class Puffy::Rule

Abstract firewall rule.

Attributes

action[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
af[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
dir[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
from[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
in[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
nat_to[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
no_quick[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
on[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
out[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
proto[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
rdr_to[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
return[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag
to[RW]

@!attribute action

The action to perform when the rule apply (+:accept+ or +:block+).
@return [Symbol] Action

@!attribute return

Whether blocked packets must be returned to sender instead of being silently dropped.
@return [Boolean] Return flag

@!attribute dir

The direction of the rule (+:in+ or +:out+).
@return [Symbol] Direction

@!attribute proto

The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc).
@return [Symbol] Protocol

@!attribute af

The address family of the rule (+:inet6+ or +:inet+)
@return [Symbol] Address family

@!attribute on

The interface the rule applies to.
@return [String] Interface

@!attribute in

The interface packets must arrive on for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute out

The interface packets must be sent to for the rule to apply in a forwarding context.
@return [String] Interface

@!attribute from

The packet source as a Hash for the rule to apply.

:host:: address of the source host or network the rule apply to
:port:: source port the rule apply to
@return [Hash] Source

@!attribute to

The packet destination as a Hash for the rule to apply.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute nat_to

The packet destination when peforming NAT.
@return [IPAddr] IP Adress

@!attribute rdr_to

The destination as a Hash for redirections.

:host:: address of the destination host or network the rule apply to
:port:: destination port the rule apply to
@return [Hash] Destination

@!attribute no_quick

Prevent the rule from being a quick one.
@return [Boolean] Quick flag

Public Class Methods

fwd_rule(rule) click to toggle source

Instanciate a forward Puffy::Rule.

@param rule [Puffy::Rule] a NAT rule

@return [Puffy::Rule]

# File lib/puffy/rule.rb, line 78
def self.fwd_rule(rule)
  res = rule.dup
  res.on_to_in_out!
  res.to.merge!(res.rdr_to.compact)
  res.rdr_to = nil
  res.dir = :fwd
  res
end
new(options = {}) click to toggle source

Instanciate a firewall Puffy::Rule.

options is a Hash of the Puffy::Rule class attributes

Rule.new({ action: :accept, dir: :in, proto: :tcp, to: { port: 80 } })
# File lib/puffy/rule.rb, line 64
def initialize(options = {})
  send_options(options)

  @af = detect_af unless af

  raise "unsupported action `#{options[:action]}'" unless valid_action?
  raise 'if from_port or to_port is specified, the protocol must also be given' if port_without_protocol?
end

Public Instance Methods

filter?() click to toggle source

Return true if the rule is a filter rule.

# File lib/puffy/rule.rb, line 108
def filter?
  !nat? && !rdr?
end
fwd?() click to toggle source

Returns whether the rule performs forwarding.

# File lib/puffy/rule.rb, line 133
def fwd?
  dir == :fwd
end
implicit_ipv4?() click to toggle source

Return true if the rule has an IPv4 source or destination.

# File lib/puffy/rule.rb, line 93
def implicit_ipv4?
  from_ipv4? || to_ipv4? || rdr_to_ipv4? || (rdr_to && af == :inet)
end
implicit_ipv6?() click to toggle source

Return true if the rule has an IPv6 source or destination.

# File lib/puffy/rule.rb, line 103
def implicit_ipv6?
  from_ipv6? || to_ipv6? || rdr_to_ipv6? || (rdr_to && af == :inet6)
end
in?() click to toggle source

Returns whether the rule applies to incomming packets.

# File lib/puffy/rule.rb, line 113
def in?
  dir.nil? || dir == :in
end
ipv4?() click to toggle source

Return true if the rule is valid in an IPv4 context.

# File lib/puffy/rule.rb, line 88
def ipv4?
  af.nil? || af == :inet
end
ipv6?() click to toggle source

Return true if the rule is valid in an IPv6 context.

# File lib/puffy/rule.rb, line 98
def ipv6?
  af.nil? || af == :inet6
end
nat?() click to toggle source

Returns whether the rule performs Network Address Translation.

# File lib/puffy/rule.rb, line 123
def nat?
  nat_to
end
on_to_in_out!() click to toggle source

Setsthe in / out to on depending on dir.

@return [void]

# File lib/puffy/rule.rb, line 161
def on_to_in_out!
  if dir == :in
    self.in ||= on
  else
    self.out ||= on
  end
  self.on = nil
end
out?() click to toggle source

Returns whether the rule applies to outgoing packets.

# File lib/puffy/rule.rb, line 118
def out?
  dir.nil? || dir == :out
end
rdr?() click to toggle source

Returns whether the rule is a redirection.

# File lib/puffy/rule.rb, line 128
def rdr?
  rdr_to_host || rdr_to_port
end

Private Instance Methods

collect_afs() click to toggle source
# File lib/puffy/rule.rb, line 194
def collect_afs
  %i[from_host to_host rdr_to_host].map do |method|
    res = send(method)
    if res.nil? then nil
    elsif res.ipv4? then :inet
    elsif res.ipv6? then :inet6
    else raise 'Fail'
    end
  end.uniq.compact
end
detect_af() click to toggle source
# File lib/puffy/rule.rb, line 186
def detect_af
  afs = collect_afs
  return nil if afs.empty?
  return afs.first if afs.one?

  raise AddressFamilyConflict, "Incompatible address famlilies: #{afs}"
end
port_without_protocol?() click to toggle source
# File lib/puffy/rule.rb, line 176
def port_without_protocol?
  (from_port || to_port) && proto.nil?
end
send_options(options) click to toggle source
# File lib/puffy/rule.rb, line 180
def send_options(options)
  options.each do |k, v|
    send("#{k}=", v)
  end
end
valid_action?() click to toggle source
# File lib/puffy/rule.rb, line 172
def valid_action?
  [nil, :pass, :block].include?(action)
end