IpsecPeerConfig: Require valid local address

projects/batfish-common-protocol/src/main/java/org/batfish/datamodel/IpsecPeerConfig.java

@@ -1,6 +1,7 @@
 package org.batfish.datamodel;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
+import static com.google.common.base.Preconditions.checkArgument;
 import static org.batfish.datamodel.Interface.UNSET_LOCAL_INTERFACE;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
@@ -41,10 +42,14 @@ protected IpsecPeerConfig(
       @JsonProperty(PROP_POLICY_ACCESS_LIST) @Nullable IpAccessList policyAccessList,
       @JsonProperty(PROP_LOCAL_ADDRESS) @Nullable Ip localAddress,
       @JsonProperty(PROP_TUNNEL_INTERFACE) @Nullable String tunnelInterface) {
+    checkArgument(
+        localAddress != null && localAddress.valid(),
+        "Not a valid local address: %s",
+        localAddress);
     _ipsecPolicy = ipsecPolicy;
     _sourceInterface = firstNonNull(sourceInterface, UNSET_LOCAL_INTERFACE);
     _policyAccessList = policyAccessList;
-    _localAddress = firstNonNull(localAddress, Ip.AUTO);
+    _localAddress = localAddress;
     _tunnelInterface = tunnelInterface;
   }
 

projects/batfish-common-protocol/src/test/java/org/batfish/common/util/CompletionMetadataUtilsTest.java

@@ -503,7 +503,8 @@ public void testGetStructureNames() {
     config.setIpsecPhase2Proposals(
         ImmutableSortedMap.of(ipsecPhase2ProposalName, new IpsecPhase2Proposal()));
     config.setIpsecPeerConfigs(
-        ImmutableSortedMap.of(ipsecPeerConfigName, IpsecStaticPeerConfig.builder().build()));
+        ImmutableSortedMap.of(
+            ipsecPeerConfigName, IpsecStaticPeerConfig.builder().setLocalAddress(Ip.ZERO).build()));
     config.setRouteFilterLists(
         ImmutableSortedMap.of(routeFilterListName, new RouteFilterList(routeFilterListName)));
     config.setRoute6FilterLists(

projects/batfish-common-protocol/src/test/java/org/batfish/common/util/IpsecUtilHybridCloudTest.java

@@ -16,6 +16,7 @@
 import org.batfish.datamodel.Configuration;
 import org.batfish.datamodel.Edge;
 import org.batfish.datamodel.Interface;
+import org.batfish.datamodel.Ip;
 import org.batfish.datamodel.IpsecPeerConfigId;
 import org.batfish.datamodel.IpsecPhase2Proposal;
 import org.batfish.datamodel.IpsecSession;
@@ -45,11 +46,13 @@ public void setup() {
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface1")
             .setTunnelInterface("Tunnel1")
+            .setLocalAddress(Ip.parse("1.1.1.1"))
             .build();
     IpsecStaticPeerConfig ipsecPeerConfig2 =
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface2")
             .setTunnelInterface("Tunnel2")
+            .setLocalAddress(Ip.parse("2.2.2.2"))
             .build();
 
     IpsecSession establishedSession =

projects/batfish-common-protocol/src/test/java/org/batfish/common/util/IpsecUtilTest.java

