Clash Royale CLAN TAG

Iptables rules validation

I have a perl script that generates a shell script that will later be loaded by iptables on a remote machine. The data input for the perl script comes from a config file, where I can specify all kind of parameters for each rule.

perl

iptables

The problem is about validation, How would you validate the whole set of rules without the ability of executing it?

I have searched on CPAN and the closest solution was IPTables::Rule but it only validates some of the restrictions when it generates the rule. I can't use IPTables::IPv4 because it interacts directly with the host iptables.

4 Answers
4

This isn't directly achieveable. The iptables rules string syntax is parsed partly by iptables(8) and partly by the individual matching or action modules that are loaded. There's no standard way to parse the input without invoking the underlying C modules directly.

iptables

iptables(8)

Check out fffuu, the fancy formal firewall universal understander. It is a static analyzer for rulesets of the iptables firewall. The tool is still under active development (as of February 2017) and not completely finished yet. However, the core is completely formally verified and thus, you can trust it.

As input, it just needs the output of iptables-save. For your scenario, you could generate this output on a virtual machine.

iptables-save

What do you want to validate?

fffuu can:

Note that ITval has bugs, reported in Verified iptables Firewall Analysis by Cornelius Diekmann, Julius Michaelis, Maximilian Haslbeck, and Georg Carle. In IFIP Networking 2016, Vienna, Austria, May 2016 (Section 2, paragraph 2).

Disclaimer: I'm the author of fffuu, my views may be biased and fffuu is not perfect (yet). But hey, it's free and libre and I hope it helps. Feel free to reuse any of the code :-)

check the following sf.net project http://sourceforge.net/projects/itval/

Here is how I test rules in a sh script:

#!/bin/sh
/usr/sbin/iptables-restore --test < yourfileofrules
[ $? -ne 0 ] && {
echo File does NOT syntax check
exit 1
}


In perl, you'll execute the iptables-restore command in whatever way you prefer and then check for a '0' exit status for success.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.