterIndex,
388-
Rules: *rules,
389-
RulesOfType: rType,
393+
TableIndex: filterIndex,
394+
Rules: *rules,
395+
RulesOfType: rType,
396+
TableConn: tableConn,
397+
TableHasEffect: tableEffect,
390398
}
391399
*resRulesInFilter = append(*resRulesInFilter, rulesInNacl)
392400
}
@@ -571,13 +579,13 @@ func (sgl *SecurityGroupLayer) AllowedConnectivity(src, dst vpcmodel.Node, isIng
571579
}
572580

573581
// RulesInConnectivity return allow rules between src and dst,
574-
// or between src and dst of connection conn if conn specified
582+
// or between src and dst of connection connQuery if connQuery specified
575583
// denyRules not relevant here - returns nil
576584
func (sgl *SecurityGroupLayer) RulesInConnectivity(src, dst vpcmodel.Node,
577-
conn *connection.Set, isIngress bool) (allowRes []vpcmodel.RulesInTable,
585+
connQuery *connection.Set, isIngress bool) (allowRes []vpcmodel.RulesInTable,
578586
denyRes []vpcmodel.RulesInTable, err error) {
579587
for index, sg := range sgl.SgList {
580-
tableRelevant, sgRules, err1 := sg.rulesFilterInConnectivity(src, dst, conn, isIngress)
588+
tableRelevant, sgRules, err1 := sg.rulesFilterInConnectivity(src, dst, connQuery, isIngress)
581589
if err1 != nil {
582590
return nil, nil, err1
583591
}
@@ -586,10 +594,14 @@ func (sgl *SecurityGroupLayer) RulesInConnectivity(src, dst vpcmodel.Node,
586594
if len(sgRules) == 0 {
587595
rType = vpcmodel.NoRules
588596
}
597+
conn := sg.AllowedConnectivity(src, dst, isIngress)
598+
tableConn, tableHasEffect := getTableConnEffect(connQuery, conn)
589599
rulesInSg := vpcmodel.RulesInTable{
590-
TableIndex: index,
591-
Rules: sgRules,
592-
RulesOfType: rType,
600+
TableIndex: index,
601+
Rules: sgRules,
602+
RulesOfType: rType,
603+
TableConn: tableConn,
604+
TableHasEffect: tableHasEffect,
593605
}
594606
allowRes = append(allowRes, rulesInSg)
595607
}
@@ -708,3 +720,20 @@ func (sg *SecurityGroup) getMemberTargetStrAddress(src, dst vpcmodel.Node,
708720
// TODO: member is expected to be internal node (validate?) [could use member.(vpcmodel.InternalNodeIntf).Address()]
709721
return member.IPBlock(), target.IPBlock(), member.CidrOrAddress()
710722
}
723+
724+
func getTableConnEffect(connQuery, conn *connection.Set) (*connection.Set, vpcmodel.TableEffect) {
725+
switch {
726+
case connQuery == nil: // connection not part of query
727+
if !conn.IsEmpty() {
728+
return conn, vpcmodel.Allow
729+
} else {
730+
return conn, vpcmodel.Deny
731+
}
732+
case conn.Intersect(connQuery).IsEmpty():
733+
return connection.None(), vpcmodel.Deny
734+
case connQuery.ContainedIn(conn):
735+
return connQuery, vpcmodel.Allow
736+
default:
737+
return conn.Intersect(connQuery), vpcmodel.PartlyAllow
738+
}
739+
}

0 commit comments

Comments
 (0)