read nACLs

pkg/io/confio/parse_acls.go

@@ -5,8 +5,138 @@ SPDX-License-Identifier: Apache-2.0
 
 package confio
 
-import "github.com/np-guard/vpc-network-config-synthesis/pkg/ir"
+import (
+	"errors"
+	"fmt"
+	"log"
 
-func ReadACLs(_ string) (*ir.ACLCollection, error) {
-	return nil, nil
+	"github.com/IBM/vpc-go-sdk/vpcv1"
+
+	"github.com/np-guard/models/pkg/netp"
+	"github.com/np-guard/models/pkg/netset"
+	"github.com/np-guard/vpc-network-config-synthesis/pkg/ir"
+)
+
+// ReadACLs translates ACLs from a config_object file to ir.ACLCollection
+func ReadACLs(filename string) (*ir.ACLCollection, error) {
+	config, err := readModel(filename)
+	if err != nil {
+		return nil, err
+	}
+
+	result := ir.NewACLCollection()
+	for i, acl := range config.NetworkACLList {
+		if acl.Name == nil || acl.VPC == nil || acl.VPC.Name == nil {
+			log.Printf("Warning: missing acl/VPC name in acl at index %d\n", i)
+			continue
+		}
+		inbound, outbound, err := translateACLRules(&acl.NetworkACL)
+		if err != nil {
+			return nil, err
+		}
+		vpcName := *acl.VPC.Name
+		if result.ACLs[vpcName] == nil {
+			result.ACLs[vpcName] = make(map[string]*ir.ACL)
+		}
+		result.ACLs[vpcName][*acl.Name] = &ir.ACL{Inbound: inbound, Outbound: outbound}
+	}
+	return result, nil
+}
+
+func translateACLRules(acl *vpcv1.NetworkACL) (inbound, outbound []*ir.ACLRule, err error) {
+	inbound = make([]*ir.ACLRule, 0)
+	outbound = make([]*ir.ACLRule, 0)
+	for index := range acl.Rules {
+		rule, err := translateACLRule(acl, index)
+		if err != nil {
+			return nil, nil, err
+		}
+		if rule.Direction == ir.Inbound {
+			inbound = append(inbound, rule)
+		} else {
+			outbound = append(outbound, rule)
+		}
+	}
+	return inbound, outbound, nil
+}
+
+func translateACLRule(acl *vpcv1.NetworkACL, i int) (*ir.ACLRule, error) {
+	switch r := acl.Rules[i].(type) {
+	case *vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolAll:
+		return translateACLRuleProtocolAll(r)
+	case *vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolTcpudp:
+		return translateACLRuleProtocolTCPUDP(r)
+	case *vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolIcmp:
+		return translateACLRuleProtocolIcmp(r)
+	}
+	return nil, fmt.Errorf("error parsing rule number %d in acl %s in VPC %s", i, *acl.Name, *acl.VPC.Name)
+}
+
+func translateACLRuleProtocolAll(rule *vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolAll) (*ir.ACLRule, error) {
+	action, err1 := translateAction(rule.Action)
+	direction, err2 := translateDirection(*rule.Direction)
+	src, err3 := translateResource(rule.Source)
+	dst, err4 := translateResource(rule.Destination)
+	if err := errors.Join(err1, err2, err3, err4); err != nil {
+		return nil, err
+	}
+	return &ir.ACLRule{
+		Action:      action,
+		Direction:   direction,
+		Source:      src,
+		Destination: dst,
+		Protocol:    netp.AnyProtocol{},
+	}, nil
+}
+
+func translateACLRuleProtocolTCPUDP(rule *vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolTcpudp) (*ir.ACLRule, error) {
+	action, err1 := translateAction(rule.Action)
+	direction, err2 := translateDirection(*rule.Direction)
+	src, err3 := translateResource(rule.Source)
+	dst, err4 := translateResource(rule.Destination)
+	protocol, err5 := translateProtocolTCPUDP(*rule.Protocol, rule.SourcePortMin, rule.SourcePortMax,
+		rule.DestinationPortMin, rule.DestinationPortMax)
+	if err := errors.Join(err1, err2, err3, err4, err5); err != nil {
+		return nil, err
+	}
+
+	return &ir.ACLRule{
+		Action:      action,
+		Direction:   direction,
+		Source:      src,
+		Destination: dst,
+		Protocol:    protocol,
+	}, nil
+}
+
+func translateACLRuleProtocolIcmp(rule *vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolIcmp) (*ir.ACLRule, error) {
+	action, err1 := translateAction(rule.Action)
+	direction, err2 := translateDirection(*rule.Direction)
+	src, err3 := translateResource(rule.Source)
+	dst, err4 := translateResource(rule.Destination)
+	protocol, err5 := netp.ICMPFromTypeAndCode64WithoutRFCValidation(rule.Type, rule.Code)
+	if err := errors.Join(err1, err2, err3, err4, err5); err != nil {
+		return nil, err
+	}
+
+	return &ir.ACLRule{
+		Action:      action,
+		Direction:   direction,
+		Source:      src,
+		Destination: dst,
+		Protocol:    protocol,
+	}, nil
+}
+
+func translateAction(action *string) (ir.Action, error) {
+	if *action == vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolAllActionAllowConst {
+		return ir.Allow, nil
+	} else if *action == vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolAllActionDenyConst {
+		return ir.Deny, nil
+	}
+	return ir.Deny, fmt.Errorf("an nACL rule action must be either allow or deny")
+}
+
+func translateResource(ipAddrs *string) (*netset.IPBlock, error) {
+	return netset.IPBlockFromCidrOrAddress(*ipAddrs)
 }

