(aws-ec2): cannot create ingress rule for protocols ESP or AH

[rectalogic]

We need ingress and egress rules for protocol 50 (ESP) and 51 (AH), ec2.Port has an extremely limited set of protocol values it allows.

Reproduction Steps

#!/usr/bin/env python3

from aws_cdk import core, aws_ec2 as ec2


app = core.App()
stack = core.Stack()
vpc = ec2.Vpc(stack, "VPC", cidr="10.0.0.0/16")
vpn = ec2.SecurityGroup(
    stack,
    "VPNSecurityGroup",
    vpc=vpc,
    description="External VPN",
)
vpn.add_ingress_rule(peer=ec2.Peer.ipv4("0.0.0.0/0"), connection=ec2.Port(protocol="50", string_representation="ESP"), description="protocol 50, ESP")
vpn.add_ingress_rule(peer=ec2.Peer.ipv4("0.0.0.0/0"), connection=ec2.Port(protocol="51", string_representation="AH"), description="protocol 51, AH")

app.synth()

What did you expect to happen?

Should be able to add legal CFN rules.

What actually happened?

$ cdk synth
jsii.errors.JavaScriptError:
  Error: Expected enum value, got "50"
      at Object.deserialize (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3508:31)
      at Kernel._toSandbox (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3071:69)
      at /private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3636:37
      at mapValues (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3907:35)
      at Object.deserialize (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3632:28)
      at Kernel._toSandbox (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3071:69)
      at /private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3119:42
      at Array.map (<anonymous>)
      at Kernel._boxUnboxParameters (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3119:27)
      at Kernel._toSandboxValues (/private/var/folders/v1/y34vbhp158x18m1dqjzb57mw0001yl/T/tmp3q3mzj3r/lib/program.js:3105:29)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "app.py", line 15, in <module>
    vpn.add_ingress_rule(peer=ec2.Peer.ipv4("0.0.0.0/0"), connection=ec2.Port(protocol="50", string_representation="ESP"), description="protocol 50, ESP")
  File "/Users/aw/Projects/cureatr/dev/cureatr/ops/ec2/protocol/.venv/lib/python3.7/site-packages/jsii/_runtime.py", line 83, in __call__
    inst = super().__call__(*args, **kwargs)
  File "/Users/aw/Projects/cureatr/dev/cureatr/ops/ec2/protocol/.venv/lib/python3.7/site-packages/aws_cdk/aws_ec2/__init__.py", line 37646, in __init__
    jsii.create(Port, self, [props])
  File "/Users/aw/Projects/cureatr/dev/cureatr/ops/ec2/protocol/.venv/lib/python3.7/site-packages/jsii/_kernel/__init__.py", line 281, in create
    for iface in getattr(klass, "__jsii_ifaces__", [])
  File "/Users/aw/Projects/cureatr/dev/cureatr/ops/ec2/protocol/.venv/lib/python3.7/site-packages/jsii/_kernel/providers/process.py", line 344, in create
    return self._process.send(request, CreateResponse)
  File "/Users/aw/Projects/cureatr/dev/cureatr/ops/ec2/protocol/.venv/lib/python3.7/site-packages/jsii/_kernel/providers/process.py", line 326, in send
    raise JSIIError(resp.error) from JavaScriptError(resp.stack)
jsii.errors.JSIIError: Expected enum value, got "50"
Subprocess exited with error 1

Environment

• CDK CLI Version : 1.91.0 (build 0f728ce)
• Framework Version: 1.91.0
• Node.js Version: v14.15.0
• OS : macOS 10.15.7
• Language (Version): Python 3.7.9

Other

Make ec2.Port protocol a string instead of a limited enum

---

This is 🐛 Bug Report

[rix0rrr]

Good call. They need to be added here: https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-ec2/lib/port.ts#L7

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[rectalogic]

@hollanddd the merged fix is incorrect, see my comments on the PR. THis issue should be reopened

[rectalogic]

I think this should be changed to allow string since protocol “-1” is also valid

readonly protocol: Protocol | string;

https://github.com/hollanddd/aws-cdk/blob/eb560ca9585c15bf57f209922e8c705a921a4f51/packages/%40aws-cdk/aws-ec2/lib/port.ts#L23

[hollanddd]

Thanks for the heads up. I think the convention would be to include all for each of the protocols. Something like:

  /**
   * All ESP traffic
   */
  public static allEsp(): Port {
    return new Port({
      protocol: Protocol.ESP,
      fromPort: -1,
      toPort: -1,
      stringRepresentation: 'ESP -1',
    });
  }