pfctl 0.7.0

Library for interfacing with the Packet Filter (PF) firewall on macOS
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

#[macro_use]
#[allow(dead_code)]
mod helper;

use crate::helper::pfcli;
use assert_matches::assert_matches;

static ANCHOR_NAME: &str = "pfctl-rs.integration.testing.scrub-rules";

fn before_each() {
    pfctl::PfCtl::new()
        .unwrap()
        .try_add_anchor(ANCHOR_NAME, pfctl::AnchorKind::Scrub)
        .unwrap();
}

fn after_each() {
    pfcli::flush_rules(ANCHOR_NAME, pfcli::FlushOptions::All);
    pfctl::PfCtl::new()
        .unwrap()
        .try_remove_anchor(ANCHOR_NAME, pfctl::AnchorKind::Scrub)
        .unwrap();
}

fn scrub_rule() -> pfctl::ScrubRule {
    pfctl::ScrubRuleBuilder::default()
        .action(pfctl::ScrubRuleAction::Scrub)
        .build()
        .unwrap()
}

fn no_scrub_rule() -> pfctl::ScrubRule {
    pfctl::ScrubRuleBuilder::default()
        .action(pfctl::ScrubRuleAction::NoScrub)
        .build()
        .unwrap()
}

test!(flush_scrub_rules {
    let mut pf = pfctl::PfCtl::new().unwrap();
    let test_rules = [scrub_rule(), no_scrub_rule()];
    for rule in test_rules.iter() {
        assert_matches!(pf.add_scrub_rule(ANCHOR_NAME, rule), Ok(()));
        assert_eq!(pfcli::get_rules(ANCHOR_NAME).len(), 1);

        assert_matches!(pf.flush_rules(ANCHOR_NAME, pfctl::RulesetKind::Scrub), Ok(()));
        assert_eq!(
            pfcli::get_rules(ANCHOR_NAME),
            &[] as &[&str]
        );
    }
});

test!(add_scrub_rule {
    let mut pf = pfctl::PfCtl::new().unwrap();
    let rule = scrub_rule();
    assert_matches!(pf.add_scrub_rule(ANCHOR_NAME, &rule), Ok(()));
    assert_eq!(
        pfcli::get_rules(ANCHOR_NAME),
        &["scrub all fragment reassemble"]
    );
});

test!(add_no_scrub_rule {
    let mut pf = pfctl::PfCtl::new().unwrap();
    let rule = no_scrub_rule();
    assert_matches!(pf.add_scrub_rule(ANCHOR_NAME, &rule), Ok(()));
    assert_eq!(
        pfcli::get_rules(ANCHOR_NAME),
        &["no scrub all"]
    );
});