You’re on the network security team for a fintech processing millions of card authorizations per day. Services communicate inside a private network, and auditors require that certain directed service pairs must never be allowed (e.g., db -> api). Your job is to generate the smallest set of allow rules without accidentally over-permitting traffic.
Implement build_minimized_security_rules(flows, required_isolation).
You are given:
flows: a list of flows, each flow = [src, dst, protocol, start_port, end_port]required_isolation: a list of directed forbidden pairs [src, dst] meaning traffic from src to dst is forbiddenReturn a minimized list of allow rules by merging port ranges that share the same (src, dst, protocol) and whose port intervals overlap or are adjacent.
Within the same (src, dst, protocol) group, merge intervals [a,b] and [c,d] if c <= b + 1 (overlap or adjacency). The output intervals must be disjoint and represent the same allowed ports as the input.
ValueError)Raise ValueError if any flow:
(src, dst) appears in required_isolation"tcp" or "udp")[0, 65535], or start_port > end_port)Example 1
flows = [["edge","api","tcp",80,80],["edge","api","tcp",81,90],["edge","api","tcp",443,443]], required_isolation = [["db","api"]][["edge","api","tcp",80,90],["edge","api","tcp",443,443]][80,80] and [81,90] are adjacent, so they merge.Example 2
flows = [["api","db","tcp",5432,5432],["db","api","tcp",5432,5432]], required_isolation = [["db","api"]]ValueErrordb -> api is explicitly forbidden.src, dst, or protocol.