Module: Microsandbox::Rule

Defined in:
lib/microsandbox/network.rb

Overview

Factory for a single network-policy rule. A rule pairs an action (allow/deny) with a direction, a destination, and optional protocol/port filters; rules are evaluated first-match-wins per direction.

destination: accepts a Destination Hash, a shorthand String ("*", "public", "1.1.1.1", "10.0.0.0/8", ".internal", "api.example.com"), or nil (any). Mirrors the Rule factory in the official SDKs.

Examples:

Microsandbox::Rule.allow(destination: "1.1.1.1", protocol: :tcp, port: "443")
Microsandbox::Rule.deny(destination: Microsandbox::Destination.group(:metadata))
Microsandbox::Rule.allow(direction: :ingress, destination: "10.0.0.0/8", port: "8000-9000")

Class Method Summary collapse

Class Method Details

.allow(destination: nil, direction: :egress, protocol: nil, protocols: nil, port: nil, ports: nil) ⇒ Hash

Build an allow rule. See Microsandbox::Rule for argument semantics.

Returns:

  • (Hash) 


55
56
57
 
# File 'lib/microsandbox/network.rb', line 55

def allow(destination: nil, direction: :egress, protocol: nil, protocols: nil, port: nil, ports: nil)
  build("allow", destination, direction, protocol, protocols, port, ports)
end

.allow_dns ⇒ Hash

Allow plain DNS (UDP/53 and TCP/53) to the sandbox gateway — the rule the composable profiles prepend automatically. Use it in custom policies that need name resolution. Expands to the same rule as the core's Rule::allow_dns (egress → group :host, udp+tcp, port 53).

Returns:

  • (Hash) 


70
71
72
73
74
 
# File 'lib/microsandbox/network.rb', line 70

def allow_dns
  {"action" => "allow", "direction" => "egress",
   "destination_kind" => "group", "destination" => "host",
   "protocols" => %w[udp tcp], "ports" => ["53"]}
end

.build(action, destination, direction, protocol, protocols, port, ports) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



84
85
86
87
88
89
90
91
92
 
# File 'lib/microsandbox/network.rb', line 84

def build(action, destination, direction, protocol, protocols, port, ports)
  rule = {"action" => action, "direction" => direction.to_s}
  rule.merge!(normalize_destination(destination))
  protos = (Array(protocols) + Array(protocol)).compact.map(&:to_s)
  rule["protocols"] = protos unless protos.empty?
  prts = (Array(ports) + Array(port)).compact.map(&:to_s)
  rule["ports"] = prts unless prts.empty?
  rule
end

.deny(destination: nil, direction: :egress, protocol: nil, protocols: nil, port: nil, ports: nil) ⇒ Hash

Build a deny rule.

Returns:

  • (Hash) 


61
62
63
 
# File 'lib/microsandbox/network.rb', line 61

def deny(destination: nil, direction: :egress, protocol: nil, protocols: nil, port: nil, ports: nil)
  build("deny", destination, direction, protocol, protocols, port, ports)
end

.deny_dns ⇒ Hash

Deny plain DNS to the sandbox gateway — the deny counterpart of allow_dns, useful as an override placed before profile-generated rules.

Returns:

  • (Hash) 


79
80
81
 
# File 'lib/microsandbox/network.rb', line 79

def deny_dns
  allow_dns.merge("action" => "deny")
end

.normalize_destination(dest) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



95
96
97
98
99
100
101
102
 
# File 'lib/microsandbox/network.rb', line 95

def normalize_destination(dest)
  case dest
  when nil then {}
  when Hash then dest.each_with_object({}) { |(k, v), a| a[k.to_s] = v }
  when String, Symbol then {"destination" => dest.to_s}
  else raise ArgumentError, "invalid rule destination: #{dest.inspect}"
  end
end