Class: Straycall::Policy::Network

Inherits:
Object
  • Object
show all
Defined in:
lib/straycall/policy/network.rb

Defined Under Namespace

Classes: Rule

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Network

Returns a new instance of Network.



11
12
13
14
15
16
17
 
# File 'lib/straycall/policy/network.rb', line 11

def initialize
  @default = :deny
  @inet = []
  @unix = []
  @domains = []
  @allow_unbound_listen = false
end

Instance Method Details

#allow! ⇒ Object 



23
24
25
 
# File 'lib/straycall/policy/network.rb', line 23

def allow!
  @default = :allow
end

#allow_all? ⇒ Boolean

Returns:

  • (Boolean) 


89
90
91
 
# File 'lib/straycall/policy/network.rb', line 89

def allow_all?
  @default == :allow
end

#allow_domain(domain) ⇒ Object

Raises:



52
53
54
55
56
 
# File 'lib/straycall/policy/network.rb', line 52

def allow_domain(domain)
  raise ConfigurationError, "socket domains must be non-negative integers" unless domain.is_a?(Integer) && domain >= 0

  @domains << domain
end

#allow_host(host, ports: nil) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/straycall/policy/network.rb', line 40

def allow_host(host, ports: nil)
  unless host.is_a?(String) && !host.empty? && !host.include?("\0")
    raise ConfigurationError, "hosts must be non-empty strings without NUL bytes"
  end

  Addrinfo.getaddrinfo(host, nil, nil, Socket::SOCK_STREAM).filter_map do |address|
    add_inet(IPAddr.new(address.ip_address), ports) if address.ip?
  end
rescue SocketError => error
  raise ConfigurationError, "cannot resolve host #{host.inspect}: #{error.message}"
end

#allow_loopback(ports: nil) ⇒ Object 



27
28
29
30
 
# File 'lib/straycall/policy/network.rb', line 27

def allow_loopback(ports: nil)
  add_inet(IPAddr.new("127.0.0.0/8"), ports)
  add_inet(IPAddr.new("::1"), ports)
end

#allow_unbound_listen! ⇒ Object 



58
59
60
 
# File 'lib/straycall/policy/network.rb', line 58

def allow_unbound_listen!
  @allow_unbound_listen = true
end

#allow_unix(path) ⇒ Object 



32
33
34
35
36
37
38
 
# File 'lib/straycall/policy/network.rb', line 32

def allow_unix(path)
  unless path.is_a?(String) && !path.empty? && !path.include?("\0")
    raise ConfigurationError, "Unix socket paths must be non-empty strings without NUL bytes"
  end

  @unix << File.expand_path(path)
end

#allowed?(address) ⇒ Boolean

Returns:

  • (Boolean) 


70
71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/straycall/policy/network.rb', line 70

def allowed?(address)
  return true if @default == :allow
  if address.unix?
    path = address.unix_path
    return @unix.any? { |prefix| path == prefix || path.start_with?(File.join(prefix, "")) }
  end
  return false unless address.ip?

  ip = IPAddr.new(address.ip_address.split("%", 2).first)
  ip = ip.native if ip.ipv4_mapped?
  @inet.any? do |rule|
    rule.address.include?(ip) && (rule.ports.nil? || rule.ports.any? { |port| port === address.ip_port })
  end
end

#allowed_domain?(domain) ⇒ Boolean

Returns:

  • (Boolean) 


62
63
64
 
# File 'lib/straycall/policy/network.rb', line 62

def allowed_domain?(domain)
  @default == :allow || @domains.include?(domain)
end

#deny! ⇒ Object 



19
20
21
 
# File 'lib/straycall/policy/network.rb', line 19

def deny!
  @default = :deny
end

#endpoint?(address) ⇒ Boolean

Returns:

  • (Boolean) 


85
86
87
 
# File 'lib/straycall/policy/network.rb', line 85

def endpoint?(address)
  address.unix? || address.ip?
end

#unbound_listen_allowed? ⇒ Boolean

Returns:

  • (Boolean) 


66
67
68
 
# File 'lib/straycall/policy/network.rb', line 66

def unbound_listen_allowed?
  @default == :allow || @allow_unbound_listen
end