softwarecontainer::IPTableEntry Class Reference

A rules entry for the treatment of packets. More...

#include <iptableentry.h>

Data Structures
struct	portFilter
	container for port filtering options. More...
struct	Rule
	Definition of a 'Rule' used to handle network traffic. More...

Public Types
enum	Target { INVALID_TARGET, ACCEPT, DROP, REJECT }
	Targets for Rules. More...

Public Member Functions
bool	applyRules ()
	Applies all rules to iptables. More...
std::string	interpretRule (Rule rule)
	Interprets a rule to iptables applicable string. More...
std::string	interpretRuleWithProtocol (Rule rule, const std::string &protocol)
	Interprets a rule with protocol information to iptables applicable string. More...
std::string	interpretPolicy (void)
	This function Interprets defaultTarget rule to iptables applicable policy string. More...
std::string	toString ()
	Creates a string with information about the entry. More...

Data Fields
std::string	m_type
std::vector< Rule >	m_rules
Target	m_defaultTarget

Detailed Description

A rules entry for the treatment of packets.

Definition at line 29 of file iptableentry.h.

Member Enumeration Documentation

enum softwarecontainer::IPTableEntry::Target

Targets for Rules.

Definition at line 51 of file iptableentry.h.

    {
        INVALID_TARGET,
        ACCEPT,
        DROP,
        REJECT
    };

Member Function Documentation

bool softwarecontainer::IPTableEntry::applyRules

(

)

Applies all rules to iptables.

Returns

true Upon success

false Upon failure

Definition at line 26 of file iptableentry.cpp.

References interpretPolicy(), interpretRule(), and interpretRuleWithProtocol().

{
    for (auto rule : m_rules) {
        if (rule.protocols.size()) {

            for (auto proto : rule.protocols) {
                if (!insertCommand(interpretRuleWithProtocol(rule, proto))) {
                    std::cerr << "Couldn't apply the rule " << rule.target << std::endl;
                    return false;
                }
            }

        } else if (!insertCommand(interpretRule(rule))) {
            std::cerr << "Couldn't apply the rule " << rule.target << std::endl;
            return false;
        }
    }

    if (!insertCommand(interpretPolicy())) {
        std::cerr << "Unable to set policy " << convertTarget(m_defaultTarget)
                  << " for " << m_type << std::endl;
        return false;
    }

    return true;
}

Here is the call graph for this function:

std::string softwarecontainer::IPTableEntry::interpretRule

(

Rule

rule

)

Interprets a rule to iptables applicable string.

Returns

string indicating interpreted rule

Definition at line 110 of file iptableentry.cpp.

Referenced by applyRules().

{
    std::string iptableCommand = "iptables -A " + m_type;

    if (!rule.host.empty()) {
        if (rule.host != "*") {
            if ("INPUT" == m_type) {
                iptableCommand = iptableCommand + " -s ";
            } else {
                iptableCommand = iptableCommand + " -d ";
            }
            iptableCommand = iptableCommand + rule.host ;
        }
    }

    if (rule.ports.any) {
        if (rule.ports.multiport) {
            iptableCommand = iptableCommand + " -p all --match multiport ";

            if ("INPUT" == m_type) {
                iptableCommand = iptableCommand + "--sports " + rule.ports.ports;
            } else {
                iptableCommand = iptableCommand + "--dports " + rule.ports.ports;
            }
        } else {
            iptableCommand = iptableCommand + " -p tcp ";
            if ("INPUT" == m_type) {
                iptableCommand = iptableCommand + "--sport " + rule.ports.ports;
            } else {
                iptableCommand = iptableCommand + "--dport " + rule.ports.ports;
            }
        }
    }

    iptableCommand = iptableCommand + " -j " + convertTarget(rule.target);

    return iptableCommand;
}

Here is the caller graph for this function:

std::string softwarecontainer::IPTableEntry::interpretRuleWithProtocol	(	Rule	rule,
		const std::string &	protocol
	)

Interprets a rule with protocol information to iptables applicable string.

Returns

string indicating interpreted rule

Definition at line 69 of file iptableentry.cpp.

Referenced by applyRules().

{
    std::string iptableCommand = "iptables -A " + m_type;

    if (!rule.host.empty()) {
        if (rule.host != "*") {
            if ("INPUT" == m_type) {
                iptableCommand = iptableCommand + " -s ";
            } else {
                iptableCommand = iptableCommand + " -d ";
            }
            iptableCommand = iptableCommand + rule.host ;
        }
    }

    if (rule.ports.any) {
        if (rule.ports.multiport) {
            iptableCommand = iptableCommand + " -p " + protocol + " --match multiport ";

            if ("INPUT" == m_type) {
                iptableCommand = iptableCommand + "--sports " + rule.ports.ports;
            } else {
                iptableCommand = iptableCommand + "--dports " + rule.ports.ports;
            }
        } else {
            iptableCommand = iptableCommand + " -p " + protocol + " ";
            if ("INPUT" == m_type) {
                iptableCommand = iptableCommand + "--sport " + rule.ports.ports;
            } else {
                iptableCommand = iptableCommand + "--dport " + rule.ports.ports;
            }
        }
    } else {
        iptableCommand = iptableCommand + " -p " + protocol;
    }

    iptableCommand = iptableCommand + " -j " + convertTarget(rule.target);

    return iptableCommand;
}

Here is the caller graph for this function:

std::string softwarecontainer::IPTableEntry::interpretPolicy

(

void

)

This function Interprets defaultTarget rule to iptables applicable policy string.

defaultTarget indicates what happens to packets if they don't match to any rules. iptables apply this functionality with setting policy. The role of this function is converting defaultTarget configuration value to iptables policy

Returns

string indicating interpreted policy

empty string when interfered incompatible m_defaultTarget

Definition at line 149 of file iptableentry.cpp.

Referenced by applyRules().

{
    if (m_defaultTarget != Target::ACCEPT && m_defaultTarget != Target::DROP) {
        std::cerr << "Wrong default target : " << convertTarget(m_defaultTarget) << std::endl;
        return "";
    }
    std::string iptableCommand = "iptables -P " + m_type + " " + convertTarget(m_defaultTarget);

    return iptableCommand;
}

Here is the caller graph for this function:

std::string softwarecontainer::IPTableEntry::toString

(

)

Creates a string with information about the entry.

Definition at line 182 of file iptableentry.cpp.

{
    return "IPTableEntry type: " + m_type;
}

---

The documentation for this class was generated from the following files:

• libsoftwarecontainer/src/gateway/network/iptableentry.h
• libsoftwarecontainer/src/gateway/network/iptableentry.cpp