Class Symbiosis::Firewall::Template
In: firewall/lib/symbiosis/firewall/template.rb
Parent: Object
Array Utmp EventMachine::Connection ApacheLogger StandardError CrontabFormatError Enumerable IPAddr ::IPAddr Host Range Domain ConfigFile Prosody Tinydns Apache Webalizer Directory IPListDirectory TemplateDirectory Domains Alert Crontab CrontabRecord StateDB Check Runner TCPConnection Test Process BlacklistDB Template Logtail Pattern Ports Blacklist Monitor ConfigFiles Utils Firewall Symbiosis dot/f_0.png

This class encapsulates a single firewall (iptables) template

Methods

Attributes

address  [R]  The address (if any) this rule is applied to.
chain  [R]  The name of the chain this rule will be used in.
direction  [R]  The direction of the rule.
name  [R]  The name of the rule (usually the same as the template filename)
port  [R]  The port (if any) this rule applies to.
template_file  [R]  The filename of the template used.

Public Class methods

Return an arry showing which address families have been set. Defaults to inet inet6

Specify which address families the templates can be run for.

Return the array of directories which are used when searching for templates.

Set which directories are searched for templates.

The argument is a string, prepend it to the array of directries. If it is an array, overwrite the list.

Return a list of suitable iptables commands, given the available address families.

Public Instance methods

Set the source/dest address.

Set the chain

destination()

Alias for dst

Sets the direction of the template. Must be either "incoming" or "outgoing".

Return the iptables dst address flag, or an empty string if no address has been set.

Set this rule to work against incoming connections.

Returns true if this is an incoming template.

Return the correct iptables command determined if this rule can apply to IPv4, or IPv6, or both IPv4 and IPv6 addresses.

Returns true if this rule can apply to IPv4 addresses

Returns true if this rule can apply to IPv6 addresses

Sets the name of the template

Set this rule to work against outgoing connections.

Returns true if this is an outgoing template.

Set the port

source()

Alias for src

Return the iptables src address flag or an empty string if no address has been set.

Returns the src or the dest iptables flags depending on the direction of the template.

Sets the name of the template file. Returns Errno::ENOENT if the file cannot be found.

The meat of the code. This is designed to return the actual "iptables" command which this rule can be used to generate.

This can cope with new ERB-based templates, as well as older ones with perl-style $SRC/$DEST statements.

For the old-style templates, any substitutions other than $SRC and $DEST will be removed, and warned about if the verbose flag is set.

TODO: this could be neater.

[Validate]