ript 0.8.4

data/examples/accept-without-specific-from.rb

@@ -0,0 +1,11 @@
+partition "joeblogsco" do
+
+  label "jbc.com", :address => "172.22.111.99"
+
+  accept "jbc.com web" do
+    ports 80, 443
+    to "jbc.com"
+  end
+
+end
+

data/examples/accept.rb

@@ -0,0 +1,12 @@
+partition "keepalived" do
+  label "primary lvs",    :address => "172.16.0.216"
+  label "secondary lvs",  :address => "172.16.0.217"
+  label "fw multicast",  :address => "224.0.0.0/8"
+
+  accept "keepalive chatter on the fw multicast" do
+    protocols "vrrp"
+    from      "primary lvs", "secondary lvs"
+    to        "fw multicast"
+  end
+end
+

data/examples/basic.rb

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+
+partition "basic" do
+end

data/examples/dash-in-partition-name.rb

@@ -0,0 +1,2 @@
+partition "dash-in-my-name" do
+end

data/examples/drop.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+  label "localhost",      :address => "127.0.0.1"
+
+  drop "localhost on www.bar.com" do
+    from "localhost"
+    to   "www.bar.com"
+  end
+end
+

data/examples/duplicate-partition-names/foobar1.rb

@@ -0,0 +1,2 @@
+partition "foobar" do
+end

data/examples/duplicate-partition-names/foobar2.rb

@@ -0,0 +1,2 @@
+partition "foobar" do
+end

data/examples/errors-undefined-method-with-no-match.rb

@@ -0,0 +1,12 @@
+partition "keepalived" do
+  label "foobar-lvs-04", :address => "192.168.0.76"
+  label "util-01",       :address => "172.16.0.246"
+  label "util-02",       :address => "172.16.0.247"
+
+  accept "ssh access between lvs/firewalls with incorrect invocation" do
+    blahblahblah 22
+    from         "foobar-lvs-04", "util-01", "util-02"
+    to           "foobar-lvs-04"
+  end
+end
+

data/examples/errors-undefined-method.rb

@@ -0,0 +1,12 @@
+partition "keepalived" do
+  label "foobar-lvs-04", :address => "192.168.0.76"
+  label "util-01",       :address => "172.16.0.246"
+  label "util-02",       :address => "172.16.0.247"
+
+  accept "ssh access between lvs/firewalls with incorrect invocation" do
+    port 22
+    from "foobar-lvs-04", "util-01", "util-02"
+    to   "foobar-lvs-04"
+  end
+end
+

data/examples/forward-dnat-with-different-destination-port.rb

@@ -0,0 +1,16 @@
+partition "foo" do
+  label "www.foo.com",   :address => "172.23.0.88"
+  label "foo-web-01",    :address => "192.168.38.1"
+  label "stage.foo.com", :address => "172.23.0.90"
+  label "foo-web-02",    :address => "192.168.38.2"
+
+  rewrite "foo.com public website" do
+    ports 25, 80, 11, 22 => 9876, 443 => 4443
+    dnat  "www.foo.com" =>  "foo-web-01"
+  end
+
+  rewrite "foo.com stage website" do
+    ports 22 => 9876, 443 => 4443
+    dnat  "stage.foo.com" =>  "foo-web-02"
+  end
+end

data/examples/forward-dnat-with-explicit-from-and-port-mappings.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label :jamdev,                :address => "192.168.23.70/27"
+  label "www.bar.com",          :address => "172.23.0.95"
+  label "barprod-blackhole-01", :address => "192.168.27.66"
+
+  rewrite "bar" do
+    ports 139 => 2011
+    from  :jamdev
+    dnat "www.bar.com" => "barprod-blackhole-01"
+  end
+end

data/examples/forward-dnat-with-explicit-from-and-ports.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label :jamdev,                :address => "192.168.23.70/27"
+  label "www.bar.com",          :address => "172.23.0.95"
+  label "barprod-blackhole-01", :address => "192.168.27.66"
+
+  rewrite "bar" do
+    ports 82
+    from  :jamdev
+    dnat "www.bar.com" => "barprod-blackhole-01"
+  end
+end

data/examples/forward-dnat-with-explicit-from.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label :jamdev,                :address => "192.168.23.70/27"
+  label "www.bar.com",          :address => "172.23.0.95"
+  label "barprod-blackhole-01", :address => "192.168.27.66"
+
+  rewrite "bar" do
+    ports 80
+    from  :jamdev
+    dnat "www.bar.com" => "barprod-blackhole-01"
+  end
+end

