tablomat 1.2.1 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3acd84433060bbc3bf7e1502c05f0e9889694d3a32037e22e15f743ca01b5fc3
-  data.tar.gz: 9dd4eaab8169d4a12bc8d84de57913f35d8ffc0d90d9f716e12a801f2936e4aa
+  metadata.gz: 173080a9ec9a2627d84f5d4cc6a9db6ae34cde2299411ff7ab8145250f303114
+  data.tar.gz: 7ea6702336b2d690e8c098a1b92af60c22522baaac228a8c4ec3b2c015715290
 SHA512:
-  metadata.gz: 25075f75a86af90044a997409afec220443610589c68bba8d22144586724288ae860b5dcfb191ba64afaf14b420c8cfc838bc6e7f3b887f21a07a2ac99862c7e
-  data.tar.gz: c8be92592b3fe8e3c67439db72aa7f1717da3c13ed32b412009a65ebeb4d9bdbbb291c3391a2dda28e684cefb758b9be79960f64d0bc7183e1279deebfbf62bc
+  metadata.gz: 389670b5b1fdec89b2939207cb6eafdad8a6896249ae240a07eb615d5cf1f85cd8f2fa54ee94dbce4471b528b49c8476aaedeb9d073ef6bafa321f177e66d3f7
+  data.tar.gz: '0591296122cfac89e226522a675129ad04b554b6074a6224e2b3de95fdb7deed16569bd8283bb34c164558343a31d0fb29c6013069c2da06453000dc5041fef4'

data/lib/tablomat/iptables/chain.rb

@@ -3,7 +3,7 @@
 require 'tablomat/iptables/rule'
 
 module Tablomat
-  class IPTables
+  class IPTablesBase
     # The IPTables class is the interface to the iptables command
     class Chain
       attr_accessor :owned

data/lib/tablomat/iptables/rule.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Tablomat
-  class IPTables
+  class IPTablesBase
     # IPTables are made of Rules
     class Rule
       attr_accessor :owned, :active, :method, :position

data/lib/tablomat/iptables/table.rb

@@ -3,7 +3,7 @@
 require 'tablomat/iptables/chain'
 
 module Tablomat
-  class IPTables
+  class IPTablesBase
     # Puts the Table in IPTables
     class Table
       attr_accessor :owned

data/lib/tablomat/iptables.rb

@@ -7,17 +7,13 @@ require 'tempfile'
 require 'tablomat/exec'
 
 module Tablomat
-  # The IPTables interface
-  class IPTables
+  # The base class for the IPTables interface
+  class IPTablesBase
     extend Exec
     attr_accessor :iptables_bin
     attr_reader :active, :builtin_chains, :tmp_chain
 
     def initialize
-      # iptables must be in PATH
-      @iptables_bin = 'iptables'
-      @iptables_bin = "sudo #{@iptables_bin}" if Etc.getlogin != 'root'
-
       # get random value for rule creation hack, iptables limits name to 28 characters
       @tmp_chain_prefix = 'tablomat'
 
@@ -25,7 +21,6 @@ module Tablomat
       @tables = {}
 
       @active = true
-      synchronize
     end
 
     def exec(cmd)
@@ -199,4 +194,26 @@ module Tablomat
       pp self
     end
   end
+
+  # The IPTables interface
+  class IPTables < IPTablesBase
+    def initialize
+      super()
+      # iptables must be in PATH
+      @iptables_bin = 'iptables'
+      @iptables_bin = "sudo #{@iptables_bin}" if Etc.getlogin != 'root'
+      synchronize
+    end
+  end
+
+  # The IP6Tables interface
+  class IP6Tables < IPTablesBase
+    def initialize
+      super()
+      # ip6tables must be in PATH
+      @iptables_bin = 'ip6tables'
+      @iptables_bin = "sudo #{@iptables_bin}" if Etc.getlogin != 'root'
+      synchronize
+    end
+  end
 end

data/lib/tablomat/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tablomat
-  VERSION = '1.2.1'
+  VERSION = '1.3.0'
 end

