class

Pared::Simulation::PacketTracer

Deterministic 7-stage packet evaluation pipeline over cached firewalld and NetworkManager state. Zones, policies, and socket data are injectable so the simulator stays fully testable without live D-Bus daemons.

Constants

DEFAULT_IPV6_RPFILTER_READER = -> : String | ::Nil do Pared::Firewalld.ipv6_rpfilter end

IPv6 reverse path filtering is implemented by firewalld as RFC 3704 nftables rules; the Linux kernel exposes no IPv6 rp_filter sysctl.

DEFAULT_POLICY_PRIORITY = -1

firewalld dispatches every implicit and user policy from the same filter_<chain>_POLICIES chain: zone-derived policies run at DEFAULT_POLICY_PRIORITY and carry the whole zone block (rich rules, service/port allows, ICMP acceptance) inside them, while the zone target is a terminal rule that sorts after all non-terminal policies. Rich-rule priorities order rules within the zone block only; they do not hoist those rules ahead of user policies.

DEFAULT_SYSCTL_READER = ->(path : String) : String | ::Nil do begin File.read(path) rescue nil end end

INTERFACE_NAME_PATTERN = /\A[A-Za-z0-9][A-Za-z0-9_.:@-]{0,14}\z/

Linux interface names are limited to IFNAMSIZ-1 characters and cannot contain path separators or whitespace.

KERNEL_HANDLED_PROTOCOLS = ["icmp", "icmpv6", "gre", "esp"] of ::String

Protocols terminated directly by the kernel network stack; they never bind userspace listening sockets.

SOURCE_KIND_PATTERN = Regex.new("\\A[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}\\z")

Zone sources may be addresses, MAC addresses, or ipset names; the synthetic packet only carries IPs, so MAC and ipset sources are reported instead of silently ignored.

Class methods

ipv6_rpfilter_reader

Source

ipv6_rpfilter_reader=(ipv6_rpfilter_reader : Proc(String | Nil))

Source

request_error(interface : String, source_ip : String, destination_ip : String, destination_port : Int32 | Nil, source_port : Int32 | Nil, protocol : String) : String | Nil

Validates operator-supplied trace parameters; returns an error message or nil when the request can be evaluated.

Source

sysctl_reader

Source

sysctl_reader=(sysctl_reader : Proc(String, String | Nil))

Source

valid_interface_name?(name : String) : Bool

Source

Instance methods

trace(packet : SyntheticPacket, zones : Array(Pared::Cache::ZoneSummary) = Pared::Cache.all_zone_summaries, policies : Array(Pared::Firewalld::PolicyConfig) | Nil = nil, listening_sockets : Array(Pared::Safety::ListeningSocket) = [] of Pared::Safety::ListeningSocket) : TraceResult

Source