Html out

README.md

@@ -101,6 +101,11 @@ The arguments to `--resource_list` and to `--base_resource_list` should be one o
 - `--output_endpoints`\
   Choose endpoints type in output (pods/deployments).\
   *default:* deployments
+  - `--explain`\
+  A pair of node names (comma separated) to explain the policies affecting their connection or lack of it. Relevant only for connectivity query.\
+  Connections including IP-Blocks will show only the configurations of the node in that connection (since, IP-Blocks does
+  not have configurations). IP-Blocks should be places in CIDR format as seen in the query results (run the connectivity query first, to see the nodes there).\
+  e.g. default/pod-A1,default/deployment-B1.
   - `--print_ipv6`\
   include IPv6 range in the query results even when the policies of the config do not contain any IPv6 addresses.
 

docs/SchemeFileFormat.md

@@ -78,15 +78,15 @@ For example: `my_set/prod_ns/deny_all_policy`. If there are multiple policies na
 #### <a name="outputconfig"></a>Output Configuration object
 The supported entries in the outputConfiguration object are as follows:
 
-| Field            | Description                                                                                                     | Value                                                        |
-|------------------|-----------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
-| outputFormat     | Output format specification.                                                                                    | string [ txt / yaml / csv / md / dot / jpg/ txt_no_fw_rules] |
-| outputPath       | A file path to redirect output into.                                                                            | string                                                       |
-| outputEndpoints  | Choose endpoints type in output.                                                                                | string [ pods / deployments ]                                |
-| subset           | A dict object with the defined subset elements to display in the output                                         | [subset](#subset) object                                     |
-| fullExplanation  | Choose if to print all counterexamples causing the query result in the output                                   | bool                                                         |
-| excludeIPv6Range | If the policies of the config do not contain any IPv6 addresses, do not include IPv6 range in the query results | bool  [default: True]                                        |
-
+| Field            | Description                                                                                                                                                                                                                                                                                                                                                                                                                            | Value                                                        |
+|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
+| outputFormat     | Output format specification.                                                                                                                                                                                                                                                                                                                                                                                                           | string [ txt / yaml / csv / md / dot / jpg/ txt_no_fw_rules] |
+| outputPath       | A file path to redirect output into.                                                                                                                                                                                                                                                                                                                                                                                                   | string                                                       |
+| outputEndpoints  | Choose endpoints type in output.                                                                                                                                                                                                                                                                                                                                                                                                       | string [ pods / deployments ]                                |
+| subset           | A dict object with the defined subset elements to display in the output                                                                                                                                                                                                                                                                                                                                                                | [subset](#subset) object                                     |
+| fullExplanation  | Choose if to print all counterexamples causing the query result in the output                                                                                                                                                                                                                                                                                                                                                          | bool                                                         |
+| excludeIPv6Range | If the policies of the config do not contain any IPv6 addresses, do not include IPv6 range in the query results                                                                                                                                                                                                                                                                                                                        | bool  [default: True]                                        |
+| explain          | A pair of node names (comma separated) to explain the policies affecting their connection or lack of it. Relevant only for connectivityMap query. Connections including IP-Blocks will show only the configurations of the node in that connection (since, IP-Blocks does not have configurations). IP-Blocks should be places in CIDR format as seen in the query results (run the connectivity query first, to see the nodes there). | string [ ns/node1,ns/node2 ]                           |
 
 #### <a name="subset"></a>Subset object
 The supported entries in the subset object are as follows:

nca/FWRules/ConnectivityGraph.py

@@ -343,7 +343,7 @@ def get_connectivity_dot_format_str(self, connectivity_restriction=None):
 
         dot_graph = DotGraph(name)
         peers_groups = self._get_equals_groups()
-        # we are going to treat a a peers_group as one peer.
+        # we are going to treat a peers_group as one peer.
         # the first peer in the peers_group is representing the group
         # we will add the text of all the peers in the group to this peer
         for peers_group, group_connection in peers_groups:
@@ -387,7 +387,7 @@ def get_connectivity_dot_format_str(self, connectivity_restriction=None):
                 dot_graph.add_edge(src_name=edge[0][0], dst_name=edge[1][0], label=conn_str, is_dir=True)
             for edge in undirected_edges | cliques_edges:
                 dot_graph.add_edge(src_name=edge[0][0], dst_name=edge[1][0], label=conn_str, is_dir=False)
-        return dot_graph.to_str()
+        return dot_graph.to_str(self.output_config.outputFormat == 'dot')
 
     def get_minimized_firewall_rules(self):
         """

nca/FWRules/DotGraph.py

@@ -96,19 +96,22 @@ def add_edge(self, src_name, dst_name, label, is_dir):
         self.edges.append(self.Edge(src_node, dst_node, label, is_dir))
         self.labels.add(label)
 
-    def to_str(self):
+    def to_str(self, with_header=True):
         """
         creates a string in a dot file format
+        :param bool with_header: whether to add a header to the graph (dot has one, but html does not)
         return str: the string
         """
         output_result = f'// The Connectivity Graph of {self.name}\n'
         output_result += 'digraph ' + '{\n'
 
-        output_result += f'\tlabel=\"Connectivity Graph of {self.name}\"'
+        if with_header:
+            output_result += f'\tlabel=\"Connectivity Graph of {self.name}\"'
         output_result += '\tlabelloc = "t"\n'
-        output_result += '\tfontsize=30\n'
-        output_result += '\tfontcolor=maroon\n'
-        output_result += '\tsubgraph cluster_map_explanation {\n'
+        if with_header:
+            output_result += '\tfontsize=30\n'
+            output_result += '\tfontcolor=maroon\n'
+            output_result += '\tsubgraph cluster_map_explanation {\n'
         if self._set_labels_dict():
             output_result += self._labels_dict_to_str()
         self.subgraphs = dict(sorted(self.subgraphs.items()))
@@ -117,9 +120,11 @@ def to_str(self):
         output_result += '\tcolor=white\n'
         output_result += self._explanation_to_str()
         output_result += '\tlabelloc = "b"\n'
-        output_result += '\tfontsize=15\n'
+        if with_header:
+            output_result += '\tfontsize=15\n'
         output_result += '\tfontcolor=maroon\n'
-        output_result += '\t}\n'
+        if with_header:
+            output_result += '\t}\n'
         output_result += '}\n'
         return output_result
 

nca/FWRules/FWRule.py

@@ -383,7 +383,8 @@ def get_pod_str(self):
         """
         :return: string for the field src_pods or dst_pods in representation for txt rule format
         """
-        return f'[{self._get_pods_names()}]'
+        sorted_pods_names = ', '.join(sorted(self._get_pods_names().split(', ')))
+        return f'[{sorted_pods_names}]'
 
     def _get_pods_names(self):
         res = ''