private IpSpace computeOwnedIps() { try (ActiveSpan span = GlobalTracer.get().buildSpan("ForwardingAnalysisImpl.computeOwnedIps").startActive()) { assert span != null; // avoid unused warning return IpWildcardSetIpSpace.builder() .including( _interfaceOwnedIps.values().stream() .flatMap(ifaceMap -> ifaceMap.values().stream()) .flatMap(Collection::stream) .map(IpWildcard::new) .collect(Collectors.toList())) .build(); } }
ipWildcardSetIpSpace.getWhitelist().stream() .filter( whitelistedIpWildcard -> ipWildcardSetIpSpace.getBlacklist().stream() .noneMatch(whitelistedIpWildcard::subsetOf)) .collect(Collectors.toSet()); ipWildcardSetIpSpace.getBlacklist().stream() .filter( blacklistedIpWildcard -> { return IpWildcardSetIpSpace.builder().including(whitelist).excluding(blacklist).build();
@Override public String visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { String metadataDescription = computeMetadataDescription(ipWildcardSetIpSpace); if (metadataDescription != null) { return metadataDescription; } return ipWildcardSetIpSpace.toString(); }
@Override public Void visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { ipWildcardSetIpSpace.getWhitelist().forEach(this::assertIpWildcardIsPrefix); ipWildcardSetIpSpace.getBlacklist().forEach(this::assertIpWildcardIsPrefix); ipWildcardSetIpSpace.getWhitelist().stream().map(IpWildcard::toPrefix).forEach(_prefixes::add); ipWildcardSetIpSpace.getBlacklist().stream() .map(IpWildcard::toPrefix) .forEach(_notPrefixes::add); return null; }
@Test public void resolveIpSpaceTest() { String prefix = "3.3.3.3/24"; SpecifiersQuestion questionWithIp = new SpecifiersQuestion(QueryType.LOCATION); questionWithIp.setIpSpaceSpecifierInput(prefix); // both interfacelocations should be mapped to 3.3.3.3/24 assertThat( resolveIpSpace(questionWithIp, _context).getRows().getData(), equalTo( ImmutableMultiset.of( Row.of( COL_IP_SPACE, IpWildcardSetIpSpace.builder() .including(new IpWildcard(prefix)) .build() .toString())))); }
@Override public Boolean visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { return ipWildcardSetIpSpace.getWhitelist().stream().allMatch(_ipWildcard::supersetOf); }
public IpWildcardSetIpSpace build() { return new IpWildcardSetIpSpace(_blacklistBuilder.build(), _whitelistBuilder.build()); }
/** * Returns all {@link IpsecPeerConfigId}s whose local IP is equal to any of the IPs behind * destinationIp after NAT */ @Nonnull private static Set<IpsecPeerConfigId> getCandidatePeersBehindNat( @Nonnull Ip destinationIp, @Nonnull SetMultimap<Ip, IpWildcardSetIpSpace> privateIpsByPublicIp, @Nonnull Map<Ip, Set<IpsecPeerConfigId>> localIpsAndIpsecPeers) { ImmutableSet.Builder<IpsecPeerConfigId> candidateNeighbors = ImmutableSet.builder(); Set<IpWildcardSetIpSpace> privateIpsBehindDestIp = privateIpsByPublicIp.get(destinationIp); if (privateIpsBehindDestIp == null) { return candidateNeighbors.build(); } for (IpWildcardSetIpSpace ipWildcardSetIpSpace : privateIpsBehindDestIp) { for (Entry<Ip, Set<IpsecPeerConfigId>> entry : localIpsAndIpsecPeers.entrySet()) { if (ipWildcardSetIpSpace.containsIp(entry.getKey(), ImmutableMap.of())) { candidateNeighbors.addAll(entry.getValue()); } } } return candidateNeighbors.build(); }
@Override public Boolean visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { return ipWildcardSetIpSpace.getBlacklist().stream().noneMatch(_ipWildcard::subsetOf) && ipWildcardSetIpSpace.getWhitelist().stream().anyMatch(_ipWildcard::intersects); }
public static SortedSet<IpWildcard> asPositiveIpWildcards(IpSpace ipSpace) { // TODO use an IpSpace visitor if (ipSpace == null) { return null; } else if (ipSpace instanceof IpWildcardIpSpace) { return ImmutableSortedSet.of(((IpWildcardIpSpace) ipSpace).getIpWildcard()); } else if (ipSpace instanceof IpWildcardSetIpSpace) { return ((IpWildcardSetIpSpace) ipSpace).getWhitelist(); } else if (ipSpace instanceof UniverseIpSpace) { return ImmutableSortedSet.of(); } else { throw new BatfishException( String.format("Cannot represent as SortedSet<IpWildcard>: %s", ipSpace)); } }
