106 add synthesis tests

pkg/collector/data/examples.go

@@ -335,3 +335,133 @@ var ExampleDumbeldore = Example{
 		},
 	},
 }
+
+// ExampleTwoDeniesSimple
+// Simple example with two denies
+// Slytherin can talk to all but Dumbledore
+// Gryffindor can talk to all but Dumbledore
+var ExampleTwoDeniesSimple = Example{
+	vms: []string{"Slytherin", "Hufflepuff", "Gryffindor", "Dumbledore1", "Dumbledore2"},
+	groups: map[string][]string{
+		"Slytherin":   {"Slytherin"},
+		"Hufflepuff":  {"Hufflepuff"},
+		"Gryffindor":  {"Gryffindor"},
+		"Dumbledore":  {"Dumbledore1", "Dumbledore2"},
+		"Dumbledore1": {"Dumbledore1"},
+		"Dumbledore2": {"Dumbledore2"},
+	},
+	policies: []category{
+		{
+			name:         "Two-Denys-Simple-Test",
+			categoryType: "Application",
+			rules: []rule{
+				{
+					name:     "no-conn-to-dumb1",
+					id:       1,
+					source:   "ANY",
+					dest:     "Dumbledore1",
+					services: []string{"ANY"},
+					action:   drop,
+				},
+				{
+					name:     "no-conn-to-dumb2",
+					id:       2,
+					source:   "ANY",
+					dest:     "Dumbledore2",
+					services: []string{"ANY"},
+					action:   drop,
+				},
+				{
+					name:     "Slytherin-to-all",
+					id:       3,
+					source:   "Slytherin",
+					dest:     "ANY",
+					services: []string{"ANY"},
+					action:   allow,
+				},
+				{
+					name:     "Gryffindor-to-all",
+					id:       4,
+					source:   "Gryffindor",
+					dest:     "ANY",
+					services: []string{"ANY"},
+					action:   allow,
+				},
+			},
+		},
+		{
+			name:         "Default-L3-Section",
+			categoryType: "Application",
+			rules: []rule{
+				defaultDenyRule(denyRuleIDApp),
+			},
+		},
+	},
+}
+
+// ExampleDenyPassSimple one pass and two denies, span over two categories
+// all can talk to all but Slytherin and Hufflepuff (or to Gryffindor and Dumbledore)
+var ExampleDenyPassSimple = Example{
+	vms: []string{"Slytherin", "Hufflepuff", "Gryffindor", "Dumbledore1", "Dumbledore2"},
+	groups: map[string][]string{
+		"Slytherin":   {"Slytherin"},
+		"Hufflepuff":  {"Hufflepuff"},
+		"Gryffindor":  {"Gryffindor"},
+		"Dumbledore":  {"Dumbledore1", "Dumbledore2"},
+		"Dumbledore1": {"Dumbledore1"},
+		"Dumbledore2": {"Dumbledore2"},
+	},
+	policies: []category{
+		{
+			name:         "Env-pass-and-deny",
+			categoryType: "Environment",
+			rules: []rule{
+				{
+					name:     "pass-all-to-dumb",
+					id:       10218,
+					source:   "ANY",
+					dest:     "Dumbledore",
+					services: []string{"ANY"},
+					action:   jumpToApp,
+				},
+				{
+					name:     "deny-all-to-Hufflepuff",
+					id:       10219,
+					source:   "ANY",
+					dest:     "Hufflepuff",
+					services: []string{"ANY"},
+					action:   drop,
+				},
+				{
+					name:     "deny-all-to-Slytherin",
+					id:       10220,
+					source:   "ANY",
+					dest:     "Slytherin",
+					services: []string{"ANY"},
+					action:   drop,
+				},
+			},
+		},
+		{
+			name:         "App-Allow-All",
+			categoryType: "Application",
+			rules: []rule{
+				{
+					name:     "allow-all-to-all",
+					id:       newRuleID,
+					source:   "ANY",
+					dest:     "ANY",
+					services: []string{"ANY"},
+					action:   allow,
+				},
+			},
+		},
+		{
+			name:         "Default-L3-Section",
+			categoryType: "Application",
+			rules: []rule{
+				defaultDenyRule(denyRuleIDApp),
+			},
+		},
+	},
+}

