313 explain add routing resources

pkg/vpcmodel/abstractVPC.go

@@ -49,6 +49,7 @@ func (n *VPCResource) VPC() VPCResourceIntf {
 	return n.VPCRef
 }
 
+// todo: define enum for filters
 const (
 	// filter-resources layer names (grouping all vpc resources of that kind)
 	NaclLayer          = "NaclLayer"

pkg/vpcmodel/commonConnectivity.go

@@ -10,3 +10,16 @@ func (connectivityMap GeneralConnectivityMap) updateAllowedConnsMap(src, dst VPC
 	}
 	connectivityMap[src][dst] = conn
 }
+
+// getRoutingResource: gets the routing resource and its conn; currently the conn is either all or none
+// node is associated with either a pgw or a fip;
+// if the relevant network interface has both the parser will keep only the fip.
+func (c *VPCConfig) getRoutingResource(src, dst Node) (RoutingResource, *common.ConnectionSet) {
+	for _, router := range c.RoutingResources {
+		routerConnRes := router.AllowedConnectivity(src, dst)
+		if !routerConnRes.IsEmpty() { // connection is allowed through router resource
+			return router, routerConnRes
+		}
+	}
+	return nil, NoConns()
+}

pkg/vpcmodel/grouping.go

@@ -23,6 +23,7 @@ type groupedCommonProperties struct {
 	conn     *common.ConnectionSet
 	connDiff *connectionDiff
 	rules    *rulesConnection
+	router   RoutingResource
 	// groupingStrKey is the key by which the grouping is done:
 	// the string of conn per grouping of conn lines, string of connDiff per grouping of diff lines
 	// and string of conn and rules for explainblity
@@ -88,7 +89,7 @@ func newGroupConnLinesDiff(d *diffBetweenCfgs) (res *GroupConnLines, err error)
 	return res, err
 }
 
-func newGroupConnExplainability(c *VPCConfig, e *explainStruct) (res *GroupConnLines, err error) {
+func newGroupConnExplainability(c *VPCConfig, e *rulesAndConnDetails) (res *GroupConnLines, err error) {
 	res = &GroupConnLines{
 		config:                   c,
 		explain:                  e,
@@ -107,7 +108,7 @@ type GroupConnLines struct {
 	nodesConn   *VPCConnectivity
 	subnetsConn *VPCsubnetConnectivity
 	diff        *diffBetweenCfgs
-	explain     *explainStruct
+	explain     *rulesAndConnDetails
 	srcToDst    *groupingConnections
 	dstToSrc    *groupingConnections
 	// a map to groupedEndpointsElems used by GroupedConnLine from a unified key of such elements
@@ -319,9 +320,15 @@ func (g *GroupConnLines) groupExternalAddressesForExplainability() error {
 	var res []*groupedConnLine
 	for _, rulesSrcDst := range *g.explain {
 		connStr := rulesSrcDst.conn.String() + semicolon
-		groupingStrKey := connStr + rulesSrcDst.rules.rulesEncode(g.config)
+		routingStr := ""
+		if rulesSrcDst.router != nil {
+			router := rulesSrcDst.router
+			routingStr = router.Name() + ";"
+		}
+		groupingStrKey := connStr + routingStr + rulesSrcDst.rules.rulesEncode(g.config)
 		err := g.addLineToExternalGrouping(&res, rulesSrcDst.src, rulesSrcDst.dst,
-			&groupedCommonProperties{conn: rulesSrcDst.conn, rules: rulesSrcDst.rules, groupingStrKey: groupingStrKey})
+			&groupedCommonProperties{conn: rulesSrcDst.conn, router: rulesSrcDst.router,
+				rules: rulesSrcDst.rules, groupingStrKey: groupingStrKey})
 		if err != nil {
 			return err
 		}

