Class: Puffy::Formatters::Netfilter::Rule

Inherits:
Base::Rule
  • Object
show all
Defined in:
lib/puffy/formatters/netfilter.rb

Overview

Netfilter implementation of a Puffy Rule formatter.

Instance Method Summary collapse

Instance Method Details

#emit_ct_rule(rule) ⇒ Object 



130
131
132
133
134
135
136
137
138
139
 
# File 'lib/puffy/formatters/netfilter.rb', line 130

def emit_ct_rule(rule)
  parts = ['-A PREROUTING']
  parts << emit_if(rule)
  parts << emit_proto(rule)
  parts << emit_src_port(rule)
  parts << emit_dst_port(rule)
  parts << '-j CT'
  parts << "--helper #{Ruleset.known_conntrack_helpers[rule.to_port]}"
  pp_rule(parts)
end

#emit_dnat(rule) ⇒ Object 



247
248
249
250
251
 
# File 'lib/puffy/formatters/netfilter.rb', line 247

def emit_dnat(rule)
  res = "-j DNAT --to-destination #{rule.rdr_to_host}"
  res += ":#{rule.rdr_to_port}" if rule.rdr_to_port && rule.rdr_to_port != rule.to_port
  res
end

#emit_dst(rule) ⇒ Object 



215
216
217
 
# File 'lib/puffy/formatters/netfilter.rb', line 215

def emit_dst(rule)
  emit_dst_host(rule) + emit_dst_port(rule)
end

#emit_dst_host(rule) ⇒ Object 



219
220
221
222
223
224
225
 
# File 'lib/puffy/formatters/netfilter.rb', line 219

def emit_dst_host(rule)
  if rule.to_host
    ['-d', emit_address(rule.to_host)]
  else
    []
  end
end

#emit_dst_port(rule) ⇒ Object 



227
228
229
230
231
232
233
 
# File 'lib/puffy/formatters/netfilter.rb', line 227

def emit_dst_port(rule)
  if rule.to_port
    ['--dport', emit_port(rule.to_port)]
  else
    []
  end
end

#emit_filter_rule(rule) ⇒ Object 



155
156
157
158
159
160
161
162
163
164
165
 
# File 'lib/puffy/formatters/netfilter.rb', line 155

def emit_filter_rule(rule)
  iptables_direction = { in: 'INPUT', out: 'OUTPUT', fwd: 'FORWARD' }
  parts = ["-A #{iptables_direction[rule.dir]}"]
  parts << '-m conntrack --ctstate NEW' if %i[tcp udp].include?(rule.proto)
  parts << emit_if(rule)
  parts << emit_proto(rule)
  parts << emit_src(rule)
  parts << emit_dst(rule)
  parts << emit_jump(rule)
  pp_rule(parts)
end

#emit_if(rule) ⇒ Object 



167
168
169
170
171
172
173
 
# File 'lib/puffy/formatters/netfilter.rb', line 167

def emit_if(rule)
  if rule.on
    emit_on(rule)
  else
    emit_in_out(rule)
  end
end

#emit_in_out(rule) ⇒ Object 



184
185
186
187
188
189
 
# File 'lib/puffy/formatters/netfilter.rb', line 184

def emit_in_out(rule)
  parts = []
  parts << "-i #{rule.in}" if rule.in
  parts << "-o #{rule.out}" if rule.out
  parts
end

#emit_jump(rule) ⇒ Object 



253
254
255
 
# File 'lib/puffy/formatters/netfilter.rb', line 253

def emit_jump(rule)
  "-j #{Puffy::Formatters::Netfilter.iptables_action(rule)}"
end

#emit_on(rule) ⇒ Object 



175
176
177
178
179
180
181
182
 
# File 'lib/puffy/formatters/netfilter.rb', line 175

def emit_on(rule)
  on_direction_flag = { in: '-i', out: '-o' }

  return unless rule.on || rule.dir

  matches = /(!)?(.*)/.match(rule.on)
  [matches[1], on_direction_flag[rule.dir], matches[2]].compact
end

#emit_postrouting_rule(rule) ⇒ Object 



141
142
143
 
# File 'lib/puffy/formatters/netfilter.rb', line 141

def emit_postrouting_rule(rule)
  "-A POSTROUTING -o #{rule.on} -j MASQUERADE"
end

#emit_prerouting_rule(rule) ⇒ Object 



145
146
147
148
149
150
151
152
153
 
# File 'lib/puffy/formatters/netfilter.rb', line 145

def emit_prerouting_rule(rule)
  parts = ['-A PREROUTING']
  parts << emit_on(rule)
  parts << emit_proto(rule)
  parts << emit_src(rule)
  parts << emit_dst(rule)
  parts << emit_redirect_or_dnat(rule)
  pp_rule(parts)
end

#emit_proto(rule) ⇒ Object 



191
192
193
 
# File 'lib/puffy/formatters/netfilter.rb', line 191

def emit_proto(rule)
  "-p #{rule.proto}" if rule.proto
end

#emit_redirect(rule) ⇒ Object 



243
244
245
 
# File 'lib/puffy/formatters/netfilter.rb', line 243

def emit_redirect(rule)
  "-j REDIRECT --to-port #{rule.rdr_to_port}"
end

#emit_redirect_or_dnat(rule) ⇒ Object 



235
236
237
238
239
240
241
 
# File 'lib/puffy/formatters/netfilter.rb', line 235

def emit_redirect_or_dnat(rule)
  if Puffy::Formatters::Base.loopback_addresses.include?(rule.rdr_to_host)
    emit_redirect(rule)
  else
    emit_dnat(rule)
  end
end

#emit_rule(rule) ⇒ Object

Returns a Netfilter String representation of the provided rule Puffy::Rule.



120
121
122
123
124
125
126
127
128
 
# File 'lib/puffy/formatters/netfilter.rb', line 120

def emit_rule(rule)
  if rule.nat?
    emit_postrouting_rule(rule)
  elsif rule.rdr?
    emit_prerouting_rule(rule)
  else
    emit_filter_rule(rule)
  end
end

#emit_src(rule) ⇒ Object 



195
196
197
 
# File 'lib/puffy/formatters/netfilter.rb', line 195

def emit_src(rule)
  emit_src_host(rule) + emit_src_port(rule)
end

#emit_src_host(rule) ⇒ Object 



199
200
201
202
203
204
205
 
# File 'lib/puffy/formatters/netfilter.rb', line 199

def emit_src_host(rule)
  if rule.from_host
    ['-s', emit_address(rule.from_host)]
  else
    []
  end
end

#emit_src_port(rule) ⇒ Object 



207
208
209
210
211
212
213
 
# File 'lib/puffy/formatters/netfilter.rb', line 207

def emit_src_port(rule)
  if rule.from_port
    ['--sport', emit_port(rule.from_port)]
  else
    []
  end
end

#pp_rule(parts) ⇒ Object 



257
258
259
 
# File 'lib/puffy/formatters/netfilter.rb', line 257

def pp_rule(parts)
  parts.flatten.compact.join(' ')
end