Class: Inspec::Resources::IpTables

Inherits:
Object
  • Object
show all
Defined in:
lib/inspec/resources/iptables.rb

Instance Method Summary collapse

Constructor Details

#initialize(params = {}) ⇒ IpTables

Returns a new instance of IpTables.



33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/inspec/resources/iptables.rb', line 33

def initialize(params = {})
  @table = params[:table]
  @chain = params[:chain]

  # we're done if we are on linux
  return if inspec.os.linux?

  # ensures, all calls are aborted for non-supported os
  @iptables_cache = []
  skip_resource "The `iptables` resource is not supported on your OS yet."
end

Instance Method Details

#has_rule?(rule = nil, _table = nil, _chain = nil) ⇒ Boolean

Returns:

  • (Boolean) 


45
46
47
48
49
 
# File 'lib/inspec/resources/iptables.rb', line 45

def has_rule?(rule = nil, _table = nil, _chain = nil)
  # checks if the rule is part of the ruleset
  # for now, we expect an exact match
  retrieve_rules.any? { |line| line.casecmp(rule) == 0 }
end

#retrieve_rules ⇒ Object 



51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/inspec/resources/iptables.rb', line 51

def retrieve_rules
  return @iptables_cache if defined?(@iptables_cache)

  # construct iptables command to read all rules
  bin = find_iptables_or_error
  table_cmd = "-t #{@table}" if @table
  iptables_cmd = format("%s %s -S %s", bin, table_cmd, @chain).strip

  cmd = inspec.command(iptables_cmd)
  return [] if cmd.exit_status.to_i != 0

  # split rules, returns array or rules
  @iptables_cache = cmd.stdout.split("\n").map(&:strip)
end

#to_s ⇒ Object 



66
67
68
 
# File 'lib/inspec/resources/iptables.rb', line 66

def to_s
  format("Iptables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
end