pkg/vpcmodel/nodesConnectivity.go

@@ -117,20 +117,10 @@ func (c *VPCConfig) getAllowedConnsPerDirection(isIngress bool, capturedNode Nod
 			allLayersRes[peerNode] = allowedConnsBetweenCapturedAndPeerNode
 		} else {
 			// else : external node -> consider attached routing resources
-
-			allowedConnsBetweenCapturedAndPeerNode := NoConns()
-			// node is associated with either a pgw or a fip
-			var appliedRouter RoutingResource
-			for _, router := range c.RoutingResources {
-				routerConnRes := router.AllowedConnectivity(src, dst)
-				if !routerConnRes.IsEmpty() { // connection is allowed through router resource
-					// TODO: consider adding connection attribute with details of routing through this router resource
-					allowedConnsBetweenCapturedAndPeerNode = routerConnRes
-					appliedRouter = router
-					updatePerLayerRes(perLayerRes, router.Kind(), peerNode, routerConnRes)
-				}
-			}
-			if appliedRouter == nil {
+			appliedRouter, routerConnRes := c.getRoutingResource(src, dst)
+			if appliedRouter != nil {
+				updatePerLayerRes(perLayerRes, appliedRouter.Kind(), peerNode, routerConnRes)
+			} else {
 				// without fip/pgw there is no external connectivity
 				allLayersRes[peerNode] = NoConns()
 				continue
@@ -139,9 +129,9 @@ func (c *VPCConfig) getAllowedConnsPerDirection(isIngress bool, capturedNode Nod
 			// TODO: consider moving to pkg ibm-vpc
 			appliedFilters := appliedRouter.AppliedFiltersKinds()
 			for layer := range appliedFilters {
-				allowedConnsBetweenCapturedAndPeerNode = allowedConnsBetweenCapturedAndPeerNode.Intersection(perLayerRes[layer][peerNode])
+				routerConnRes = routerConnRes.Intersection(perLayerRes[layer][peerNode])
 			}
-			allLayersRes[peerNode] = allowedConnsBetweenCapturedAndPeerNode
+			allLayersRes[peerNode] = routerConnRes
 		}
 	}
 	return allLayersRes, perLayerRes, nil

pkg/vpcmodel/nodesExplainability.go

@@ -9,6 +9,7 @@ import (
 )
 
 // rulesInLayers contains specific rules across all layers (SGLayer/NACLLayer)
+// it maps from the layer name to the list of rules
 type rulesInLayers map[string][]RulesInFilter
 
 // rulesConnection contains the rules enabling a connection
@@ -18,18 +19,22 @@ type rulesConnection struct {
 }
 
 type rulesSingleSrcDst struct {
-	src   Node
-	dst   Node
-	conn  *common.ConnectionSet
-	rules *rulesConnection
+	src             Node
+	dst             Node
+	conn            *common.ConnectionSet
+	router          RoutingResource // the router (fip or pgw) to external network; nil if none
+	filtersExternal map[string]bool // filters relevant for external IP
+	rules           *rulesConnection
 }
 
-type explainStruct []*rulesSingleSrcDst
+type rulesAndConnDetails []*rulesSingleSrcDst
 
 type explanation struct {
-	c             *VPCConfig
-	connQuery     *common.ConnectionSet
-	explainStruct *explainStruct
+	c              *VPCConfig
+	connQuery      *common.ConnectionSet
+	potentialRules *rulesAndConnDetails // rules potentially enabling connection
+	actualRules    *rulesAndConnDetails // rules enabling connection given router
+	// at the moment (only SG) potentialRules may differ from actualRules only if src or dst is external
 	// grouped connectivity result:
 	// grouping common explanation lines with common src/dst (internal node) and different dst/src (external node)
 	// [required due to computation with disjoint ip-blocks]
@@ -100,34 +105,36 @@ func (c *VPCConfig) getNodesFromInput(cidrOrName string) ([]Node, error) {
 
 // ExplainConnectivity todo: this will not be needed here once we connect explanbility to the cli
 // todo: support vsi given as an ID/IP address (CRN?)
-// todo: connection should be given in a string format, of course
 // nil conn means connection is not part of the query
 func (c *VPCConfig) ExplainConnectivity(src, dst string, connQuery *common.ConnectionSet) (out string, err error) {
-	explanationStruct, err1 := c.computeExplainRules(src, dst, connQuery)
+	srcNodes, dstNodes, err := c.processInput(src, dst)
+	if err != nil {
+		return "", err
+	}
+	potentialRulesAndConnDetails, err1 := c.computeExplainRules(srcNodes, dstNodes, connQuery)
 	if err1 != nil {
 		return "", err1
 	}
 	if connQuery == nil { // find the connection between src and dst if connection not specified in query
-		err2 := explanationStruct.computeConnections(c)
+		err2 := potentialRulesAndConnDetails.computeConnections(c)
 		if err2 != nil {
 			return "", err2
 		}
 	}
-	groupedLines, err3 := newGroupConnExplainability(c, &explanationStruct)
+	actualRulesAndConnDetails := c.computeRouterAndActualRules(&potentialRulesAndConnDetails)
+	groupedLines, err3 := newGroupConnExplainability(c, actualRulesAndConnDetails)
 	if err3 != nil {
 		return "", err3
 	}
-	res := &explanation{c, connQuery, &explanationStruct, groupedLines.GroupedLines}
+	res := &explanation{c, connQuery, &potentialRulesAndConnDetails,
+		&potentialRulesAndConnDetails, groupedLines.GroupedLines}
 	return res.String(), nil
 }
 