data/spec/ip6tables_spec.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'etc'
+
+describe Tablomat::IP6Tables do
+  describe 'Initialize module' do
+    @iptables = Tablomat::IP6Tables.new
+  end
+
+  before(:all) do
+    @command = 'ip6tables'
+    @command = "sudo #{@command}" if Etc.getlogin != 'root'
+
+    @iptables = Tablomat::IP6Tables.new
+    @iptables.activate
+  end
+
+  after(:all) do
+    # cleanup tables
+    @iptables.table('mangle').chain('test', &:apply_delete)
+    @iptables.table('mangle').chain('custom', &:apply_delete)
+    @iptables.table('filter').chain('rspec', &:apply_delete)
+    @iptables.table('nat').chain('rspec', &:apply_delete)
+  end
+
+  it 'does raise an error when getting an invalid ruleset' do
+    output = <<~IPTABLE
+      *nat
+      *mangle
+      :PREROUTING ACCEPT [57:17363]
+      :INPUT ACCEPT [57:17363]
+      :FORWARD ACCEPT [0:0]
+      :OUTPUT ACCEPT [60:16575]
+      :POSTROUTING ACCEPT [60:16575]
+      COMMIT
+      *filter
+    IPTABLE
+    expect { @iptables.parse_output(output) }.to raise_error(StandardError)
+  end
+
+  it 'converts rules to iptables-save format via tmp chain' do
+    expect(@iptables.normalize(protocol: :tcp, sport: 123, source: 'aaaa::ffff')).to eq('-s aaaa::ffff/128 -p tcp -m tcp --sport 123')
+    expect(@iptables.normalize('-s aaaa::ffff/128 -p tcp -m tcp --sport 123')).to eq('-s aaaa::ffff/128 -p tcp -m tcp --sport 123')
+    expect(@iptables.normalize('-s aaaa::ffff/128 -m tcp --sport 123 -p tcp')).to eq('-s aaaa::ffff/128 -p tcp -m tcp --sport 123')
+  end
+
+  it 'gets current ruleset' do
+    # remove all existing rules in mangle FORWARD (hurts running host rules during test)
+    `#{@command}-save > /tmp/iptables.save`
+    `#{@command} -t mangle -F FORWARD`
+    `#{@command} -t mangle -A FORWARD -p tcp -j ACCEPT`
+    @iptables.synchronize
+
+    `#{@command}-restore < /tmp/iptables.save`
+    # @iptables.print
+
+    # check that filter:INPUT is not owned!
+    expect(@iptables.table('filter').chain('INPUT').owned).to be_falsey
+
+    expect(@iptables.table('mangle').chain('FORWARD').rule(@iptables.normalize(protocol: :tcp, jump: :ACCEPT)).owned).to be_falsey
+    expect(@iptables.table('mangle').chain('FORWARD').rule(@iptables.normalize(protocol: :tcp, jump: :ACCEPT)).active).to be_truthy
+  end
+
+  it 'creates new chain in table mangle' do
+    @iptables.table('mangle').chain('custom').activate
+    expect(@iptables.table('mangle').chain('custom').active).to be_truthy
+  end
+
+  it 'allows to retrieve active rules' do
+    @iptables.append('nat', 'PREROUTING', source: 'cccc::ffff',
+                                          destination: 'cccc::fffe',
+                                          protocol: :tcp,
+                                          dport: 8080,
+                                          jump: 'DNAT', to: 'cccc::bbbb:9090')
+    target_hash = { source: 'cccc::ffff', destination: 'cccc::fffe', dport: '8080', jump: 'DNAT', protocol: 'tcp', to_dest: 'cccc::bbbb:9090' }
+    rules = @iptables.get_active_rules
+    expect(rules.length).to eq(1)
+    expect(rules.pop).to eq(target_hash)
+    @iptables.delete('nat', 'PREROUTING', source: 'cccc::ffff',
+                                          destination: 'cccc::fffe',
+                                          protocol: :tcp,
+                                          dport: 8080,
+                                          jump: 'DNAT', to: 'cccc::bbbb:9090')
+  end
+
+  it 'is not possible to set policy for non builtin chains' do
+    expect do
+      @iptables.table('mangle').chain('custom') do |chain|
+        chain.policy 'RETURN'
+        chain.apply
+      end
+    end.to raise_error('Unable to assign policy to non builtin chains, TODO: implement handling')
+  end
+
+  #  it "can set policy for builtin chains" do
+  #    @iptables.table("mangle").chain("INPUT") do | chain |
+  #      chain.set_policy "ACCEPT"
+  #    end
+  #    @iptables.activate
+  #  end
+
+  it 'can remove chains' do
+    # create chain
+    @iptables.table('mangle').chain('test').activate
+    expect(@iptables.exists('mangle', 'test')).to be_truthy
+    @iptables.table('mangle').chain('test').deactivate
+    expect(@iptables.exists('mangle', 'test')).to be_falsey
+  end
+
+  it 'checks if rule already exists' do
+    # check precondition
+    expect(@iptables.exists('mangle', 'custom', protocol: :tcp, sport: 123)).to be_falsy
+
+    # check existing
+    @iptables.append('mangle', 'custom', protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', protocol: :tcp, sport: 123)).to be_truthy
+    expect(@iptables.table('mangle').chain('FORWARD').rule(@iptables.normalize(protocol: :tcp, jump: :ACCEPT)).active).to be_truthy
+
+    # check missing
+    @iptables.delete('mangle', 'custom', protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', protocol: :tcp, sport: 123)).to be_falsy
+  end
+
+  it 'appends new rule via system' do
+    expect(@iptables.exists('mangle', 'custom', protocol: :tcp, sport: 123)).to be_falsy
+    @iptables.append('mangle', 'custom', protocol: :tcp, sport: 123)
+    expect(@iptables.table('mangle').chain('FORWARD').rule(@iptables.normalize(protocol: :tcp, jump: :ACCEPT)).owned).to be_falsey
+    expect(@iptables.table('mangle').chain('FORWARD').rule(@iptables.normalize(protocol: :tcp, jump: :ACCEPT)).active).to be_truthy
+  end
+
+  it 'can remove rules via system' do
+    expect(@iptables.exists('mangle', 'custom', protocol: :tcp, sport: 123)).to be_truthy
+    @iptables.delete('mangle', 'custom', protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', protocol: :tcp, sport: 123)).to be_falsey
+  end
+
+  it 'changes all rules for a specific source address to another source address' do
+    @iptables.append('filter', 'rspec', protocol: :tcp, sport: 123, source: 'aaaa::ffff')
+    @iptables.switch_sources('aaaa::ffff', 'aaaa::bbbb')
+    expect(@iptables.exists('filter', 'rspec', source: 'aaaa::bbbb', protocol: :tcp, sport: 123)).to be_truthy
+    expect(@iptables.exists('filter', 'rspec', source: 'aaaa::ffff', protocol: :tcp, sport: 123)).to be_falsey
+    @iptables.append('nat', 'rspec', protocol: :tcp, sport: 123, source: 'aaaa::ffff', jump: :DNAT, 'to-destination': 'cccc::ffff:123')
+    @iptables.switch_sources('aaaa::ffff', 'aaaa::bbbb')
+    expect(@iptables.exists('nat', 'rspec', source: 'aaaa::bbbb', protocol: :tcp, sport: 123, jump: :DNAT, 'to-destination': 'cccc::ffff:123')).to be_truthy
+    expect(@iptables.exists('nat', 'rspec', source: 'aaaa::ffff', protocol: :tcp, sport: 123, jump: :DNAT, 'to-destination': 'cccc::ffff:123')).to be_falsey
+  end
+end

