np-guard / vpc-network-config-analyzer Goto Github PK
View Code? Open in Web Editor NEWA tool for analyzing the configured network connectivity of VPCs as specified by various VPC resources
License: Apache License 2.0
A tool for analyzing the configured network connectivity of VPCs as specified by various VPC resources
License: Apache License 2.0
Please open an issue on merging overlapping/touching IP-blocks. It can improve results here. E.g., replacing 161.26.0.0/16,161.27.0.0/16
with 161.26.0.0/15
Originally posted by @zivnevo in #95 (comment)
grouping of ip-blocks should be always applied
Thus, there could be sg's rules referring solely to private address that are not within the VPC. At the current setting the analyzer will not be able to identify them since the address prefixes are not known to it. Perhaps it makes sense to add warning for these cases as they may indicate a mistake.
Priority: nice to have
The result should reflect allowed/denied connections considering both types of config resources
support grouping with all_subnets
:
not relevant to single_subnet
public gateway can be attached to multiple subnets in the zone.
current implementation assumed only one subnet per pgw.
The function GetExternalNetworkNodes
seems to have an issue, where not all public internet ranges are added after computation of disjoint ip-blocks.
The concept of an IP block and the manipulation of IP blocks will be common to all vendors for sure.
consider the the output with flag -grouping
, and support it with drawio format
uid as CRN and not ID
Textual connectivity report - currently plan to handle two use cases:
Visualization of connectivity report :
input: vpc config dump in json file
output: connectivity results (ingress/ egress) for vpc elements considering SG/NACL
```suggestion
vsi3a-ky[10.240.30.5],vsi3b-ky[10.240.30.6],vsi3c-ky[10.240.30.4] => vsi3a-ky[10.240.30.5],vsi3b-ky[10.240.30.6],vsi3c-ky[10.240.30.4] : All Connections
vsi3a-ky[10.240.30.5],vsi3b-ky[10.240.30.6],vsi3c-ky[10.240.30.4] => vsi1-ky[10.240.10.4] : All Connections
This requires adding a self loop to each VSI, run the grouping algorithm, then remove left-over self loops.
Can be handled in a future PR.
_Originally posted by @zivnevo in https://github.com/np-guard/vpc-network-config-analyzer/pull/92#discussion_r1253989708_
fip is applied on interface level and its connectivity not affected by nacl rules, only sg rules.
Two modifications:
See standard examples in the official repo: https://github.ibm.com/ibmcloud/ibm-cloud-stencils#v20-examples
Consider moving Details(), DetailsMap() and Kind() to NamedResourceIntf (and maybe rename it to VPCResourceIntf)
extend the support of ip-block grouping to all_subnets
analysis type as well (see issue #124)
support grouping of ip-blocks for json format : note that the non-grouped version has more information about the connections than stateful/stateless)
grouped output issue: external nodes are printed without "Public Internet" prefix
Open an issue for handling of unidirectional connections under grouping
Originally posted by @zivnevo in #96 (comment)
currently using
VsiLevel / SubnetsLevel / DebugSubnet
model: e.g. vpc should point to its subnets
Remaining items:
(1) [done] keep in VPCConfig an abstract member of type VPCResourceIntf which points to the concrete VPC the config belongs to, and delete vpcsMap
(2) [done] support with formats: json
(3) change map from object name to object reference in vpc config to be based on unique ids (see issue #256 )
(4) decide on JSON format for aggregation - list or map (see #207 (comment) )
(5) handle drawio output for multiple vpcs , see #207 (comment)
should add a flag to choose which vpc to analyze
see issue #164
End-to-end examples:
cidrs
that is presented as ip range
in output.This issue is for brainstorming ideas for checks we may include as part of a linting functionality. At some point we will review the list with a stakeholder and decide which ones make sense.
see comments from:
few options to consider:
current state: info msg is "connections are stateful unless marked with *"
, and is always added to textual output (txt,md)
Make sure that the info message will be added once, not from various code functions
consider also the comment from another PR : #207 (comment)
The report of aggregated VPCs should contain this line only once rather than after every VPC report.
consider any resources with impact on connectivity results
Add as a new command line query , input: src / dst (endpoint/subnet/) , optionally protocol and port to explore
output: explain which resources (SG/NACL) are relevant for connectivity blocked/allowed , and which rules in the resource.
if blocked: which NACLs is blocking (and if there is deny rule / deny by default) , and which SGs can allow (if exist)
if allowed: which NACLs + SGs allow (and which rules)
phase2: gateways / LBs / PGW (+ ip-address as src/dst ) / TGW
example:
protocol: TCP src-ports: 1-442,444-65535 dst-ports: 443; protocol: TCP src-ports: 443
should be simplified to
protocol: TCP dst-ports: 443; protocol: TCP src-ports: 443
explore other examples to generalize the problem
Initial version assumes the following:
supporting both all_endpoints and all_subnets analysis types.
The attached config_object causes the tool to crash when invoked as follows:
vpcanalyzer -vpc-config config_object.json -analysis-type all_endpoints -format arch_drawio
crashes_drawio_config_object.txt
SG: Rules are stateful. To have stateful rules means when you create a rule that allows traffic one way, the rule automatically permits reverse traffic. For example, if you create a rule to allow inbound TCP traffic on port 80, the rule also allows replying outbound TCP traffic on port 80 back to the originating host, without the need for another rule.
NACL: An Access Control List (ACL) can manage (that is, it can allow or deny) inbound and outbound traffic for a subnet. An ACL is stateless, which means that inbound and outbound rules must be specified separately and explicitly. Each ACL consists of rules, based on a source IP, source port, destination IP, destination port, and protocol.
In the connectivity output, a connection A -> B
is stateful (allows bidrectional flow) if both SG and NACL (of A and B) allow connection (ingress and egress) from A to B , AND if NACL (of A and B) allow connection (ingress and egress) from B to A .
should be lower case
Currently parser generates the ResourcesContainer
from the input config object.
Now the collector supports the creation of this object, thus should use the collector's object instead.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.