The Tuple

Source Address

The firewall starts with exact tuple bytes, not prose.

highlighted = computed this step

Policy starts with tuple fields

This toy firewall reads a fixed tuple: source address, destination address, protocol, and ports.

tuple bytes=13\text{tuple bytes}=13
The source sideThe firewall tuple is decoded from exact pinned bytes.Tuple fields104 bits / 13 bytes0xc0a8010acb007105069c4001bbbyte 0byte 1byte 2byte 311000000101010000000000100001010byte 4byte 5byte 6byte 711001011000000000111000100000101byte 8byte 9byte 10byte 1100000110100111000100000000000001byte 1210111011source-ip192.168.1.10destination-ip203.0.113.5protocol6source-port40000destination-port443(cont.)

The source address is pinned

The source address in the tuple is 192.168.1.10. The rule table will compare it with source prefixes.

src=192.168.1.10\text{src}=192.168.1.10
The source sideThe firewall tuple is decoded from exact pinned bytes.Tuple fields104 bits / 13 bytes0xc0a8010acb007105069c4001bbbyte 0byte 1byte 2byte 311000000101010000000000100001010byte 4byte 5byte 6byte 711001011000000000111000100000101byte 8byte 9byte 10byte 1100000110100111000100000000000001byte 1210111011source-ip192.168.1.10destination-ip203.0.113.5protocol6source-port40000destination-port443(cont.)

The source port is also data

The source port is 40000. It is part of the tuple, but these pinned rules only filter the destination port.

source port=40000\text{source port}=40000
The source sideThe firewall tuple is decoded from exact pinned bytes.Tuple fields104 bits / 13 bytes0xc0a8010acb007105069c4001bbbyte 0byte 1byte 2byte 311000000101010000000000100001010byte 4byte 5byte 6byte 711001011000000000111000100000101byte 8byte 9byte 10byte 1100000110100111000100000000000001byte 1210111011source-ip192.168.1.10destination-ip203.0.113.5protocol6source-port40000destination-port443(cont.)

Summary

The tuple gives the firewall exact fields to compare; it does not guess from prose.

tuple bytes=13\text{tuple bytes}=13
The source sideThe firewall tuple is decoded from exact pinned bytes.Tuple fields104 bits / 13 bytes0xc0a8010acb007105069c4001bbbyte 0byte 1byte 2byte 311000000101010000000000100001010byte 4byte 5byte 6byte 711001011000000000111000100000101byte 8byte 9byte 10byte 1100000110100111000100000000000001byte 1210111011source-ip192.168.1.10destination-ip203.0.113.5protocol6source-port40000destination-port443(cont.)