@@ -26,6 +26,7 @@
 import org.batfish.datamodel.IkeKeyType;
 import org.batfish.datamodel.IkePhase1Key;
 import org.batfish.datamodel.Interface;
+import org.batfish.datamodel.Ip;
 import org.batfish.datamodel.IpsecPeerConfigId;
 import org.batfish.datamodel.IpsecPhase2Proposal;
 import org.batfish.datamodel.IpsecSession;
@@ -68,30 +69,41 @@ public void setup() {
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface1")
             .setTunnelInterface("Tunnel1")
+            .setLocalAddress(Ip.parse("1.1.1.1"))
             .build();
     IpsecStaticPeerConfig ipsecPeerConfig2 =
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface2")
             .setTunnelInterface("Tunnel2")
+            .setLocalAddress(Ip.parse("2.2.2.2"))
             .build();
     IpsecStaticPeerConfig ipsecPeerConfig3 =
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface3")
             .setTunnelInterface("Tunnel3")
+            .setLocalAddress(Ip.parse("3.3.3.3"))
             .build();
     IpsecStaticPeerConfig ipsecPeerConfig4 =
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface4")
             .setTunnelInterface("Tunnel4")
+            .setLocalAddress(Ip.parse("4.4.4.4"))
             .build();
     IpsecStaticPeerConfig ipsecPeerConfig5 =
-        IpsecStaticPeerConfig.builder().setSourceInterface("interface5").build();
+        IpsecStaticPeerConfig.builder()
+            .setSourceInterface("interface5")
+            .setLocalAddress(Ip.parse("5.5.5.5"))
+            .build();
     IpsecStaticPeerConfig ipsecPeerConfig6 =
-        IpsecStaticPeerConfig.builder().setSourceInterface("interface6").build();
+        IpsecStaticPeerConfig.builder()
+            .setSourceInterface("interface6")
+            .setLocalAddress(Ip.parse("6.6.6.6"))
+            .build();
     IpsecStaticPeerConfig ipsecPeerConfig7 =
         IpsecStaticPeerConfig.builder()
             .setSourceInterface("interface7")
             .setTunnelInterface("Tunnel7")
+            .setLocalAddress(Ip.parse("7.7.7.7"))
             .build();
 
     IpsecSession establishedSession =
@@ -194,24 +206,24 @@ public void testGetIpsecSesssionCloud() {
         getIpsecSession(
                 cb.setConfigurationFormat(AWS).build(),
                 cb.setConfigurationFormat(AWS).build(),
-                ipsecPeerConfigBuilder.build(),
-                ipsecPeerConfigBuilder.build())
+                ipsecPeerConfigBuilder.setLocalAddress(Ip.parse("1.1.1.1")).build(),
+                ipsecPeerConfigBuilder.setLocalAddress(Ip.parse("2.2.2.2")).build())
             .isCloud());
 
     assertTrue(
         getIpsecSession(
                 cb.setConfigurationFormat(CISCO_IOS).build(),
                 cb.setConfigurationFormat(AWS).build(),
-                ipsecPeerConfigBuilder.build(),
-                ipsecPeerConfigBuilder.build())
+                ipsecPeerConfigBuilder.setLocalAddress(Ip.parse("1.1.1.1")).build(),
+                ipsecPeerConfigBuilder.setLocalAddress(Ip.parse("2.2.2.2")).build())
             .isCloud());
 
     assertFalse(
         getIpsecSession(
                 cb.setConfigurationFormat(CISCO_IOS).build(),
                 cb.setConfigurationFormat(CISCO_IOS).build(),
-                ipsecPeerConfigBuilder.build(),
-                ipsecPeerConfigBuilder.build())
+                ipsecPeerConfigBuilder.setLocalAddress(Ip.parse("1.1.1.1")).build(),
+                ipsecPeerConfigBuilder.setLocalAddress(Ip.parse("2.2.2.2")).build())
             .isCloud());
   }
 

projects/batfish/src/main/java/org/batfish/representation/arista/AristaConfiguration.java

@@ -2374,7 +2374,8 @@ public List<Configuration> toVendorIndependentConfigurations() {
           continue;
         }
         // convert to IpsecPeerConfig
-        ipsecPeerConfigBuilder.put(name, toIpsecPeerConfig(tunnel, name, this, c));
+        toIpsecPeerConfig(tunnel, name, this, c, _w)
+            .ifPresent(config -> ipsecPeerConfigBuilder.put(name, config));
       }
     }
     c.setIpsecPeerConfigs(ipsecPeerConfigBuilder.build());

projects/batfish/src/main/java/org/batfish/representation/arista/Conversions.java

