class Puffy::Rule
Abstract firewall rule.
Attributes
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
@!attribute action
The action to perform when the rule apply (+:accept+ or +:block+). @return [Symbol] Action
@!attribute return
Whether blocked packets must be returned to sender instead of being silently dropped. @return [Boolean] Return flag
@!attribute dir
The direction of the rule (+:in+ or +:out+). @return [Symbol] Direction
@!attribute proto
The protocol the Puffy::Rule applies to (+:tcp+, +:udp+, etc). @return [Symbol] Protocol
@!attribute af
The address family of the rule (+:inet6+ or +:inet+) @return [Symbol] Address family
@!attribute on
The interface the rule applies to. @return [String] Interface
@!attribute in
The interface packets must arrive on for the rule to apply in a forwarding context. @return [String] Interface
@!attribute out
The interface packets must be sent to for the rule to apply in a forwarding context. @return [String] Interface
@!attribute from
The packet source as a Hash for the rule to apply. :host:: address of the source host or network the rule apply to :port:: source port the rule apply to @return [Hash] Source
@!attribute to
The packet destination as a Hash for the rule to apply. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute nat_to
The packet destination when peforming NAT. @return [IPAddr] IP Adress
@!attribute rdr_to
The destination as a Hash for redirections. :host:: address of the destination host or network the rule apply to :port:: destination port the rule apply to @return [Hash] Destination
@!attribute no_quick
Prevent the rule from being a quick one. @return [Boolean] Quick flag
Public Class Methods
Instanciate a forward Puffy::Rule
.
@param rule [Puffy::Rule] a NAT rule
@return [Puffy::Rule]
# File lib/puffy/rule.rb, line 78 def self.fwd_rule(rule) res = rule.dup res.on_to_in_out! res.to.merge!(res.rdr_to.compact) res.rdr_to = nil res.dir = :fwd res end
Instanciate a firewall Puffy::Rule
.
options
is a Hash
of the Puffy::Rule
class attributes
Rule.new({ action: :accept, dir: :in, proto: :tcp, to: { port: 80 } })
# File lib/puffy/rule.rb, line 64 def initialize(options = {}) send_options(options) @af = detect_af unless af raise "unsupported action `#{options[:action]}'" unless valid_action? raise 'if from_port or to_port is specified, the protocol must also be given' if port_without_protocol? end
Public Instance Methods
Return true if the rule is a filter rule.
# File lib/puffy/rule.rb, line 108 def filter? !nat? && !rdr? end
Returns whether the rule performs forwarding.
# File lib/puffy/rule.rb, line 133 def fwd? dir == :fwd end
Return true if the rule has an IPv4 source or destination.
# File lib/puffy/rule.rb, line 93 def implicit_ipv4? from_ipv4? || to_ipv4? || rdr_to_ipv4? || (rdr_to && af == :inet) end
Return true if the rule has an IPv6 source or destination.
# File lib/puffy/rule.rb, line 103 def implicit_ipv6? from_ipv6? || to_ipv6? || rdr_to_ipv6? || (rdr_to && af == :inet6) end
Returns whether the rule applies to incomming packets.
# File lib/puffy/rule.rb, line 113 def in? dir.nil? || dir == :in end
Return true if the rule is valid in an IPv4 context.
# File lib/puffy/rule.rb, line 88 def ipv4? af.nil? || af == :inet end
Return true if the rule is valid in an IPv6 context.
# File lib/puffy/rule.rb, line 98 def ipv6? af.nil? || af == :inet6 end
Returns whether the rule performs Network Address Translation.
# File lib/puffy/rule.rb, line 123 def nat? nat_to end
Returns whether the rule applies to outgoing packets.
# File lib/puffy/rule.rb, line 118 def out? dir.nil? || dir == :out end
Returns whether the rule is a redirection.
# File lib/puffy/rule.rb, line 128 def rdr? rdr_to_host || rdr_to_port end
Private Instance Methods
# File lib/puffy/rule.rb, line 194 def collect_afs %i[from_host to_host rdr_to_host].map do |method| res = send(method) if res.nil? then nil elsif res.ipv4? then :inet elsif res.ipv6? then :inet6 else raise 'Fail' end end.uniq.compact end
# File lib/puffy/rule.rb, line 186 def detect_af afs = collect_afs return nil if afs.empty? return afs.first if afs.one? raise AddressFamilyConflict, "Incompatible address famlilies: #{afs}" end
# File lib/puffy/rule.rb, line 176 def port_without_protocol? (from_port || to_port) && proto.nil? end
# File lib/puffy/rule.rb, line 180 def send_options(options) options.each do |k, v| send("#{k}=", v) end end
# File lib/puffy/rule.rb, line 172 def valid_action? [nil, :pass, :block].include?(action) end