Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EndpointElem -> VPCResourceIntf #222

Merged
merged 29 commits into from
Nov 8, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
78401ee
structs and main functionality of https://github.com/np-guard/vpc-net…
ShiriMoran Oct 12, 2023
9a4f947
Highlevel code and structs
ShiriMoran Oct 15, 2023
15970f4
subnetConnectivitySubtract code; still needs to fill inside functiona…
ShiriMoran Oct 16, 2023
9400063
Redefined made the connection set diff and added todos
ShiriMoran Oct 17, 2023
bf18d01
Minor reorgs
ShiriMoran Oct 17, 2023
625fa41
Export SubnetConnectivityMap and enable external creation for unit test
ShiriMoran Oct 17, 2023
d2fbe4e
Added grouping subnet unittesting as preliminery stage to writing uni…
ShiriMoran Oct 18, 2023
823503e
exporting functionality for unit test; SubnetConnectivitySubtract sho…
ShiriMoran Oct 18, 2023
769eb7a
semantic diff simple unit test
ShiriMoran Oct 18, 2023
5a652cc
improved semantic diff computation
ShiriMoran Oct 18, 2023
f735908
fixed a bug/typo, added ad-hoc printing functionality
ShiriMoran Oct 18, 2023
20b4e98
unit test written for current functionality
ShiriMoran Oct 18, 2023
ce31dda
lint comments
ShiriMoran Oct 19, 2023
6b0897b
Merge remote-tracking branch 'origin/main'
ShiriMoran Oct 23, 2023
cdeff24
Merge remote-tracking branch 'origin/main'
ShiriMoran Oct 31, 2023
b9220e6
Merge remote-tracking branch 'origin/main'
ShiriMoran Nov 6, 2023
027d643
Merge remote-tracking branch 'origin/main'
ShiriMoran Nov 7, 2023
a6c60ee
parsing arguments for diff analysis
ShiriMoran Nov 1, 2023
30184db
Added end-to-end support for semantic diff of subnets
ShiriMoran Nov 2, 2023
8e1cedb
fix typo
ShiriMoran Nov 2, 2023
44c11d3
headerOfAnalyzedVPC to reflect diff
ShiriMoran Nov 5, 2023
146f8d6
added end-to-end test flow
ShiriMoran Nov 5, 2023
3658742
diff test added
ShiriMoran Nov 5, 2023
d9b1414
lint comments
ShiriMoran Nov 5, 2023
8f43305
somehow cherrypick missed it
ShiriMoran Nov 7, 2023
dcfc10d
EndpointElem -> VPCResourceIntf
ShiriMoran Nov 7, 2023
f315fb0
Merge remote-tracking branch 'origin/main'
ShiriMoran Nov 8, 2023
b56b789
merge with main
ShiriMoran Nov 8, 2023
dd6b897
fixing an error introduced by merge
ShiriMoran Nov 8, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkg/ibmvpc/vpc.go
Original file line number Diff line number Diff line change
Expand Up @@ -461,8 +461,8 @@ func (pgw *PublicGateway) ConnectivityMap() map[string]vpcmodel.ConfigBasedConne
res := map[string]vpcmodel.ConfigBasedConnectivityResults{}
for _, subnetCidr := range pgw.subnetCidr {
res[subnetCidr] = vpcmodel.ConfigBasedConnectivityResults{
IngressAllowedConns: map[vpcmodel.EndpointElem]*common.ConnectionSet{},
EgressAllowedConns: map[vpcmodel.EndpointElem]*common.ConnectionSet{},
IngressAllowedConns: map[vpcmodel.VPCResourceIntf]*common.ConnectionSet{},
EgressAllowedConns: map[vpcmodel.VPCResourceIntf]*common.ConnectionSet{},
}
for _, dst := range pgw.destinations {
res[subnetCidr].EgressAllowedConns[dst] = vpcmodel.AllConns()
Expand Down
30 changes: 15 additions & 15 deletions pkg/vpcmodel/semanticDiffSubnets.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ type connectionDiff struct {
diff DiffType
}

type SubnetsDiff map[EndpointElem]map[EndpointElem]*connectionDiff
type SubnetsDiff map[VPCResourceIntf]map[VPCResourceIntf]*connectionDiff

type ConfigsForDiff struct {
config1 *VPCConfig
Expand Down Expand Up @@ -83,9 +83,9 @@ func (configs ConfigsForDiff) GetSubnetsDiff(grouping bool) (*DiffBetweenSubnets
return res, nil
}

