iptable 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ec29d57d27a6e6476d7e7b45ce0b00e2a6e2d18b
-  data.tar.gz: 741f015325d6734dfa087f872923ab23763c4672
+  metadata.gz: f5f4f3b42e0340211d5f76976dcacc8a93634f90
+  data.tar.gz: 384ae7df7d10bd7e9843bf0ba8426d62a0b738b5
 SHA512:
-  metadata.gz: a7b8932b08f65e35b209a39cbbf44d5e10129e2ad60135d3b87c7bf8c0bf2217601aed294d953257481e2c0fbea17436c3030ce27b10e3128bbc1eeba0aceeb1
-  data.tar.gz: 9649433b362c790c7496dbc0a2d07a4fbdebb95cd462eb9697a014fa610aed75e3da84c5625a9457bf2b4a99d699c2af1cbcee86e6034f07296a773152c23cdb
+  metadata.gz: 9a831bb0c4de7c088e51452086c468a4ef8bac4a317abacaa78365da22360f75d1e693e77ac5959e8f68ef4adf11ae3f5ebc0f6318f9eedcbedd29c6e7d7ef84
+  data.tar.gz: 06fdcec05df266c35efca59f6c8a0ed745bb58f06668c7fbc13dff8ced7735d0006a2840c90a26203c86dbc0d063442409c0ffb495aca4b38a51fc5dd0833f5d

data/.gitignore

@@ -0,0 +1,2 @@
+*gem
+*swp

data/README.md

@@ -0,0 +1,20 @@
+iptable
+=======
+
+Manipulate iptables with ruby, for packet accounting of ports
+
+Must be run as root, typically with rvmsudo
+
+```ruby
+require 'iptable'
+# load the current iptables
+table = IP::Table.new
+chain = table.add_chain :name => "nginx_in"
+table.chains["INPUT"].append_jump_to chain
+chain.add_rule :protocol => :tcp, :src => "208.51.40.2", :dport => 34576
+sleep 5
+chain.reload
+puts chain.packets
+puts chain.bytes
+chain.delete
+```

data/iptable.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name        = 'iptable'
-  s.version     = '0.0.1'
+  s.version     = '0.0.2'
   s.date        = '2014-11-05'
   s.summary     = "IP Table"
   s.description = "manipulate iptables"

data/lib/iptable/ip.rb

@@ -24,10 +24,16 @@ module IP
       end
     end
 
+    def add_chain(options)
+      new_chain = Chain.new(options)
+      new_chain.save
+      @chains[options[:name]] = new_chain
+    end
+
     def match_chain(line)
       if match = line.match(CHAIN_RE)
         name = match[1]
-        @current_chain = @chains[name] = Chain.new(name)
+        @current_chain = @chains[name] = Chain.new(:name => name)
         return true
       end
       false
@@ -35,30 +41,91 @@ module IP
   end
 
   class Chain
-    attr_reader :rules
+    attr_reader :rules, :name
+    attr_accessor :reference
 
-    def initialize(name)
-      @name = name
+    def initialize(options)
+      @name = options[:name]
       @rules = []
+      @reference = nil
+    end
+
+    def save
+      IO.popen("/sbin/iptables -N #{@name}") do |output|
+        if output.read =~ /Chain already exists/
+          return false
+        else
+          return true
+        end
+      end
+    end
+
+    def append_jump_to chain
+      chain.reference = self
+      IO.popen("/sbin/iptables -I #{@name} -j #{chain.name}") do |output|
+        puts output.read
+      end
+    end
+
+    def init_rule(options)
+      @rules << Rule.new(options.merge(:chain => self))
     end
 
-    def add_rule(*args)
-      @rules << Rule.new(args)
+    def add_rule(options)
+      new_rule = Rule.new(options.merge(:chain => self))
+      new_rule.save
+      @rules << new_rule
     end
 
     def match_rule(string)
       if match = string.match(RULE_RE)
-        add_rule match[1, -1]
+        init_rule :packets => match[1], :protocol => match[2]
+      end
+    end
+
+    def delete
+      @rules.each do |rule|
+        IO.popen("/sbin/iptables -D #{@name} 1") do |output|
+          puts output.read
+        end
+      end
+      if @reference
+        IO.popen("/sbin/iptables -D #{@reference.name} -j #{@name}") do |output|
+          puts output.read
+        end
+      end
+      IO.popen("/sbin/iptables -X #{@name}") do |output|
+        puts output.read
+      end
+    end
+
+    def reload
+      @rules = []
+      IO.popen("/sbin/iptables -L #{@name} -n -v -x") do |output|
+        output.readlines.each do |line|
+          match_rule(line)
+        end
       end
     end
   end
 
   class Rule
     attr_accessor :chain, :target
+    attr_reader :packets
 
-    def initialize(*args)
-      @chain = nil
+    def initialize(options)
+      @chain = options[:chain]
+      raise "Rule needs a chain" unless @chain
+      @packets = options[:packets].to_i
       @target = nil
+      @dport = options[:dport]
+      @protocol = options[:protocol] || "all"
+    end
+
+    def save
+      IO.popen("/sbin/iptables -A #{@chain.name} -p #{@protocol} --dport #{@dport}") do |output|
+        puts output.read
+      end
     end
   end
 end

data/test/test.rb

@@ -2,10 +2,11 @@ gem 'mocha'
 require 'minitest/autorun'
 require 'iptable'
 require 'mocha/mini_test'
+require 'socket'
 
 class Tests < Minitest::Test
   def test_rule_matching
-    chain = IP::Chain.new "hey"
+    chain = IP::Chain.new :name => "hey"
     str = "607939 956613034 TRAFFIC_ACCT_OUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0          "
     chain.match_rule str
     assert chain.rules.size == 1
@@ -22,4 +23,49 @@ class Tests < Minitest::Test
     table = IP::Table.new
     assert table.match_chain "Chain TRAFFIC_ACCT (0 references)"
   end
+
+  def test_add_chain_tcp
+    table = IP::Table.new
+    chain = table.add_chain :name => "nginx_in"
+    table.chains["INPUT"].append_jump_to chain
+    rule = chain.add_rule :protocol => :tcp, :dport => 1999
+    server_thread = Thread.new do
+      server = TCPServer.new 1999
+      server.accept
+      sleep 0.1
+    end
+    client_thread = Thread.new do
+      client = TCPSocket.new 'localhost', 1999
+      sleep 0.1
+      client.puts "hey"
+    end
+    client_thread.join
+    server_thread.join
+    chain.reload
+    assert_equal 4, chain.rules.first.packets
+    ensure
+    chain.delete
+  end
+
+  def test_add_chain_udp
+    table = IP::Table.new
+    chain = table.add_chain :name => "nginx_in"
+    table.chains["INPUT"].append_jump_to chain
+    rule = chain.add_rule :protocol => :udp, :dport => 1998
+    server_thread = Thread.new do
+      server = UDPSocket.new
+      server.bind "localhost", 1998
+      text, sender = server.recvfrom(1)
+    end
+    client_thread = Thread.new do
+      client = UDPSocket.new
+      client.send("hello", 0, 'localhost', 1998)
+    end
+    client_thread.join
+    server_thread.join
+    chain.reload
+    assert_equal 1, chain.rules.first.packets
+    ensure
+    chain.delete
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: iptable
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - towski
@@ -16,6 +16,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- .gitignore
+- README.md
 - Rakefile
 - iptable.gemspec
 - lib/iptable.rb