Class: Puffy::Rule

Inherits:
Object
  • Object
show all
Defined in:
lib/puffy/rule.rb

Overview

Abstract firewall rule.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(options = {}) ⇒ Rule

Instanciate a firewall Puffy::Rule.

options is a Hash of the Puffy::Rule class attributes

Rule.new({ action: :accept, dir: :in, proto: :tcp, to: { port: 80 } })



64
65
66
67
68
69
70
71
72
 
# File 'lib/puffy/rule.rb', line 64

def initialize(options = {})
  send_options(options)

  self.af ||= detect_af
  self.proto ||= from_proto_hint || to_proto_hint

  raise "unsupported action `#{options[:action]}'" unless valid_action?
  raise 'if from_port or to_port is specified, the protocol must also be given' if port_without_protocol?
end

Instance Attribute Details

#action ⇒ Symbol

The action to perform when the rule apply (:accept or :block).

Returns:

  • (Symbol) —

    Action



57
58
59
 
# File 'lib/puffy/rule.rb', line 57

def action
  @action
end

#af ⇒ Symbol

The address family of the rule (:inet6 or :inet)

Returns:

  • (Symbol) —

    Address family



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#dir ⇒ Symbol

The direction of the rule (:in or :out).

Returns:

  • (Symbol) —

    Direction



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#from ⇒ Hash

The packet source as a Hash for the rule to apply.

:host

address of the source host or network the rule apply to

:port

source port the rule apply to

Returns:



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#in ⇒ String

The interface packets must arrive on for the rule to apply in a forwarding context.

Returns:

  • (String) —

    Interface



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#nat_to ⇒ IPAddr

The packet destination when peforming NAT.

Returns:

  • (IPAddr) —

    IP Adress



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#no_quick ⇒ Boolean

Prevent the rule from being a quick one.

Returns:

  • (Boolean) —

    Quick flag



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#on ⇒ String

The interface the rule applies to.

Returns:

  • (String) —

    Interface



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#out ⇒ String

The interface packets must be sent to for the rule to apply in a forwarding context.

Returns:

  • (String) —

    Interface



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#proto ⇒ Symbol

The protocol the Puffy::Rule applies to (:tcp, :udp, etc).

Returns:

  • (Symbol) —

    Protocol



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#rdr_to ⇒ Hash

The destination as a Hash for redirections.

:host

address of the destination host or network the rule apply to

:port

destination port the rule apply to

Returns:

  • (Hash) —

    Destination



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#return ⇒ Boolean

Whether blocked packets must be returned to sender instead of being silently dropped.

Returns:

  • (Boolean) —

    Return flag



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

#to ⇒ Hash

The packet destination as a Hash for the rule to apply.

:host

address of the destination host or network the rule apply to

:port

destination port the rule apply to

Returns:

  • (Hash) —

    Destination



57
 
# File 'lib/puffy/rule.rb', line 57

attr_accessor :action, :return, :dir, :proto, :af, :on, :in, :out, :from, :to, :nat_to, :rdr_to, :no_quick

Class Method Details

.fwd_rule(rule) ⇒ Puffy::Rule

Instanciate a forward Puffy::Rule.

Parameters:

Returns:



79
80
81
82
83
84
85
86
 
# File 'lib/puffy/rule.rb', line 79

def self.fwd_rule(rule)
  res = rule.dup
  res.on_to_in_out!
  res.to.merge!(res.rdr_to.compact)
  res.rdr_to = nil
  res.dir = :fwd
  res
end

Instance Method Details

#filter? ⇒ Boolean

Return true if the rule is a filter rule.

Returns:

  • (Boolean) 


109
110
111
 
# File 'lib/puffy/rule.rb', line 109

def filter?
  !nat? && !rdr?
end

#from_host ⇒ Object

Returns the source host of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#from_port ⇒ Object

Returns the source port of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#from_proto_hint ⇒ Object

Returns the proto hint of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#fwd? ⇒ Boolean

Returns whether the rule performs forwarding.

Returns:

  • (Boolean) 


134
135
136
 
# File 'lib/puffy/rule.rb', line 134

def fwd?
  dir == :fwd
end

#implicit_ipv4? ⇒ Boolean

Return true if the rule has an IPv4 source or destination.

Returns:

  • (Boolean) 


94
95
96
 
# File 'lib/puffy/rule.rb', line 94

def implicit_ipv4?
  from_ipv4? || to_ipv4? || rdr_to_ipv4? || (rdr_to && af == :inet)
end

#implicit_ipv6? ⇒ Boolean

Return true if the rule has an IPv6 source or destination.

Returns:

  • (Boolean) 


104
105
106
 
# File 'lib/puffy/rule.rb', line 104

def implicit_ipv6?
  from_ipv6? || to_ipv6? || rdr_to_ipv6? || (rdr_to && af == :inet6)
end

#in? ⇒ Boolean

Returns whether the rule applies to incomming packets.

Returns:

  • (Boolean) 


114
115
116
 
# File 'lib/puffy/rule.rb', line 114

def in?
  dir.nil? || dir == :in
end

#ipv4? ⇒ Boolean

Return true if the rule is valid in an IPv4 context.

Returns:

  • (Boolean) 


89
90
91
 
# File 'lib/puffy/rule.rb', line 89

def ipv4?
  af.nil? || af == :inet
end

#ipv6? ⇒ Boolean

Return true if the rule is valid in an IPv6 context.

Returns:

  • (Boolean) 


99
100
101
 
# File 'lib/puffy/rule.rb', line 99

def ipv6?
  af.nil? || af == :inet6
end

#nat? ⇒ Boolean

Returns whether the rule performs Network Address Translation.

Returns:

  • (Boolean) 


124
125
126
 
# File 'lib/puffy/rule.rb', line 124

def nat?
  nat_to
end

#on_to_in_out! ⇒ void

This method returns an undefined value.

Setsthe #in / #out to #on depending on #dir.



168
169
170
171
172
173
174
175
 
# File 'lib/puffy/rule.rb', line 168

def on_to_in_out!
  if dir == :in
    self.in ||= on
  else
    self.out ||= on
  end
  self.on = nil
end

#out? ⇒ Boolean

Returns whether the rule applies to outgoing packets.

Returns:

  • (Boolean) 


119
120
121
 
# File 'lib/puffy/rule.rb', line 119

def out?
  dir.nil? || dir == :out
end

#rdr? ⇒ Boolean

Returns whether the rule is a redirection.

Returns:

  • (Boolean) 


129
130
131
 
# File 'lib/puffy/rule.rb', line 129

def rdr?
  rdr_to_host || rdr_to_port
end

#rdr_to_host ⇒ Object

Returns the redirect destination host of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#rdr_to_port ⇒ Object

Returns the redirect destination port of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#rdr_to_proto_hint ⇒ Object

Returns the proto hint of the Puffy::Rule (does not make sense).



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#to_host ⇒ Object

Returns the destination host of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#to_port ⇒ Object

Returns the destination port of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end

#to_proto_hint ⇒ Object

Returns the proto hint of the Puffy::Rule.



156
157
158
159
160
161
162
163
 
# File 'lib/puffy/rule.rb', line 156

%i[from to rdr_to].each do |destination|
  %i[host port proto_hint].each do |param|
    define_method("#{destination}_#{param}") do
      res = public_send(destination)
      res && res[param]
    end
  end
end