 // computeExplainRules computes the egress and ingress rules contributing to the (existing or missing) connection <src, dst>
-func (c *VPCConfig) computeExplainRules(srcName, dstName string, conn *common.ConnectionSet) (explanationStruct explainStruct, err error) {
-	srcNodes, dstNodes, err := c.processInput(srcName, dstName) // todo: should also handle connection string translation
-	if err != nil {
-		return nil, err
-	}
-	explanationStruct = make(explainStruct, max(len(srcNodes), len(dstNodes)))
+func (c *VPCConfig) computeExplainRules(srcNodes, dstNodes []Node,
+	conn *common.ConnectionSet) (rulesAndConn rulesAndConnDetails, err error) {
+	rulesAndConn = make(rulesAndConnDetails, max(len(srcNodes), len(dstNodes)))
 	i := 0
 	// either src of dst has more than one item; never both
 	// the loop is on two dimension since we do not know which, but actually we have a single dimension
@@ -137,12 +144,56 @@ func (c *VPCConfig) computeExplainRules(srcName, dstName string, conn *common.Co
 			if err != nil {
 				return nil, err
 			}
-			rulesThisSrcDst := &rulesSingleSrcDst{src, dst, common.NewConnectionSet(false), rulesOfConnection}
-			explanationStruct[i] = rulesThisSrcDst
+			rulesThisSrcDst := &rulesSingleSrcDst{src, dst, common.NewConnectionSet(false), nil, nil, rulesOfConnection}
+			rulesAndConn[i] = rulesThisSrcDst
 			i++
 		}
 	}
-	return explanationStruct, nil
+	return rulesAndConn, nil
+}
+
+// computeActualRules computes from potentialRules the rules that actually enable traffic, considering the filtersExternal
+// (which was computed based on the RoutingResource) and (in the near future) considering the combined filters
+// at the moment (only SG supported) actual can differ from potential only if src or dst is external
+func (c *VPCConfig) computeRouterAndActualRules(potentialRules *rulesAndConnDetails) *rulesAndConnDetails {
+	actualRulesAndConn := make(rulesAndConnDetails, len(*potentialRules))
+	for i, potential := range *potentialRules {
+		src := potential.src
+		dst := potential.dst
+		// RoutingResources are computed by the parser for []Nodes of the VPC,
+		// finds the relevant nodes for the query's src and dst;
+		// err indicates no containing node was found, which is an indication there is no router
+		containingSrcNode, err1 := c.getContainingConfigNode(src)
+		containingDstNode, err2 := c.getContainingConfigNode(dst)
+		var routingResource RoutingResource
+		var filtersForExternal map[string]bool
+		if err1 == nil && err2 == nil {
+			routingResource, _ = c.getRoutingResource(containingSrcNode, containingDstNode)
+			if routingResource != nil {
+				filtersForExternal = routingResource.AppliedFiltersKinds() // relevant filtersExternal
+			}
+		}
+		potential.router = routingResource
+		potential.filtersExternal = filtersForExternal
+		actual := *potential
+		if !potential.src.IsInternal() || !potential.dst.IsInternal() {
+			actualIngress := computeActualRules(&potential.rules.ingressRules, filtersForExternal)
+			actualEgress := computeActualRules(&potential.rules.egressRules, filtersForExternal)
+			actual.rules = &rulesConnection{*actualIngress, *actualEgress}
+		}
+		actualRulesAndConn[i] = &actual
+	}
+	return &actualRulesAndConn
+}
+
+func computeActualRules(potentialRules *rulesInLayers, filtersExternal map[string]bool) *rulesInLayers {
+	actualRules := rulesInLayers{}
+	for filter, potentialRules := range *potentialRules {
+		if filtersExternal[filter] {
+			actualRules[filter] = potentialRules
+		}
+	}
+	return &actualRules
 }
 
 func (c *VPCConfig) processInput(srcName, dstName string) (srcNodes, dstNodes []Node, err error) {
@@ -234,10 +285,11 @@ func (c *VPCConfig) getContainingConfigNode(node Node) (Node, error) {
 }
 
