network-local-segment-reach

A source co-located with the destination in the same Subnet reaches it when the destination's SG/NSG/firewall admits the source segment on a listening port.

derived any cloud emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'sg': None} CanReachPort {'dst': None} {'src': None} LocatedIn {'net': None} {'dst': None} LocatedIn {'net': None}

where

node_class(?src) in [Compute, Network] node_class(?dst) in [Compute, Data, Storage] node_type(?net) == Subnet node_type(?sg) in [SecurityGroup, Firewall]

emit

source type	`Compute` `Network`
target type	`Compute` `Data` `Storage`
source	`?src`
target	`?dst`
conditions	`network_reachability`
state logic	ACTIVE when both endpoints are confirmed in the same Subnet and the destination's ingress rule (SG/NSG/firewall) admits the source segment on the port. CONDITIONAL(network_reachability) if placement or the ingress rule is unconfirmed from collection, or if the SG-to-source-segment join is not fully evaluated (see MODELING LIMITATIONS: CANREACHPORT SOURCE SHAPE). BLOCKED if a subnet NACL / stateless firewall DENY covers the source range on the port. Inherit the weakest state of the contributing CanReachPort.

Narrative

{src.name} is co-located with {dst.name} in subnet {net.name} and the destination's security group/NSG admits it on the service port, so {src.name} can reach {dst.name} over the network without traversing any gateway.

Raw rule rules/derived/network-chains.yaml

id: network-local-segment-reach
emits: CanNetworkReach
description: A source co-located with the destination in the same Subnet reaches it when the destination's
  SG/NSG/firewall admits the source segment on a listening port.
applies_to:
- '*'
match:
- - sg: null
  - CanReachPort
  - dst: null
- - src: null
  - LocatedIn
  - net: null
- - dst: null
  - LocatedIn
  - net: null
where:
- node_class(?src) in [Compute, Network]
- node_class(?dst) in [Compute, Data, Storage]
- node_type(?net) == Subnet
- node_type(?sg) in [SecurityGroup, Firewall]
emit:
  source_type:
  - Compute
  - Network
  target_type:
  - Compute
  - Data
  - Storage
  source: ?src
  target: ?dst
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'ACTIVE when both endpoints are confirmed in the same Subnet and the destination''s ingress
    rule (SG/NSG/firewall) admits the source segment on the port. CONDITIONAL(network_reachability) if
    placement or the ingress rule is unconfirmed from collection, or if the SG-to-source-segment join
    is not fully evaluated (see MODELING LIMITATIONS: CANREACHPORT SOURCE SHAPE). BLOCKED if a subnet
    NACL / stateless firewall DENY covers the source range on the port. Inherit the weakest state of the
    contributing CanReachPort.'
  confidence: min(contributing_confidences)
  derived_from:
  - ?sg CanReachPort ?dst
  - ?src LocatedIn ?net
  - ?dst LocatedIn ?net
  false_positive_note: "The judgment is (a) the destination ingress rule genuinely admits THIS source\
    \ segment (a 0.0.0.0/0 SG is internet exposure \u2014 rule 5 \u2014 not intra-segment; a source-SG\
    \ reference or the source's own CIDR/subnet must match) and (b) both endpoints are truly in the same\
    \ L3 Subnet (node_type == Subnet). Do NOT emit for endpoints in different subnets that lack a route\
    \ (that is rule 2). A NACL or stateless firewall DENY is a real control: emit BLOCKED, not ACTIVE.\
    \ This edge is the reachability PRECONDITION only \u2014 the exploit of the listening service is the\
    \ service adapter's / can-control's job."
  narrative: '{src.name} is co-located with {dst.name} in subnet {net.name} and the destination''s security
    group/NSG admits it on the service port, so {src.name} can reach {dst.name} over the network without
    traversing any gateway.'