@@ -22,6 +22,7 @@
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.stream.Collectors;
@@ -524,18 +525,30 @@ static IpAccessList toIpAccessList(ExtendedAccessList eaList) {
         .build();
   }
 
-  /** Converts a {@link Tunnel} to an {@link IpsecPeerConfig} */
-  static IpsecPeerConfig toIpsecPeerConfig(
+  /**
+   * Converts a {@link Tunnel} to an {@link IpsecPeerConfig}, or empty optional if it can't be
+   * converted
+   */
+  static Optional<IpsecPeerConfig> toIpsecPeerConfig(
       Tunnel tunnel,
       String tunnelIfaceName,
       AristaConfiguration oldConfig,
-      Configuration newConfig) {
+      Configuration newConfig,
+      Warnings w) {
+    Ip localAddress = tunnel.getSourceAddress();
+    if (localAddress == null || !localAddress.valid()) {
+      w.redFlag(
+          String.format(
+              "Cannot create IPsec peer on tunnel %s: cannot determine tunnel source address",
+              tunnelIfaceName));
+      return Optional.empty();
+    }
 
     IpsecStaticPeerConfig.Builder ipsecStaticPeerConfigBuilder =
         IpsecStaticPeerConfig.builder()
             .setTunnelInterface(tunnelIfaceName)
             .setDestinationAddress(tunnel.getDestination())
-            .setLocalAddress(tunnel.getSourceAddress())
+            .setLocalAddress(localAddress)
             .setSourceInterface(tunnel.getSourceInterfaceName())
             .setIpsecPolicy(tunnel.getIpsecProfileName());
 
@@ -554,7 +567,7 @@ static IpsecPeerConfig toIpsecPeerConfig(
               tunnel.getSourceInterfaceName()));
     }
 
-    return ipsecStaticPeerConfigBuilder.build();
+    return Optional.of(ipsecStaticPeerConfigBuilder.build());
   }
 
   /**

projects/batfish/src/main/java/org/batfish/representation/cisco/CiscoConfiguration.java

@@ -3387,7 +3387,8 @@ public List<Configuration> toVendorIndependentConfigurations() {
           continue;
         }
         // convert to IpsecPeerConfig
-        ipsecPeerConfigBuilder.put(name, toIpsecPeerConfig(tunnel, name, this, c));
+        toIpsecPeerConfig(tunnel, name, this, c, _w)
+            .ifPresent(config -> ipsecPeerConfigBuilder.put(name, config));
       }
     }
     c.setIpsecPeerConfigs(ipsecPeerConfigBuilder.build());

projects/batfish/src/main/java/org/batfish/representation/cisco/CiscoConversions.java

@@ -827,18 +827,30 @@ static IpSpace toIpSpace(NetworkObjectGroup networkObjectGroup) {
     return firstNonNull(AclIpSpace.union(networkObjectGroup.getLines()), EmptyIpSpace.INSTANCE);
   }
 
-  /** Converts a {@link Tunnel} to an {@link IpsecPeerConfig} */
-  static IpsecPeerConfig toIpsecPeerConfig(
+  /**
+   * Converts a {@link Tunnel} to an {@link IpsecPeerConfig}, or empty optional if it can't be
+   * converted
+   */
+  static Optional<IpsecPeerConfig> toIpsecPeerConfig(
       Tunnel tunnel,
       String tunnelIfaceName,
       CiscoConfiguration oldConfig,
-      Configuration newConfig) {
+      Configuration newConfig,
+      Warnings w) {
+    Ip localAddress = tunnel.getSourceAddress();
+    if (localAddress == null || !localAddress.valid()) {
+      w.redFlag(
+          String.format(
+              "Cannot create IPsec peer on tunnel %s: cannot determine tunnel source address",
+              tunnelIfaceName));
+      return Optional.empty();
+    }
 
