Woori Financial Group AWS security architecture Design and implementation

Computing network coverage (related public repository pf-09)

What this code does: Takes the target ranges to check and the CIDRs of the firewall rules, and returns only the ranges that no rule covers. It applies the rules one by one: a range that fits entirely inside a rule is dropped, a range that a rule covers only in part keeps just the uncovered remainder, and malformed CIDRs are skipped. An empty result means the requested traffic is already open, and anything left is exactly the range that still needs opening, so the decision needs no duplicate rules.

def uncovered_networks(
    targets: Iterable[ipaddress.IPv4Network], rule_cidrs: Iterable[str]
) -> list[ipaddress.IPv4Network]:
    """The parts of the targets that no rule reaches."""
    remaining = list(targets)
    for cidr in rule_cidrs:
        try:
            rule = ipaddress.IPv4Network(cidr, strict=False)
        except ValueError:
            continue
        next_round: list[ipaddress.IPv4Network] = []
        for network in remaining:
            if network.subnet_of(rule):
                continue
            if rule.subnet_of(network):
                next_round.extend(network.address_exclude(rule))
            else:
                next_round.append(network)
        remaining = next_round
    return remaining