module

Pared::Firewalld

Constants

BUS_DEST = "org.fedoraproject.FirewallD1"
BUS_PATH = "/org/fedoraproject/FirewallD1"
BUS_ZONE = "#{BUS_DEST}.zone"
IPV6_RPFILTER_MODES = ["strict", "loose", "strict-forward", "loose-forward"] of ::String

IPv6 reverse path filtering is not a kernel sysctl: firewalld enforces RFC 3704 rules in its own nftables filter when IPv6_rpfilter is enabled. The setting is exposed as a string property on the config interface.

PORT_SPEC_PATTERN = /\A(\d+)(?:-(\d+))?\z/
RICH_RULE_REGEX = Regex.new("^rule(\\s+family=\"(ipv4|ipv6)\")?(\\s+priority=\"\\-?\\d+\")?(\\s+source(\\s+not)?\\s+address=\"[^\"]+\")?(\\s+destination(\\s+not)?\\s+address=\"[^\"]+\")?(\\s+(service\\s+name=\"[^\"]+\"|port\\s+port=\"\\d+(\\-\\d+)?\"\\s+protocol=\"(tcp|udp|sctp|dccp)\"|protocol\\s+value=\"[^\"]+\"|icmp-type\\s+name=\"[^\"]+\"|masquerade|forward-port\\s+port=\"\\d+\"\\s+protocol=\"(tcp|udp|sctp|dccp)\"\\s+to-port=\"\\d+\"(\\s+to-addr=\"[^\"]+\")?))?(\\s+log(\\s+prefix=\"[^\"]+\")?(\\s+level=\"[^\"]+\")?(\\s+limit\\s+value=\"\\d+/[smhd]\")?)?(\\s+audit(\\s+limit\\s+value=\"\\d+/[smhd]\")?)?\\s+(accept|reject(\\s+type=\"[^\"]+\")?|drop|mark(\\s+set=\"[^\"]+\")?)(\\s+limit\\s+value=\"\\d+/[smhd]\")?$")
SERVICE_NAME_PATTERN = /\A[A-Za-z0-9_-]+\z/
SERVICE_PORTS = {"ssh" => ["22/tcp"], "http" => ["80/tcp"], "https" => ["443/tcp"], "http3" => ["443/udp"], "dns" => ["53/tcp", "53/udp"], "dhcp" => ["67/udp"], "dhcpv6" => ["547/udp"], "dhcpv6-client" => ["546/udp"], "cockpit" => ["9090/tcp"], "mdns" => ["5353/udp"], "samba" => ["137/udp", "138/udp", "139/tcp", "445/tcp"], "nfs" => ["2049/tcp", "2049/udp"], "ntp" => ["123/udp"], "smtp" => ["25/tcp"], "smtps" => ["465/tcp"], "imap" => ["143/tcp"], "imaps" => ["993/tcp"], "postgresql" => ["5432/tcp"], "mysql" => ["3306/tcp"], "redis" => ["6379/tcp"], "wireguard" => ["51820/udp"], "openvpn" => ["1194/udp", "1194/tcp"], "tftp" => ["69/udp"], "ldap" => ["389/tcp", "389/udp"], "ldaps" => ["636/tcp"], "kerberos" => ["88/tcp", "88/udp"], "rdp" => ["3389/tcp"], "vnc-server" => ["5900/tcp"], "squid" => ["3128/tcp"], "iscsi-target" => ["3260/tcp"]}

Well-known firewalld service catalog used by the packet tracer and the host exposure correlator to expand service names into port/protocol pairs.

TRANSPORT_PROTOCOLS = ["tcp", "udp", "sctp", "dccp"] of ::String

Transport protocols accepted by firewalld port and rich-rule elements.

Class methods

gdbus_caller
Source
gdbus_caller=(gdbus_caller : Proc(String, String, Array(String), String))
Source

Instance methods

active_zones
Source
add_forward_port(zone : String, port : String, protocol : String, to_port : String, to_addr : String)
Source
add_interface(zone : String, interface : String)
Source
add_masquerade(zone : String)
Source
add_policy(policy : PolicyConfig)
Source
add_port(zone : String, port : String, protocol : String)
Source
add_rich_rule(zone : String, rule : String)
Source
add_service(zone : String, service : String)
Source
add_source(zone : String, source : String)
Source
add_zone(name : String)
Source
all_zones
Source
cidr_contains?(parent : String, child : String) : Bool

Returns true when child (an IP address or CIDR network) is fully contained within the parent CIDR network. Address families must match.

Source
cidr_overlap?(first : String, second : String) : Bool

Returns true when two CIDR networks or addresses share any address space.

Source
commit
Source
compile_rich_rule(family : String | Nil = nil, priority : Int32 | Nil = nil, source : String | Nil = nil, destination : String | Nil = nil, element : String | Nil = nil, action : String = "accept", log_prefix : String | Nil = nil, log_level : String | Nil = nil, log_limit : String | Nil = nil, action_limit : String | Nil = nil) : String
Source
conflict_warning(conflicts : Array(ConflictResult)) : String | Nil

Renders the first detected conflict into a concise operator-facing warning suitable for flash messages, or nil when no conflict exists.

Source
get_policy_config_path(name : String) : String | Nil
Source
get_zone_config_path(name : String) : String | Nil
Source
ip_or_network?(value : String) : Bool

True when the string parses as a single IPv4/IPv6 address or CIDR network; used to validate operator input before evaluation.

Source
ipv6_rpfilter
Source
list_policies
Source
list_zone(zone : String) : ZoneConfig
Source
port_spec_error(spec : String) : String | Nil

Returns an error message when spec is not a single port or an ordered low-high range within 1..65535.

Source
reload
Source
remove_forward_port(zone : String, port : String, protocol : String, to_port : String, to_addr : String)
Source
remove_interface(zone : String, interface : String)
Source
remove_masquerade(zone : String)
Source
remove_policy(name : String)
Source
remove_port(zone : String, port : String, protocol : String)
Source
remove_rich_rule(zone : String, rule : String)
Source
remove_service(zone : String, service : String)
Source
remove_source(zone : String, source : String)
Source
remove_zone(name : String)
Source
rule_conflicts(existing_rules : Array(String), candidate_rule : String) : Array(ConflictResult)

Evaluates the raw rich rules already active in a zone against a candidate rule string, reporting any shadowing, contradictory, or duplicate conflicts that would prevent the candidate from evaluating as intended.

Source
service_name_error(name : String) : String | Nil

Returns an error message when name cannot be a firewalld service name.

Source
service_port?(service : String, port : Int32, protocol : String) : Bool
Source
service_ports(service : String) : Array(String)
Source
set_zone_target(zone : String, target : String)
Source
state
Source
transport_protocol?(protocol : String) : Bool
Source
update_policy(name : String, priority : Int32, ingress : Array(String), egress : Array(String), target : String)
Source
validate_rich_rule(rule : String) : Bool
Source

Nested types