 // prints each separately without grouping - for debug
-func (explanationStruct *explainStruct) String(c *VPCConfig, connQuery *common.ConnectionSet) (string, error) {
+func (explanationStruct *rulesAndConnDetails) String(c *VPCConfig, connQuery *common.ConnectionSet) (string, error) {
 	resStr := ""
 	for _, rulesSrcDst := range *explanationStruct {
-		resStr += stringExplainabilityLine(c, connQuery, rulesSrcDst.src, rulesSrcDst.dst, rulesSrcDst.conn, rulesSrcDst.rules)
+		resStr += stringExplainabilityLine(c, connQuery, rulesSrcDst.src, rulesSrcDst.dst,
+			rulesSrcDst.conn, rulesSrcDst.router, rulesSrcDst.rules)
 	}
 	return resStr, nil
 }
@@ -247,14 +299,14 @@ func (explanation *explanation) String() string {
 	groupedLines := explanation.groupedLines
 	for i, line := range groupedLines {
 		linesStr[i] = stringExplainabilityLine(explanation.c, explanation.connQuery, line.src, line.dst, line.commonProperties.conn,
-			line.commonProperties.rules)
+			line.commonProperties.router, line.commonProperties.rules)
 	}
 	sort.Strings(linesStr)
 	return strings.Join(linesStr, "\n") + "\n"
 }
 
 func stringExplainabilityLine(c *VPCConfig, connQuery *common.ConnectionSet, src, dst EndpointElem,
-	conn *common.ConnectionSet, rules *rulesConnection) string {
+	conn *common.ConnectionSet, router RoutingResource, rules *rulesConnection) string {
 	needEgress := !src.IsExternal()
 	needIngress := !dst.IsExternal()
 	noIngressRules := len(rules.ingressRules) == 0 && needIngress
@@ -269,6 +321,10 @@ func stringExplainabilityLine(c *VPCConfig, connQuery *common.ConnectionSet, src
 	}
 	resStr := ""
 	switch {
+	case router == nil && src.IsExternal():
+		resStr += fmt.Sprintf("%v no fip router and src is external\n", noConnection)
+	case router == nil && dst.IsExternal():
+		resStr += fmt.Sprintf("%v no router (fip/pgw) and dst is external\n", noConnection)
 	case noIngressRules && noEgressRules:
 		resStr += fmt.Sprintf("%v connection blocked both by ingress and egress\n", noConnection)
 	case noIngressRules:
@@ -282,26 +338,37 @@ func stringExplainabilityLine(c *VPCConfig, connQuery *common.ConnectionSet, src
 			resStr += ingressRulesStr
 		}
 	default: // there is a connection
-		if connQuery == nil {
-			resStr = fmt.Sprintf("The following connection exists between %v and %v: %v; its enabled by\n", src.Name(), dst.Name(),
-				conn.String())
-		} else {
-			resStr = fmt.Sprintf("Connection %v exists between %v and %v; its enabled by\n", connQuery.String(),
-				src.Name(), dst.Name())
-		}
-		if needEgress {
-			resStr += egressRulesStr
-		}
-		if needIngress {
-			resStr += ingressRulesStr
-		}
+		return stringExplainabilityConnection(connQuery, src, dst, conn, router, needEgress, needIngress, egressRulesStr, ingressRulesStr)
+	}
+	return resStr
+}
+
+func stringExplainabilityConnection(connQuery *common.ConnectionSet, src, dst EndpointElem,
+	conn *common.ConnectionSet, router RoutingResource,
+	needEgress, needIngress bool, egressRulesStr, ingressRulesStr string) string {
+	resStr := ""
+	if connQuery == nil {
+		resStr = fmt.Sprintf("The following connection exists between %v and %v: %v; its enabled by\n", src.Name(), dst.Name(),
+			conn.String())
+	} else {
+		resStr = fmt.Sprintf("Connection %v exists between %v and %v; its enabled by\n", connQuery.String(),
+			src.Name(), dst.Name())
+	}
+	if src.IsExternal() || dst.IsExternal() {
+		resStr += "External Router " + router.Kind() + ": " + router.Name() + "\n"
+	}
+	if needEgress {
+		resStr += egressRulesStr
+	}
+	if needIngress {
+		resStr += ingressRulesStr
 	}
 	return resStr
 }
 
 // todo: connectivity is computed for the entire network, even though we need only for specific src, dst pairs
 // this is seems the time spent here should be neglectable, not worth the effort of adding dedicated code.
-func (explanationStruct *explainStruct) computeConnections(c *VPCConfig) error {
+func (explanationStruct *rulesAndConnDetails) computeConnections(c *VPCConfig) error {
 	connectivity, err := c.GetVPCNetworkConnectivity(false) // computes connectivity
 	if err != nil {
 		return err