// for a given EndpointElem (representing a subnet or an external ip) in config return the EndpointElem representing the
// for a given VPCResourceIntf (representing a subnet or an external ip) in config return the VPCResourceIntf representing the
// subnet/external address in otherConfig or nil if the subnet does not exist in the other config.
func (c *VPCConfig) getEndpointElemInOtherConfig(other *VPCConfig, ep EndpointElem) (res EndpointElem, err error) {
func (c *VPCConfig) getVPCResourceInfInOtherConfig(other *VPCConfig, ep VPCResourceIntf) (res VPCResourceIntf, err error) {
if ep.IsExternal() {
var node Node
var ok bool
Expand All @@ -97,7 +97,7 @@ func (c *VPCConfig) getEndpointElemInOtherConfig(other *VPCConfig, ep EndpointEl
}
for _, nodeSet := range other.NodeSets {
if nodeSet.Name() == ep.Name() {
res = EndpointElem(nodeSet)
res = VPCResourceIntf(nodeSet)
return res, nil
}
}
Expand All @@ -108,21 +108,21 @@ func (c *VPCConfig) getEndpointElemInOtherConfig(other *VPCConfig, ep EndpointEl
// assumption: any connection from connectivity and "other" have src (dst) which are either disjoint or equal
func (subnetConfConnectivity *SubnetConfigConnectivity) subtract(other *SubnetConfigConnectivity) (
connectivitySubtract SubnetsDiff, err error) {
connectivitySubtract = map[EndpointElem]map[EndpointElem]*connectionDiff{}
connectivitySubtract = map[VPCResourceIntf]map[VPCResourceIntf]*connectionDiff{}
for src, endpointConns := range subnetConfConnectivity.subnetConnectivity {
for dst, conns := range endpointConns {
if conns.IsEmpty() {
continue
}
if _, ok := connectivitySubtract[src]; !ok {
connectivitySubtract[src] = map[EndpointElem]*connectionDiff{}
connectivitySubtract[src] = map[VPCResourceIntf]*connectionDiff{}
}
diffConnectionWithType := &connectionDiff{nil, NoDiff}
srcInOther, err1 := subnetConfConnectivity.config.getEndpointElemInOtherConfig(other.config, src)
srcInOther, err1 := subnetConfConnectivity.config.getVPCResourceInfInOtherConfig(other.config, src)
if err1 != nil {
return nil, err1
}
dstInOther, err2 := subnetConfConnectivity.config.getEndpointElemInOtherConfig(other.config, dst)
dstInOther, err2 := subnetConfConnectivity.config.getVPCResourceInfInOtherConfig(other.config, dst)
if err2 != nil {
return nil, err2
}
Expand Down Expand Up @@ -153,7 +153,7 @@ func (subnetConfConnectivity *SubnetConfigConnectivity) subtract(other *SubnetCo
// lack of a subnet is marked as a missing endpoint
// a lack of identical external endpoint is considered as a missing connection
// and not as a missing endpoint
func getDiffType(src, srcInOther, dst, dstInOther EndpointElem) DiffType {
func getDiffType(src, srcInOther, dst, dstInOther VPCResourceIntf) DiffType {
_, srcIsSubnet := src.(NodeSet)
_, dstIsSubnet := dst.(NodeSet)
missingSrc := srcInOther == nil && srcIsSubnet
Expand Down Expand Up @@ -321,7 +321,7 @@ func (subnetConnectivity *SubnetConnectivityMap) actualAlignSrcOrDstGivenIPBlist
// if src is external then for each IPBlock in disjointIPblocks copies dsts and connection type
// otherwise just copies as is
err = nil
alignedConnectivity = map[EndpointElem]map[EndpointElem]*common.ConnectionSet{}
alignedConnectivity = map[VPCResourceIntf]map[VPCResourceIntf]*common.ConnectionSet{}
for src, endpointConns := range *subnetConnectivity {
for dst, conns := range endpointConns {
if conns.IsEmpty() {
Expand All @@ -330,7 +330,7 @@ func (subnetConnectivity *SubnetConnectivityMap) actualAlignSrcOrDstGivenIPBlist
// the resizing element is not external - copy as is
if (resizeSrc && !src.IsExternal()) || (!resizeSrc && !dst.IsExternal()) {
if _, ok := alignedConnectivity[src]; !ok {
alignedConnectivity[src] = map[EndpointElem]*common.ConnectionSet{}
alignedConnectivity[src] = map[VPCResourceIntf]*common.ConnectionSet{}
}
alignedConnectivity[src][dst] = conns
continue
Expand Down Expand Up @@ -361,8 +361,8 @@ func (subnetConnectivity *SubnetConnectivityMap) actualAlignSrcOrDstGivenIPBlist
}

