np-guard / vpc-network-config-analyzer

A tool for analyzing the configured network connectivity of VPCs as specified by various VPC resources
Apache License 2.0
7 stars 0 forks source link

explain when there is no disabler but no connection due to empty ingress/egress intersection #859

Closed ShiriMoran closed 1 month ago

ShiriMoran commented 1 month ago

Explain does not work well when there is no disabler but there is no connection due to empty ports/protocol intersection as below

Discuss: how to describe this situation in the path @zivnevo @adisos @kyorav

E.g.:


Explaining connectivity from private2 to private1 within mixed
Interpreted source: r1[10.240.48.198]
Interpreted destination: q2[10.240.32.122], q1[10.240.32.91]
==============================================================

Connections from r1[10.240.48.198] to q1[10.240.32.91]: No Connections

Path:
    r1[10.240.48.198] -> security group GroupId:22 -> network ACL acl1 -> subnet private2 -> 
    subnet private1 -> network ACL acl1 -> security group GroupId:15 -> q1[10.240.32.91]

Details:
~~~~~~~~
Path is disabled; The relevant rules are:
    Egress:
        security group GroupId:22 allows connection with the following allow rules
            Outbound index: 0, direction: outbound, target: 0.0.0.0/0, conns: protocol: tcp, dstPorts: 9080-9080
        network ACL acl1 allows connection with the following allow rules
            ruleNumber: 20, direction: outbound ,cidr: 10.240.32.0/19, action: allow, conn: all

    Ingress:
        network ACL acl1 allows connection with the following allow rules
            ruleNumber: 20, direction: inbound ,cidr: 10.240.32.0/19, action: allow, conn: all
        security group GroupId:15 allows connection with the following allow rules
            Inbound index: 0, direction: inbound, target: 0.0.0.0/0, conns: protocol: udp, dstPorts: 0-65535

```--
ShiriMoran commented 1 month ago

Given that https://github.com/np-guard/vpc-network-config-analyzer/issues/862 is solved, this case will be solved by:

  1. Adjusting headers and adding a short explanation
  2. Avoiding from printing path in this specific case