data/examples/forward-dnat-with-explicit-protocols.rb

@@ -0,0 +1,15 @@
+partition 'cpm' do
+
+  label 'internal', :address => '192.168.0.133'
+  label 'external', :address => '172.18.88.33'
+  label 'office',   :address => '172.19.4.55'
+
+  rewrite 'incoming dns' do
+    protocols 'udp', 'tcp'
+    ports 53
+    from 'office'
+    to   'external'
+    dnat 'external' => 'internal'
+  end
+
+end

data/examples/forward-dnat-with-multiple-froms.rb

@@ -0,0 +1,13 @@
+partition "joeblogsco" do
+  label :office1,             :address => "1.2.3.4"
+  label :office2,             :address => "4.5.6.7"
+  label :office3,             :address => "7.8.9.10"
+  label "www.joeblogsco.com", :address => "172.19.10.99"
+  label "joeblogsco-app-01",  :address => "192.168.27.66"
+
+  rewrite "bar" do
+    ports 80
+    from  :office1, :office2, :office3
+    dnat "www.joeblogsco.com" => "joeblogsco-app-01"
+  end
+end

data/examples/forward-dnat-with-multiple-ports.rb

@@ -0,0 +1,10 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+
+  rewrite "bar.com public website" do
+    ports  80, 22
+    dnat   "www.bar.com" =>  "barprod-web-01"
+  end
+end
+

data/examples/forward-dnat-with-multiple-sources.rb

@@ -0,0 +1,15 @@
+partition "bar" do
+  label :jamdev,            :address => "192.168.23.70/27"
+
+  label "www.bar.com",      :address => "172.23.0.95"
+  label "secure.bar.com",   :address => "172.23.0.96"
+  label "static.bar.com",   :address => "172.23.0.97"
+  label "barprod-proxy-01", :address => "192.168.27.88"
+
+  rewrite "bar" do
+    ports 80
+    dnat  [ "www.bar.com",
+            "secure.bar.com",
+            "static.bar.com"  ] => "barprod-proxy-01"
+  end
+end

data/examples/forward-dnat.rb

@@ -0,0 +1,16 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+  label "barprod-web-02", :address => "192.168.19.4"
+
+  rewrite "bar.com public website" do
+    ports 80
+    dnat  "www.bar.com" => "barprod-web-01"
+  end
+
+  rewrite "bar.com public website" do
+    ports 22
+    dnat  "www.bar.com" => "barprod-web-02"
+  end
+end
+

data/examples/forward-snat-with-explicit-from.rb

@@ -0,0 +1,16 @@
+partition "bar" do
+  label "www.bar.com",     :address => "172.23.0.95"
+  label "api.bar.com",     :address => "172.24.0.99"
+  label "barprod-api-01",  :address => "10.55.0.45"
+  label "bar prod subnet", :address => "10.55.0.0/24"
+
+
+  # FIXME: should things with a netmask be inserted lower into the chain?
+  rewrite "bar" do
+    snat "barprod-api-01" => "api.bar.com"
+  end
+
+  rewrite "bar prod outbound" do
+    snat "bar prod subnet" => "www.bar.com"
+  end
+end

data/examples/forward-snat-with-multiple-sources.rb

@@ -0,0 +1,13 @@
+partition "bar" do
+  label "bar uat subnet",   :address => "10.33.0.0/24"
+  label "bar stage subnet", :address => "10.44.0.0/24"
+  label "bar prod subnet",  :address => "10.55.0.0/24"
+
+  label "www.bar.com",      :address => "172.23.0.95"
+
+  rewrite "bar" do
+    snat  [ "bar uat subnet",
+            "bar stage subnet",
+            "bar prod subnet"  ] => "www.bar.com"
+  end
+end

data/examples/forward-snat.rb

@@ -0,0 +1,9 @@
+partition "bar" do
+  label "www.bar.com", :address => "172.23.0.95"
+  label "bar subnet",  :address => "10.30.0.0/24"
+
+  rewrite "bar.com public website" do
+    snat "bar subnet" =>  "www.bar.com"
+  end
+end
+

data/examples/log-and-accept.rb

@@ -0,0 +1,12 @@
+partition "keepalived" do
+  label "primary lvs",   :address => "172.16.0.216"
+  label "secondary lvs", :address => "172.16.0.217"
+  label "fw multicast",  :address => "224.0.0.0/8"
+
+  accept "keepalive chatter on the fw multicast", :log => true do
+    protocols "vrrp"
+    from      "primary lvs", "secondary lvs"
+    to        "fw multicast"
+  end
+end
+

data/examples/log-and-drop.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+  label "localhost",      :address => "127.0.0.1"
+
+  drop "localhost on www.bar.com", :log => true do
+    from "localhost"
+    to   "www.bar.com"
+  end
+end
+

