F11.7 Defending a network

Complete the firewall. For each packet in packets (an address and a port), check the rules in order and take the action of the first rule that matches. A rule matches if its port is any or equals the packet's port, and its address is any or equals the packet's address. Print <address>:<port> -> allow or -> block, and at the end print blocked <n> of <total>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

# each rule: (action, address, port). First match wins.
rules = [
    ("allow", "10.0.0.9", 22),
    ("block", "any", 22),
    ("allow", "any", 443),
    ("allow", "any", 80),
    ("block", "any", "any"),
]
# each packet: (address, port)
packets = [("10.0.0.9", 22), ("10.0.0.5", 22), ("10.0.0.5", 443), ("10.0.0.2", 8080), ("10.0.0.5", 80)]

The hint students can ask for: For each packet, walk the rules in order and stop at the first one that matches, taking its decision. A rule matches when its address and port either match the packet or are the wildcard. Count how many you blocked.

A solution

from bugbot import *
connect()
rules = [
    ("allow", "10.0.0.9", 22),
    ("block", "any", 22),
    ("allow", "any", 443),
    ("allow", "any", 80),
    ("block", "any", "any"),
]
packets = [("10.0.0.9", 22), ("10.0.0.5", 22), ("10.0.0.5", 443), ("10.0.0.2", 8080), ("10.0.0.5", 80)]
blocked = 0
for address, port in packets:
    decision = "block"
    for action, rule_addr, rule_port in rules:
        if (rule_port == "any" or rule_port == port) and (rule_addr == "any" or rule_addr == address):
            decision = action
            break
    if decision == "block":
        blocked = blocked + 1
    print(f"{address}:{port} -> {decision}")
print(f"blocked {blocked} of {len(packets)}")

Any program that meets the task's checks is marked correct in the simulator; this is one way, not the only way.