pkg/synthesis/synthesis_test.go

@@ -41,6 +41,14 @@ var allTests = []synthesisTest{
 		name:   "ExampleDumbeldore",
 		exData: data.ExampleDumbeldore,
 	},
+	{
+		name:   "ExampleTwoDeniesSimple",
+		exData: data.ExampleTwoDeniesSimple,
+	},
+	{
+		name:   "ExampleDenyPassSimple",
+		exData: data.ExampleDenyPassSimple,
+	},
 }
 
 func (synTest *synthesisTest) runPreprocessing(t *testing.T, mode testMode) {

pkg/synthesis/tests_expected_output/ExampleDenyPassSimple_ConvertToAbstract.txt

@@ -0,0 +1,6 @@
+Allow Only Rules
+~~~~~~~~~~~~~~~~~
+inbound rules
+	All Connections from (*) to (*)
+outbound rules
+	All Connections from (*) to (*)

pkg/synthesis/tests_expected_output/ExampleDenyPassSimple_PreProcessing.txt

@@ -0,0 +1,18 @@
+category: Environment
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+symbolic inbound rules:
+	0. action: jump_to_application paths: All Connections from (*) to (group  = Dumbledore)
+	1. action: deny paths: All Connections from (*) to (group  = Hufflepuff)
+	2. action: deny paths: All Connections from (*) to (group  = Slytherin)
+symbolic outbound rules:
+	0. action: jump_to_application paths: All Connections from (*) to (group  = Dumbledore)
+	1. action: deny paths: All Connections from (*) to (group  = Hufflepuff)
+	2. action: deny paths: All Connections from (*) to (group  = Slytherin)
+category: Application
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+symbolic inbound rules:
+	0. action: allow paths: All Connections from (*) to (*)
+	1. action: deny paths: All Connections from (*) to (*)
+symbolic outbound rules:
+	0. action: allow paths: All Connections from (*) to (*)
+	1. action: deny paths: All Connections from (*) to (*)

pkg/synthesis/tests_expected_output/ExampleTwoDeniesSimple_ConvertToAbstract.txt

@@ -0,0 +1,8 @@
+Allow Only Rules
+~~~~~~~~~~~~~~~~~
+inbound rules
+	All Connections from (group  = Slytherin) to (group  != Dumbledore1 and group  != Dumbledore2)
+	All Connections from (group  = Gryffindor) to (group  != Dumbledore1 and group  != Dumbledore2)
+outbound rules
+	All Connections from (group  = Slytherin) to (group  != Dumbledore1 and group  != Dumbledore2)
+	All Connections from (group  = Gryffindor) to (group  != Dumbledore1 and group  != Dumbledore2)

pkg/synthesis/tests_expected_output/ExampleTwoDeniesSimple_PreProcessing.txt

@@ -0,0 +1,14 @@
+category: Application
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+symbolic inbound rules:
+	0. action: deny paths: All Connections from (*) to (group  = Dumbledore1)
+	1. action: deny paths: All Connections from (*) to (group  = Dumbledore2)
+	2. action: allow paths: All Connections from (group  = Slytherin) to (*)
+	3. action: allow paths: All Connections from (group  = Gryffindor) to (*)
+	4. action: deny paths: All Connections from (*) to (*)
+symbolic outbound rules:
+	0. action: deny paths: All Connections from (*) to (group  = Dumbledore1)
+	1. action: deny paths: All Connections from (*) to (group  = Dumbledore2)
+	2. action: allow paths: All Connections from (group  = Slytherin) to (*)
+	3. action: allow paths: All Connections from (group  = Gryffindor) to (*)
+	4. action: deny paths: All Connections from (*) to (*)