901 - changed ACL instantiation and changed acl t private _acl (list not dict) attribute, added laydown_ACL.yaml for testing, fixed encoding of acl rules to integers for obs space, added ACL position to node action space and added generic test where agents adds two ACL rules.

tests/config/obs_tests/laydown_ACL.yaml

@@ -0,0 +1,86 @@
+- item_type: PORTS
+  ports_list:
+    - port: '80'
+    - port: '21'
+- item_type: SERVICES
+  service_list:
+    - name: TCP
+    - name: FTP
+
+########################################
+# Nodes
+- item_type: NODE
+  node_id: '1'
+  name: PC1
+  node_class: SERVICE
+  node_type: COMPUTER
+  priority: P5
+  hardware_state: 'ON'
+  ip_address: 192.168.1.1
+  software_state: COMPROMISED
+  file_system_state: GOOD
+  services:
+    - name: TCP
+      port: '80'
+      state: GOOD
+    - name: FTP
+      port: '21'
+      state: GOOD
+- item_type: NODE
+  node_id: '2'
+  name: SERVER
+  node_class: SERVICE
+  node_type: SERVER
+  priority: P5
+  hardware_state: 'ON'
+  ip_address: 192.168.1.2
+  software_state: GOOD
+  file_system_state: GOOD
+  services:
+    - name: TCP
+      port: '80'
+      state: GOOD
+    - name: FTP
+      port: '21'
+      state: OVERWHELMED
+- item_type: NODE
+  node_id: '3'
+  name: SWITCH1
+  node_class: ACTIVE
+  node_type: SWITCH
+  priority: P2
+  hardware_state: 'ON'
+  ip_address: 192.168.1.3
+  software_state: GOOD
+  file_system_state: GOOD
+
+########################################
+# Links
+- item_type: LINK
+  id: '4'
+  name: link1
+  bandwidth: 1000
+  source: '1'
+  destination: '3'
+- item_type: LINK
+  id: '5'
+  name: link2
+  bandwidth: 1000
+  source: '3'
+  destination: '2'
+
+#########################################
+# IERS
+- item_type: GREEN_IER
+  id: '5'
+  start_step: 0
+  end_step: 5
+  load: 999
+  protocol: TCP
+  port: '80'
+  source: '1'
+  destination: '2'
+  mission_criticality: 5
+
+#########################################
+# ACL Rules

tests/config/single_action_space_fixed_blue_actions_main_config.yaml

@@ -24,6 +24,19 @@ load_agent: False
 # File path and file name of agent if you're loading one in
 agent_load_file: C:\[Path]\[agent_saved_filename.zip]
 
+
+
+# Choice whether to have an ALLOW or DENY implicit rule or not (TRUE or FALSE)
+apply_implicit_rule: True
+# Implicit ACL firewall rule at end of lists to be default action or no rule can be selected (ALLOW or DENY)
+implicit_acl_rule: DENY
+# Total number of ACL rules allowed in the environment
+max_number_acl_rules: 10
+
+observation_space:
+  components:
+    - name: ACCESS_CONTROL_LIST
+
 # Environment config values
 # The high value for the observation space
 observation_space_high_value: 1000000000

tests/test_acl.py

@@ -7,7 +7,7 @@ from primaite.acl.acl_rule import ACLRule
 
 def test_acl_address_match_1():
     """Test that matching IP addresses produce True."""
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     rule = ACLRule("ALLOW", "192.168.1.1", "192.168.1.2", "TCP", "80")
 
@@ -16,7 +16,7 @@ def test_acl_address_match_1():
 
 def test_acl_address_match_2():
     """Test that mismatching IP addresses produce False."""
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     rule = ACLRule("ALLOW", "192.168.1.1", "192.168.1.2", "TCP", "80")
 
@@ -25,7 +25,7 @@ def test_acl_address_match_2():
 
 def test_acl_address_match_3():
     """Test the ANY condition for source IP addresses produce True."""
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     rule = ACLRule("ALLOW", "ANY", "192.168.1.2", "TCP", "80")
 
@@ -34,7 +34,7 @@ def test_acl_address_match_3():
 
 def test_acl_address_match_4():
     """Test the ANY condition for dest IP addresses produce True."""
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     rule = ACLRule("ALLOW", "192.168.1.1", "ANY", "TCP", "80")
 