func addIPBlockToConnectivityMap(c *VPCConfig, disjointIPblocks []*common.IPBlock,
origIPBlock *common.IPBlock, alignedConnectivity map[EndpointElem]map[EndpointElem]*common.ConnectionSet,
src, dst EndpointElem, conns *common.ConnectionSet, resizeSrc bool) error {
origIPBlock *common.IPBlock, alignedConnectivity map[VPCResourceIntf]map[VPCResourceIntf]*common.ConnectionSet,
src, dst VPCResourceIntf, conns *common.ConnectionSet, resizeSrc bool) error {
for _, ipBlock := range disjointIPblocks {
// get ipBlock of resized index (src/dst)
if !ipBlock.ContainedIn(origIPBlock) { // ipBlock not relevant here
Expand All @@ -377,12 +377,12 @@ func addIPBlockToConnectivityMap(c *VPCConfig, disjointIPblocks []*common.IPBloc
}
if resizeSrc {
if _, ok := alignedConnectivity[nodeOfCidr]; !ok {
alignedConnectivity[nodeOfCidr] = map[EndpointElem]*common.ConnectionSet{}
alignedConnectivity[nodeOfCidr] = map[VPCResourceIntf]*common.ConnectionSet{}
}
alignedConnectivity[nodeOfCidr][dst] = conns
} else {
if _, ok := alignedConnectivity[src]; !ok {
alignedConnectivity[src] = map[EndpointElem]*common.ConnectionSet{}
alignedConnectivity[src] = map[VPCResourceIntf]*common.ConnectionSet{}
}
alignedConnectivity[src][nodeOfCidr] = conns
}
Expand Down
16 changes: 8 additions & 8 deletions pkg/vpcmodel/subnetsConnectivity.go
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ import (
"fmt"
)

type SubnetConnectivityMap map[EndpointElem]map[EndpointElem]*common.ConnectionSet
type SubnetConnectivityMap map[VPCResourceIntf]map[VPCResourceIntf]*common.ConnectionSet

// VPCsubnetConnectivity captures allowed connectivity for subnets, considering nacl and pgw resources
type VPCsubnetConnectivity struct {
// computed for each node (subnet), by iterating its ConnectivityResult for all relevant VPC resources that capture it
AllowedConns map[EndpointElem]*ConfigBasedConnectivityResults
AllowedConns map[VPCResourceIntf]*ConfigBasedConnectivityResults
// combined connectivity - considering both ingress and egress per connection
AllowedConnsCombined SubnetConnectivityMap
VPCConfig *VPCConfig
Expand Down Expand Up @@ -170,7 +170,7 @@ func (c *VPCConfig) GetSubnetsConnectivity(includePGW, grouping bool) (*VPCsubne
}