data/spec/ipsetip6tables_spec.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'etc'
+
+describe Tablomat::IP6Tables, Tablomat::IPSet do
+  describe 'Initialize module' do
+    @ipset = Tablomat::IPSet.new
+    @iptables = Tablomat::IP6Tables.new
+  end
+
+  before(:all) do
+    @command = 'ipset'
+    @command = "sudo #{@command}" if Etc.getlogin != 'root'
+    @ipset = Tablomat::IPSet.new
+    @iptables = Tablomat::IP6Tables.new
+    @iptables.activate
+  end
+
+  after(:all) do
+    # cleanup table and ipsets
+    @iptables.table('mangle').chain('custom', &:apply_delete)
+    @ipset.destroy_all
+  end
+
+  it 'can create and delete rules using ipsets if set exists' do
+    #  initialize ipset and create set
+    @ipset.create(set_name: 'testset1', type: 'hash:ip', create_options: 'family inet6')
+    #  create rule
+    @iptables.append('mangle', 'custom', set: @ipset.matchset(set_name: 'testset1', flags: 'src'), protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', set: @ipset.matchset(set_name: 'testset1', flags: 'src'), protocol: :tcp, sport: 123)).to be_truthy
+    @iptables.delete('mangle', 'custom', set: @ipset.matchset(set_name: 'testset1', flags: 'src'), protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', set: @ipset.matchset(set_name: 'testset1', flags: 'src'), protocol: :tcp, sport: 123)).to be_falsey
+  end
+
+  it 'can create and delete rules using ipsets with Options' do
+    @iptables.append('mangle', 'custom', match: @ipset.matchset(set_name: 'testset1', flags: 'src', option: '--update-subcounters', negate_option: true, negate: true), protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', match: @ipset.matchset(set_name: 'testset1', flags: 'src', option: '--update-subcounters', negate_option: true, negate: true), protocol: :tcp, sport: 123)).to be_truthy
+    @iptables.delete('mangle', 'custom', match: @ipset.matchset(set_name: 'testset1', flags: 'src', option: '--update-subcounters', negate_option: true, negate: true), protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', match: @ipset.matchset(set_name: 'testset1', flags: 'src', option: '--update-subcounters', negate_option: true, negate: true), protocol: :tcp, sport: 123)).to be_falsey
+  end
+
+  it 'can not create rules using a set if the set does not exist' do
+    expect(@ipset.set('testset2').exists?).to be_falsey
+    expect { @iptables.append('mangle', 'custom', match: @ipset.matchset(set_name: 'testset', flags: 'src'), protocol: :tcp, sport: 123) }.to raise_error(RuntimeError)
+  end
+
+  it 'can not destroy a set if a rule is using it' do
+    @ipset.create(set_name: 'testset3', type: 'hash:ip', create_options: 'family inet6')
+    @iptables.append('mangle', 'custom', match: @ipset.matchset(set_name: 'testset3', flags: 'src'), protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', match: @ipset.matchset(set_name: 'testset3', flags: 'src'), protocol: :tcp, sport: 123)).to be_truthy
+    expect { @ipset.destroy(set_name: 'testset3') }.to raise_error(Tablomat::IPSetError)
+    @iptables.delete('mangle', 'custom', match: @ipset.matchset(set_name: 'testset3', flags: 'src'), protocol: :tcp, sport: 123)
+    expect(@iptables.exists('mangle', 'custom', match: @ipset.matchset(set_name: 'testset3', flags: 'src'), protocol: :tcp, sport: 123)).to be_falsey
+    @ipset.destroy(set_name: 'testset3')
+  end
+
+  it 'lists the set in active rules, if a set is given' do
+    @ipset.create(set_name: 'testset4', type: 'hash:ip', create_options: 'family inet6')
+    @iptables.append('mangle', 'custom', match: @ipset.matchset(set_name: 'testset4', flags: 'src'), protocol: :tcp, sport: 123)
+    active_rules = @iptables.get_active_rules('mangle', 'custom')
+    expect(active_rules[-1][:match]).to eq('testset4')
+    @iptables.delete('mangle', 'custom', match: @ipset.matchset(set_name: 'testset4', flags: 'src'), protocol: :tcp, sport: 123)
+    @ipset.destroy(set_name: 'testset4')
+  end
+
+  it 'does not list a set in active rules, if no set is given' do
+    @ipset.create(set_name: 'testset5', type: 'hash:ip', create_options: 'family inet6')
+    @iptables.append('mangle', 'custom', source: 'aaaa::ffff', protocol: :tcp, sport: 123)
+    active_rules = @iptables.get_active_rules('mangle', 'custom')
+    expect(active_rules[-1].key?(:match)).to be_falsey
+    @iptables.delete('mangle', 'custom', source: 'aaaa::ffff', protocol: :tcp, sport: 123)
+    @ipset.destroy(set_name: 'testset5')
+  end
+end

