ruby - what does this script do? -

i don't know ruby , need understand script does. know calls ebtables add rules configure networks virtual machines. i'm not sure how?

this code:

#!/usr/bin/env ruby  require 'pp' require 'rexml/document'  vm_name=argv[0]  # uncomment act on listed bridges. #filtered_bridges = ['beth0']  def activate(rule)     system "sudo ebtables -a #{rule}" end  def get_bridges     bridges = hash.new     brctl_exit=`brctl show`     cur_bridge = ""     brctl_exit.split("\n")[1..-1].each |l|          l = l.split         if l.length > 1             cur_bridge = l[0]             bridges[cur_bridge] = array.new             bridges[cur_bridge] << l[3]         else             bridges[cur_bridge] << l[0]         end     end     bridges end  def get_interfaces     bridges = get_bridges     if defined? filtered_bridges         filtered_bridges.collect {|k,v| bridges[k]}.flatten     else         bridges.values.flatten     end end  nets=`virsh -c qemu:///system dumpxml #{vm_name}`  doc=rexml::document.new(nets).root  interfaces = get_interfaces()  doc.elements.each('/domain/devices/interface') {|net|     tap=net.elements['target'].attributes['dev']     if interfaces.include? tap         iface_mac=net.elements['mac'].attributes['address']          mac=iface_mac.split(':')         mac[-1]='00'         net_mac=mac.join(':')           in_rule="forward -s ! #{net_mac}/ff:ff:ff:ff:ff:00 -o #{tap} -j drop"         out_rule="forward -s ! #{iface_mac} -i #{tap} -j drop"          activate(in_rule)         activate(out_rule)     end } 

so apparently extracts mac adresses (not sure ones) , drops packet/or forwards them somewhere?

thanks lot help!

the script runs virsh -c qemu:///system dumpxml #{vm_name} vm_name first parameter script.

it runs twice, mistake. first run

nets=`virsh -c qemu:///system dumpxml #{vm_name}` 

then runs second time , places xml output in variable doc

doc=rexml::document.new(nets).root 

it loops on interfaces, getting value attribute dev in element <target. if value in result brctl show command gets mac address address attribute in <mac> element.

the mac split array : , last element in array changed '00' , net_mac created array.

#{net_mac} in in_rule assignment replaced newly constructed net_mac. , on.

then in_rule , out_rule applied sudo ebtables -a #{rule} command.

clear?