data/examples/log-dnat.rb

@@ -0,0 +1,10 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+
+  rewrite "bar.com public website", :log => true do
+    ports 80, 22
+    dnat  "www.bar.com" => "barprod-web-01"
+  end
+end
+

data/examples/log-snat.rb

@@ -0,0 +1,13 @@
+partition "bar" do
+  label "bar uat subnet",   :address => "10.33.0.0/24"
+  label "bar stage subnet", :address => "10.44.0.0/24"
+  label "bar prod subnet",  :address => "10.55.0.0/24"
+
+  label "www.bar.com",      :address => "172.23.0.95"
+
+  rewrite "bar", :log => true do
+    snat  [ "bar uat subnet",
+            "bar stage subnet",
+            "bar prod subnet"  ] => "www.bar.com"
+  end
+end

data/examples/log.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+  label "localhost",      :address => "127.0.0.1"
+
+  log "localhost on www.bar.com" do
+    from "localhost"
+    to   "www.bar.com"
+  end
+end
+

data/examples/missing-address-definition-in-destination.rb

@@ -0,0 +1,15 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+
+  rewrite "bar.com public website" do
+    ports 80
+    dnat  "www.bar.com" =>  "barprod-web-01"
+  end
+
+  rewrite "bar.com public website" do
+    ports 22
+    dnat  "www.bar.com" =>  "barprod-web-02"
+  end
+end
+

data/examples/missing-address-definition-in-from.rb

@@ -0,0 +1,15 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95"
+  label "barprod-web-01", :address => "192.168.19.2"
+
+  rewrite "bar.com public website" do
+    ports 80
+    dnat  "www.bar.com" => "barprod-web-01"
+  end
+
+  drop "bad guy" do
+    from "bad guy"
+    to   "www.bar.com"
+  end
+end
+

data/examples/multiple-partitions-in-this-file.rb

@@ -0,0 +1,14 @@
+%w(bar foo blum frub).each do |name|
+  partition(name) do
+    label :jamdev,                :address => "192.168.23.70/27"
+    label "www.bar.com",          :address => "172.23.0.95"
+    label "barprod-blackhole-01", :address => "192.168.27.66"
+
+    rewrite "bar" do
+      ports 80
+      from  :jamdev
+      dnat "www.bar.com" => "barprod-blackhole-01"
+    end
+  end
+end
+

data/examples/multiple-partitions/bar.rb

@@ -0,0 +1,11 @@
+partition "bar" do
+  label "www.bar.com",    :address => "172.23.0.95", :interface => "vlan44"
+  label "barprod-web-01", :address => "192.168.19.2"
+  label "localhost",      :address => "127.0.0.1"
+
+  drop "localhost on www.bar.com" do
+    from "localhost"
+    to   "www.bar.com"
+  end
+end
+

data/examples/multiple-partitions/foo.rb

@@ -0,0 +1,17 @@
+partition "foo" do
+  label "www.foo.com",   :address => "172.23.0.88", :interface => "vlan44"
+  label "foo-web-01",    :address => "192.168.38.1"
+  label "stage.foo.com", :address => "172.23.0.90", :interface => "vlan44"
+  label "foo-web-02",    :address => "192.168.38.2"
+
+  rewrite "foo.com public website" do
+    ports 25, 80, 11, 22 => 9876, 443 => 4443
+    dnat  "www.foo.com" =>  "foo-web-01"
+  end
+
+  rewrite "foo.com stage website" do
+    ports 22 => 9876, 443 => 4443
+    dnat  "stage.foo.com" =>  "foo-web-02"
+  end
+end
+

data/examples/partition-name-exactly-20-characters.rb

@@ -0,0 +1,2 @@
+partition "name_exactly_20_char" do
+end

data/examples/partition-name-longer-than-20-characters.rb

@@ -0,0 +1,2 @@
+partition "name_longer_than_21_characters" do
+end

data/examples/postclean.rb

@@ -0,0 +1,10 @@
+partition "supercow" do
+  label "cow",    :address => "172.27.1.2"
+  label "person", :address => "172.29.2.3"
+
+  accept "moo" do
+    from "cow"
+    to "person"
+  end
+end
+

data/examples/preclean.rb

@@ -0,0 +1,10 @@
+partition "supercow" do
+  label "cow",    :address => "172.27.1.1"
+  label "person", :address => "172.29.2.2"
+
+  accept "moo" do
+    from "cow"
+    to "person"
+  end
+end
+

data/examples/raw-with-chain-deletion.rb

@@ -0,0 +1,9 @@
+partition "boilerplate" do
+  raw <<-RAW
+# Delete created chains
+iptables -X
+iptables -t nat -X
+iptables -t mangle -X
+  RAW
+end
+