// convert to subnet-based connectivity result
subnetsConnectivity := map[EndpointElem]*ConfigBasedConnectivityResults{}
subnetsConnectivity := map[VPCResourceIntf]*ConfigBasedConnectivityResults{}
for subnetCidrStr, ipBasedConnectivity := range subnetsConnectivityFromACLresources {
subnetNodeSet, err := c.subnetCidrToSubnetElem(subnetCidrStr)
if err != nil {
Expand Down Expand Up @@ -207,7 +207,7 @@ func (c *VPCConfig) GetSubnetsConnectivity(includePGW, grouping bool) (*VPCsubne
}

func (v *VPCsubnetConnectivity) computeAllowedConnsCombined() error {
v.AllowedConnsCombined = map[EndpointElem]map[EndpointElem]*common.ConnectionSet{}
v.AllowedConnsCombined = map[VPCResourceIntf]map[VPCResourceIntf]*common.ConnectionSet{}
for subnetNodeSet, connsRes := range v.AllowedConns {
for peerNode, conns := range connsRes.IngressAllowedConns {
src := peerNode
Expand All @@ -232,7 +232,7 @@ func (v *VPCsubnetConnectivity) computeAllowedConnsCombined() error {
continue
}
if _, ok := v.AllowedConnsCombined[src]; !ok {
v.AllowedConnsCombined[src] = map[EndpointElem]*common.ConnectionSet{}
v.AllowedConnsCombined[src] = map[VPCResourceIntf]*common.ConnectionSet{}
}
v.AllowedConnsCombined[src][dst] = combinedConns
}
Expand All @@ -255,7 +255,7 @@ func (v *VPCsubnetConnectivity) computeAllowedConnsCombined() error {
return errors.New(errUnexpectedTypePeerNode)
}
if _, ok := v.AllowedConnsCombined[src]; !ok {
v.AllowedConnsCombined[src] = map[EndpointElem]*common.ConnectionSet{}
v.AllowedConnsCombined[src] = map[VPCResourceIntf]*common.ConnectionSet{}
}
v.AllowedConnsCombined[src][dst] = combinedConns
}
Expand Down Expand Up @@ -315,9 +315,9 @@ func (c *VPCConfig) GetConnectivityOutputPerEachSubnetSeparately() string {
return ""
}

func (subnetConnectivity SubnetConnectivityMap) updateAllowedSubnetConnsMap(src, dst EndpointElem, conn *common.ConnectionSet) {
func (subnetConnectivity SubnetConnectivityMap) updateAllowedSubnetConnsMap(src, dst VPCResourceIntf, conn *common.ConnectionSet) {
if _, ok := subnetConnectivity[src]; !ok {
subnetConnectivity[src] = map[EndpointElem]*common.ConnectionSet{}
subnetConnectivity[src] = map[VPCResourceIntf]*common.ConnectionSet{}
}
subnetConnectivity[src][dst] = conn
}
8 changes: 4 additions & 4 deletions pkg/vpcmodel/vpcConnectivity.go
Original file line number Diff line number Diff line change
Expand Up @@ -69,14 +69,14 @@ func NewIPbasedConnectivityResult() *IPbasedConnectivityResult {
// ConfigBasedConnectivityResults is used to capture allowed connectivity to/from elements in the vpc config1 (subnets / external ip-blocks)
// It is associated with a subnet when analyzing connectivity of subnets based on NACL resources
type ConfigBasedConnectivityResults struct {
IngressAllowedConns map[EndpointElem]*common.ConnectionSet
EgressAllowedConns map[EndpointElem]*common.ConnectionSet
IngressAllowedConns map[VPCResourceIntf]*common.ConnectionSet
EgressAllowedConns map[VPCResourceIntf]*common.ConnectionSet
}

func NewConfigBasedConnectivityResults() *ConfigBasedConnectivityResults {
return &ConfigBasedConnectivityResults{
IngressAllowedConns: map[EndpointElem]*common.ConnectionSet{},
EgressAllowedConns: map[EndpointElem]*common.ConnectionSet{},
IngressAllowedConns: map[VPCResourceIntf]*common.ConnectionSet{},
EgressAllowedConns: map[VPCResourceIntf]*common.ConnectionSet{},
}
}

Expand Down
Loading