data/spec/spec_helper.rb

@@ -1,6 +1,13 @@
 # frozen_string_literal: true
 
 require 'simplecov'
+require 'simplecov-cobertura'
+
+SimpleCov.formatters = [
+  SimpleCov::Formatter::CoberturaFormatter,
+  SimpleCov::Formatter::HTMLFormatter
+]
+
 SimpleCov.start do
   enable_coverage :branch
   add_filter '/spec/'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tablomat
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0
 platform: ruby
 authors:
 - Matthias Wübbeling
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-12 00:00:00.000000000 Z
+date: 2022-11-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -81,6 +81,26 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.18.5
+- !ruby/object:Gem::Dependency
+  name: simplecov-cobertura
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.4.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.4.1
 description: A simple wrapper for iptables
 email:
 - matthias.wuebbeling@cs.uni-bonn.de
@@ -99,7 +119,9 @@ files:
 - lib/tablomat/iptables/rule.rb
 - lib/tablomat/iptables/table.rb
 - lib/tablomat/version.rb
+- spec/ip6tables_spec.rb
 - spec/ipset_spec.rb
+- spec/ipsetip6tables_spec.rb
 - spec/ipsetiptables_spec.rb
 - spec/iptables_spec.rb
 - spec/spec_helper.rb
@@ -122,12 +144,14 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.3.16
 signing_key: 
 specification_version: 4
 summary: This wrapper provides an interface to iptables.
 test_files:
+- spec/ip6tables_spec.rb
 - spec/ipset_spec.rb
+- spec/ipsetip6tables_spec.rb
 - spec/ipsetiptables_spec.rb
 - spec/iptables_spec.rb
 - spec/spec_helper.rb