class Asbestos::Host

Attributes

addresses[R]
chains[R]
groups[R]
interfaces[R]
name[R]
rulesets[R]
template[RW]

the HostTemplate that built this host

Public Class Methods

[](name) click to toggle source

returns a lazily evaluated block, to allow hosts to be defined in the DSL without a lot of hoopla

# File lib/asbestos/host.rb, line 11
def [](name)
  lambda { @all[name] }
end
new(name) click to toggle source
# File lib/asbestos/host.rb, line 28
def initialize(name)
  @name = name
  @groups = []
  @rulesets = []

  @chains = {}

  @interfaces = {} # maps interface's tag to /dev name
  @addresses = {} # maps interface's /dev name to an ip address


  Asbestos.with_indifferent_access! @chains
  Asbestos.with_indifferent_access! @interfaces
  Asbestos.with_indifferent_access! @addresses

  if generating_rules_for_current_host?
    Asbestos.interfaces.each do |if_name, info|
      @addresses[if_name] = info[:inet_addr]
    end
  end

  #
  # Define the necessary chains
  # # FIXME do we need :forward too?
  #
  [:input, :output].each do |name|
    chain(name, :accept)
  end

  self.class.all[name] = self
end

Public Instance Methods

chain(name, default_action = :none) click to toggle source

Defines a firewall chain on this host, this may be an IPTables-only concept.

The default_action here is also called the chain’s “policy” in IPTables parlance

# File lib/asbestos/host.rb, line 174
def chain(name, default_action = :none)
  @chains[name.downcase.to_sym] = default_action
end
debug() click to toggle source
# File lib/asbestos/host.rb, line 60
def debug
  [
    "Hostname: #{@name}",
    (@template ? "  Template: #{@template}" : nil),
    "  Interfaces: #{@interfaces}",
    "  Addresses: #{@addresses}",
  ].tap do |a|
    a << "  Groups: #{@groups.sort.join(', ')}" unless @groups.empty?
    unless @rulesets.empty?
      a << "  RuleSets/Services:"
      @rulesets.each { |s| a << "    #{s.inspect}" }
    end
  end.join("\n")
end
generating_rules_for_current_host?() click to toggle source

Indicates if Asbestos is generating rules for the host it’s running on

# File lib/asbestos/host.rb, line 89
def generating_rules_for_current_host?
  Asbestos.hostname.to_s == @name.to_s
end
group(name = nil) click to toggle source

Places this host in a named group

host ‘dax’ do

group :developers

end

# File lib/asbestos/host.rb, line 100
def group(name = nil)
  if name
    @groups << name
    self.class.groups[name] ||= []
    self.class.groups[name] << self
  else
    @groups
  end
end
inspect() click to toggle source
# File lib/asbestos/host.rb, line 75
def inspect
  "#<Host name:#{name}>"
end
Also aliased as: to_s
interface(tag, if_names, address = nil) { |self, if_name| ... } click to toggle source

Defines an interface on this host with a given “tag”. The interface’s address can be defined explicitly, or at runtime via a block.

host ‘dax’ do

group :developers

interface :external, :eth0  #=> address is "dax_external"
interface :dmz, [:eth1, :eth2]  #=> addresses are "dax_dmz_eth1" and "dax_dmz_eth2"

interface :internal, :eth3 do |host|
  [host.group, host.name, 'foo'].join('_')
end  #=> address is "developers_dax_foo"

interface :internal, :eth4, 'bar' #=> address is "bar"

end

# File lib/asbestos/host.rb, line 127
def interface(tag, if_names, address = nil, &block)
  interfaces = [*@interfaces[tag], *if_names].compact.uniq
  raise "single address, #{address}, given for multiple interfaces, #{interfaces}, on host #{name}" if interfaces.length > 1 && address

  @interfaces[tag] = interfaces

  # determine the address for each interface
  interfaces.each do |if_name|
    new_address = \
      if !address
        if block_given? 
          yield(self, if_name)
        else
          if interfaces.length > 1
            "#{name}_#{tag}_#{if_name}"
          else
            "#{name}_#{tag}"
          end
        end
      else
        address
      end
    @addresses[if_name] = new_address
  end

end
log_denials() click to toggle source

Indicates that this host should log denied firewall packets.

host ‘dax’ do

log_denials

end

# File lib/asbestos/host.rb, line 160
def log_denials
  @log_denials = true
end
log_denials?() click to toggle source
# File lib/asbestos/host.rb, line 164
def log_denials?
  !!@log_denials
end
method_missing(rule_set_name, args = {}) click to toggle source

Missing methods should be the name of RuleSets, if not, raise an error

This is similar to the “runs” method above, but for RuleSets, rather than services.

# File lib/asbestos/host.rb, line 238
def method_missing(rule_set_name, args = {})
  template = Asbestos::RuleSet[rule_set_name]
  raise %{Unknown host DSL call : "#{rule_set_name}" for host "#{name}"} unless template

  @rulesets << \
    Asbestos::RuleSet.new(rule_set_name, self, template).tap do |rs|
      # override template defaults with provided options
      args.each do |k, v|
        rs.send k, v
      end
    end
end
rules() click to toggle source

Determine this host’s firewall rules, according to the firewall type.

# File lib/asbestos/host.rb, line 208
def rules
  #
  # This is called first in case any preable needs to be declared (chains, specifically)
  #
  _ruleset_rules = ruleset_rules

  [
    Asbestos.firewall.preamble(self),
    _ruleset_rules,
    Asbestos.firewall.postamble(self)
  ].flatten
end
ruleset_rules() click to toggle source

Ask each ruleset/service to generate its rules.

# File lib/asbestos/host.rb, line 224
def ruleset_rules
  @rulesets.collect do |r|
    ["# Begin [#{r.name}]",
     r.firewall_rules,
     "# End [#{r.name}]",
     ""]
  end
end
runs(service_name, args = {}) click to toggle source

Indicates that this host should have rules to allow the corresponding service to run on it. The arguments provided after the service name should be valid DSL calls supported by the service. Certain DSL calls come standard with all services, see the Service class for more info.

host ‘dax’ do

runs :nginx, :on => :external
runs :ssh,   :on => :internal, :port => 22022
runs :riak,  :on => :internal, :from => {:riak_cluster => :internal}

end

# File lib/asbestos/host.rb, line 190
def runs(service_name, args = {})
  template = Asbestos::Service[service_name]
  raise "Service not defined: #{service_name}" unless template

  @rulesets <<
    Asbestos::Service.new(service_name, self).tap do |s|
      s.instance_eval &template
      # override template defaults with provided options
      args.each do |k, v|
        s.send k, v
      end
    end
end
to_s()
Alias for: inspect