@@ -44,7 +44,7 @@ def test_acl_address_match_4():
 def test_check_acl_block_affirmative():
     """Test the block function (affirmative)."""
     # Create the Access Control List
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     # Create a rule
     acl_rule_permission = "ALLOW"
@@ -68,7 +68,7 @@ def test_check_acl_block_affirmative():
 def test_check_acl_block_negative():
     """Test the block function (negative)."""
     # Create the Access Control List
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     # Create a rule
     acl_rule_permission = "DENY"
@@ -93,7 +93,7 @@ def test_check_acl_block_negative():
 def test_rule_hash():
     """Test the rule hash."""
     # Create the Access Control List
-    acl = AccessControlList("DENY", 10)
+    acl = AccessControlList(True, "DENY", 10)
 
     rule = ACLRule("DENY", "192.168.1.1", "192.168.1.2", "TCP", "80")
     hash_value_local = hash(rule)

tests/test_observation_space.py

@@ -1,4 +1,7 @@
 """Test env creation and behaviour with different observation spaces."""
+
+import time
+
 import numpy as np
 import pytest
 
@@ -12,6 +15,46 @@ from tests import TEST_CONFIG_ROOT
 from tests.conftest import _get_primaite_env_from_config
 
 
+def run_generic_set_actions(env: Primaite):
+    """Run against a generic agent with specified blue agent actions."""
+    # Reset the environment at the start of the episode
+    # env.reset()
+    training_config = env.training_config
+    for episode in range(0, training_config.num_episodes):
+        for step in range(0, training_config.num_steps):
+            # Send the observation space to the agent to get an action
+            # TEMP - random action for now
+            # action = env.blue_agent_action(obs)
+            action = 0
+            print("\nStep:", step)
+            if step == 5:
+                # [1, 1, 2, 1, 1, 1, 2] ACL Action
+                # Creates an ACL rule
+                # Allows traffic from SERVER to PC1 on port TCP 80 and place ACL at position 2
+                action = 291
+            elif step == 7:
+                # [1, 1, 3, 1, 2, 2, 1] ACL Action
+                # Creates an ACL rule
+                # Allows traffic from PC1 to SWITCH 1 on port UDP at position 1
+                action = 425
+            # Run the simulation step on the live environment
+            obs, reward, done, info = env.step(action)
+            # Update observations space and return
+            env.update_environent_obs()
+
+            # Break if done is True
+            if done:
+                break
+
+            # Introduce a delay between steps
+            time.sleep(training_config.time_delay / 1000)
+
+        # Reset the environment at the end of the episode
+        # env.reset()
+
+    # env.close()
+
+
 @pytest.fixture
 def env(request):
     """Build Primaite environment for integration tests of observation space."""
@@ -131,11 +174,11 @@ class TestNodeLinkTable:
         assert np.array_equal(
             obs,
             [
-                [1, 1, 3, 1, 1, 1],
-                [2, 1, 1, 1, 1, 4],
-                [3, 1, 1, 1, 0, 0],
-                [4, 0, 0, 0, 999, 0],
-                [5, 0, 0, 0, 999, 0],
+                [1, 1, 3, 1, 1, 1, 0],
+                [2, 1, 1, 1, 1, 4, 1],
+                [3, 1, 1, 1, 0, 0, 2],
+                [4, 0, 0, 0, 999, 0, 3],
+                [5, 0, 0, 0, 999, 0, 4],
             ],
         )
 
@@ -260,4 +303,16 @@ class TestAccessControlList:
         # therefore the first and third elements should be 6 and all others 0
         # (`7` corresponds to 100% utiilsation and `6` corresponds to 87.5%-100%)
         print(obs)
-        assert np.array_equal(obs, [6, 0, 6, 0])
+        assert np.array_equal(obs, [])
+
+    def test_observation_space(self):
+        """Test observation space is what is expected when an agent adds ACLs during an episode."""
+        # Used to use env from test fixture but AtrributeError function object has no 'training_config'
+        env = _get_primaite_env_from_config(
+            training_config_path=TEST_CONFIG_ROOT
+            / "single_action_space_fixed_blue_actions_main_config.yaml",
+            lay_down_config_path=TEST_CONFIG_ROOT / "obs_tests/laydown_ACL.yaml",
+        )
+        run_generic_set_actions(env)
+
+        # print("observation space",env.observation_space)

tests/test_single_action_space.py

@@ -66,7 +66,7 @@ def test_single_action_space_is_valid():
         if len(dict_item) == 4:
             contains_node_actions = True
         # Link action detected
-        elif len(dict_item) == 6:
+        elif len(dict_item) == 7:
             contains_acl_actions = True
     # If both are there then the ANY action type is working
     if contains_node_actions and contains_acl_actions:
@@ -92,7 +92,7 @@ def test_agent_is_executing_actions_from_both_spaces():
     access_control_list = env.acl
     # Use the Access Control List object acl object attribute to get dictionary
     # Use dictionary.values() to get total list of all items in the dictionary
-    acl_rules_list = access_control_list.acl.values()
+    acl_rules_list = access_control_list.acl
     # Length of this list tells you how many items are in the dictionary
     # This number is the frequency of Access Control Rules in the environment
     # In the scenario, we specified that the agent should create only 1 acl rule