pkg/io/confio/parse_sgs.go

@@ -97,7 +97,7 @@ func translateSGRuleProtocolTCPUDP(rule *vpcv1.SecurityGroupRuleSecurityGroupRul
 	direction, err1 := translateDirection(*rule.Direction)
 	remote, err2 := translateRemote(rule.Remote)
 	local, err3 := translateLocal(rule.Local)
-	protocol, err4 := translateProtocolTCPUDP(rule)
+	protocol, err4 := translateProtocolTCPUDP(*rule.Protocol, nil, nil, rule.PortMin, rule.PortMax)
 	if err := errors.Join(err1, err2, err3, err4); err != nil {
 		return nil, err
 	}
@@ -121,7 +121,7 @@ func translateDirection(direction string) (ir.Direction, error) {
 	} else if direction == "outbound" {
 		return ir.Outbound, nil
 	}
-	return ir.Inbound, fmt.Errorf("SG rule direction must be either inbound or outbound")
+	return ir.Inbound, fmt.Errorf("a firewall rule direction must be either inbound or outbound")
 }
 
 func translateRemote(remote vpcv1.SecurityGroupRuleRemoteIntf) (ir.RemoteType, error) {
@@ -166,9 +166,11 @@ func translateTargets(sg *vpcv1.SecurityGroup) []string {
 	return res
 }
 
-func translateProtocolTCPUDP(rule *vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp) (netp.Protocol, error) {
-	isTCP := *rule.Protocol == vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudpProtocolTCPConst
-	minDstPort := utils.GetProperty(rule.PortMin, netp.MinPort)
-	maxDstPort := utils.GetProperty(rule.PortMax, netp.MaxPort)
-	return netp.NewTCPUDP(isTCP, netp.MinPort, netp.MaxPort, int(minDstPort), int(maxDstPort))
+func translateProtocolTCPUDP(protocolName string, srcPortMin, srcPortMax, dstPortMin, dstPortMax *int64) (netp.Protocol, error) {
+	isTCP := protocolName == vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudpProtocolTCPConst
+	minSrcPort := utils.GetProperty(srcPortMin, netp.MinPort)
+	maxSrcPort := utils.GetProperty(srcPortMax, netp.MaxPort)
+	minDstPort := utils.GetProperty(dstPortMin, netp.MinPort)
+	maxDstPort := utils.GetProperty(dstPortMax, netp.MaxPort)
+	return netp.NewTCPUDP(isTCP, int(minSrcPort), int(maxSrcPort), int(minDstPort), int(maxDstPort))
 }

pkg/ir/acl.go

@@ -32,6 +32,8 @@ type (
 		Subnet   string
 		Internal []*ACLRule
 		External []*ACLRule
+		Inbound  []*ACLRule
+		Outbound []*ACLRule
 	}
 
 	ACLCollection struct {