IpSpace getRoutableIps() { IpWildcardSetIpSpace.Builder builder = IpWildcardSetIpSpace.builder(); _root.addRoutableIps(builder); return builder.build(); } }
@Override public IpSpace visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { Set<IpSpace> blacklistIpSpace = ipWildcardSetIpSpace.getBlacklist().stream() .map(this::specialize) .filter(ipSpace -> ipSpace != EmptyIpSpace.INSTANCE) ipWildcardSetIpSpace.getWhitelist().stream() .map(refinedSpecializer::specialize) .filter(ipSpace -> ipSpace != EmptyIpSpace.INSTANCE) return UniverseIpSpace.INSTANCE; } else { return IpWildcardSetIpSpace.builder() .including(IpWildcard.ANY) .excluding(blacklist) .map(IpWildcardIpSpace::getIpWildcard) .collect(Collectors.toSet()); return IpWildcardSetIpSpace.builder() .including(ipWildcardWhitelist) .excluding(blacklist)
@Override public Boolean visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { /* Need to be careful not to give a false-negative here. We can return false only * if we're completely sure that ipWildcardSetIpSpace containsIp _ipWildcard. */ return ipWildcardSetIpSpace.getBlacklist().stream().anyMatch(_ipWildcard::subsetOf) || ipWildcardSetIpSpace.getWhitelist().stream().noneMatch(_ipWildcard::subsetOf); }
public static SortedSet<IpWildcard> asNegativeIpWildcards(IpSpace ipSpace) { // TODO use an IpSpace visitor if (ipSpace == null) { return null; } else if (ipSpace instanceof IpWildcardIpSpace) { return ImmutableSortedSet.of(((IpWildcardIpSpace) ipSpace).getIpWildcard()); } else if (ipSpace instanceof IpWildcardSetIpSpace) { return ((IpWildcardSetIpSpace) ipSpace).getWhitelist(); } else if (ipSpace instanceof EmptyIpSpace) { return ImmutableSortedSet.of(); } else { throw new BatfishException( String.format("Cannot represent as SortedSet<IpWildcard>: %s", ipSpace)); } }
public Builder setDstIps(Iterable<IpWildcard> dstIps) { _dstIps = IpWildcardSetIpSpace.builder().including(dstIps).build(); return this; }
@Override public BDD visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { BDD whitelist = _bddOps.or( ipWildcardSetIpSpace.getWhitelist().stream() .map(this::toBDD) .collect(Collectors.toList())); BDD blacklist = _bddOps.or( ipWildcardSetIpSpace.getBlacklist().stream() .map(this::toBDD) .collect(Collectors.toList())); return whitelist.and(blacklist.not()); }
public Builder setNotDstIps(Iterable<IpWildcard> notDstIps) { _notDstIps = IpWildcardSetIpSpace.builder().including(notDstIps).build(); return this; }
@Override public BoolExpr visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { BoolExpr whitelistExpr = _context.mkOr( ipWildcardSetIpSpace.getWhitelist().stream() .map(this::toBoolExpr) .toArray(BoolExpr[]::new)); BoolExpr blacklistExpr = _context.mkOr( ipWildcardSetIpSpace.getBlacklist().stream() .map(this::toBoolExpr) .toArray(BoolExpr[]::new)); return _context.mkAnd(whitelistExpr, _context.mkNot(blacklistExpr)); }
public Builder setNotSrcIps(Iterable<IpWildcard> notSrcIps) { _notSrcIps = IpWildcardSetIpSpace.builder().including(notSrcIps).build(); return this; }
@Override public BooleanExpr visitIpWildcardSetIpSpace(IpWildcardSetIpSpace ipWildcardSetIpSpace) { return matchAnyField( field -> { BooleanExpr matchBlacklist = HeaderSpaceMatchExpr.matchIpWildcards(ipWildcardSetIpSpace.getBlacklist(), field); BooleanExpr matchWhitelist = HeaderSpaceMatchExpr.matchIpWildcards(ipWildcardSetIpSpace.getWhitelist(), field); return new AndExpr(ImmutableList.of(new NotExpr(matchBlacklist), matchWhitelist)); }); }