     IpsecStaticPeerConfig.Builder ipsecStaticPeerConfigBuilder =
         IpsecStaticPeerConfig.builder()
             .setTunnelInterface(tunnelIfaceName)
             .setDestinationAddress(tunnel.getDestination())
-            .setLocalAddress(tunnel.getSourceAddress())
+            .setLocalAddress(localAddress)
             .setSourceInterface(tunnel.getSourceInterfaceName())
             .setIpsecPolicy(tunnel.getIpsecProfileName());
 
@@ -857,7 +869,7 @@ static IpsecPeerConfig toIpsecPeerConfig(
               tunnel.getSourceInterfaceName()));
     }
 
-    return ipsecStaticPeerConfigBuilder.build();
+    return Optional.of(ipsecStaticPeerConfigBuilder.build());
   }
 
   /**
@@ -890,19 +902,30 @@ private static Map<String, IpsecPeerConfig> toIpsecPeerConfigs(
         continue;
       }
       // add one IPSec peer config per interface for the crypto map entry
-      ipsecPeerConfigsBuilder.put(
-          String.format("~IPSEC_PEER_CONFIG:%s_%s~", cryptoMapNameSeqNumber, iface.getName()),
-          toIpsecPeerConfig(c, cryptoMapEntry, iface, ipsecPhase2Policy, w));
+      String peerName =
+          String.format("~IPSEC_PEER_CONFIG:%s_%s~", cryptoMapNameSeqNumber, iface.getName());
+      toIpsecPeerConfig(c, cryptoMapEntry, iface, ipsecPhase2Policy, w)
+          .ifPresent(config -> ipsecPeerConfigsBuilder.put(peerName, config));
     }
     return ipsecPeerConfigsBuilder.build();
   }
 
-  private static IpsecPeerConfig toIpsecPeerConfig(
+  private static Optional<IpsecPeerConfig> toIpsecPeerConfig(
       Configuration c,
       CryptoMapEntry cryptoMapEntry,
       org.batfish.datamodel.Interface iface,
       String ipsecPhase2Policy,
       Warnings w) {
+    Ip localAddress =
+        Optional.ofNullable(iface.getConcreteAddress())
+            .map(ConcreteInterfaceAddress::getIp)
+            .orElse(null);
+    if (localAddress == null || !localAddress.valid()) {
+      w.redFlag(
+          String.format(
+              "Cannot create IPsec peer on interface %s: no valid interface IP", iface.getName()));
+      return Optional.empty();
+    }
 
     IpsecPeerConfig.Builder<?, ?> newIpsecPeerConfigBuilder;
 
@@ -934,11 +957,11 @@ private static IpsecPeerConfig toIpsecPeerConfig(
     newIpsecPeerConfigBuilder
         .setSourceInterface(iface.getName())
         .setIpsecPolicy(ipsecPhase2Policy)
-        .setLocalAddress(iface.getConcreteAddress().getIp());
+        .setLocalAddress(localAddress);
 
     setIpsecPeerConfigPolicyAccessList(c, cryptoMapEntry, newIpsecPeerConfigBuilder, w);
 
-    return newIpsecPeerConfigBuilder.build();
+    return Optional.of(newIpsecPeerConfigBuilder.build());
   }
 
   private static void setIpsecPeerConfigPolicyAccessList(

projects/batfish/src/main/java/org/batfish/representation/cisco_xr/CiscoXrConfiguration.java

@@ -2384,7 +2384,8 @@ public List<Configuration> toVendorIndependentConfigurations() {
           continue;
         }
         // convert to IpsecPeerConfig
-        ipsecPeerConfigBuilder.put(name, toIpsecPeerConfig(tunnel, name, this, c));
+        toIpsecPeerConfig(tunnel, name, this, c, _w)
+            .ifPresent(config -> ipsecPeerConfigBuilder.put(name, config));
       }
     }
     c.setIpsecPeerConfigs(ipsecPeerConfigBuilder.build());