iptables 0.0.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (16) hide show
  1. data/.gitignore +3 -0
  2. data/.ruby-version +1 -0
  3. data/.travis.yml +12 -0
  4. data/Gemfile +3 -0
  5. data/README.md +17 -0
  6. data/bin/iptables-decode +18 -0
  7. data/iptables.gemspec +21 -0
  8. data/lib/iptables.rb +327 -0
  9. data/sample_data/complex-iptables-135 +219 -0
  10. data/sample_data/complex-iptables-147 +270 -0
  11. data/spec/spec_helper.rb +2 -0
  12. data/spec/unit/iptables/decoder/basic_spec.rb +7 -0
  13. data/spec/unit/iptables/decoder/rule_spec.rb +151 -0
  14. data/spec/unit/iptables/decoder/shellsplit_spec.rb +27 -0
  15. data/spec/unit/iptables/decoder/switch_hash_spec.rb +131 -0
  16. metadata +112 -0
data/sample_data/complex-iptables-147 ADDED
@@ -0,0 +1,270 @@
1
+ # Generated by iptables-save v1.4.7 on Sun Feb 24 00:48:11 2013
2
+ *mangle
3
+ :PREROUTING ACCEPT [756:54757]
4
+ :INPUT ACCEPT [756:54757]
5
+ :FORWARD ACCEPT [0:0]
6
+ :OUTPUT ACCEPT [578:527896]
7
+ :POSTROUTING ACCEPT [578:527896]
8
+ -A INPUT -s 1.1.1.2/32 -j CHECKSUM --checksum-fill
9
+ -A OUTPUT -s 1.1.1.2/32 -j CLASSIFY --set-class 0004:0056
10
+ COMMIT
11
+ # Completed on Sun Feb 24 00:48:11 2013
12
+ # Generated by iptables-save v1.4.7 on Sun Feb 24 00:48:11 2013
13
+ *filter
14
+ :INPUT ACCEPT [0:0]
15
+ :FORWARD ACCEPT [0:0]
16
+ :OUTPUT ACCEPT [1096:944096]
17
+ :foo - [0:0]
18
+ -A INPUT -p tcp -m comment --comment "000 foo" -j ACCEPT
19
+ -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
20
+ -A INPUT -p icmp -j ACCEPT
21
+ -A INPUT -i lo -j ACCEPT
22
+ -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
23
+ -A INPUT -j REJECT --reject-with icmp-host-prohibited
24
+ -A INPUT -p tcp
25
+ -A INPUT -s 1.1.1.1/32
26
+ -A INPUT -s 1.1.1.0/24
27
+ -A INPUT -d 1.1.1.0/24
28
+ -A INPUT -d 1.1.0.0/16
29
+ -A INPUT ! -p tcp
30
+ -A INPUT ! -s 1.1.1.0/24
31
+ -A INPUT ! -s 1.1.1.1/32
32
+ -A INPUT ! -d 1.1.0.0/16
33
+ -A INPUT -s 1.1.1.0/24
34
+ -A INPUT -s 1.1.2.1/24
35
+ -A INPUT -j ACCEPT
36
+ -A INPUT -s 1.1.1.1/32 -g foo
37
+ -A INPUT -i eth0
38
+ -A INPUT ! -i eth0
39
+ -A INPUT -i eth0:0
40
+ -A INPUT ! -i eth0:0
41
+ -A INPUT -m addrtype --src-type UNSPEC
42
+ -A INPUT -m addrtype --src-type LOCAL
43
+ -A INPUT -m addrtype ! --src-type LOCAL
44
+ -A INPUT -m addrtype --dst-type UNSPEC
45
+ -A INPUT -m addrtype --dst-type LOCAL
46
+ -A INPUT -m addrtype ! --dst-type LOCAL
47
+ -A INPUT -m addrtype ! --dst-type UNSPEC
48
+ -A INPUT -m addrtype --src-type UNSPEC --limit-iface-in
49
+ -A INPUT -m addrtype ! --src-type UNSPEC --limit-iface-in
50
+ -A INPUT -m addrtype ! --src-type UNSPEC --limit-iface-out
51
+ -A INPUT -m addrtype --src-type UNSPEC --limit-iface-out
52
+ -A INPUT -p ah -m ah --ahspi 1
53
+ -A INPUT -p ah -m ah --ahspi 1
54
+ -A INPUT -p ah -m ah ! --ahspi 1
55
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
56
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
57
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
58
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
59
+ -A INPUT -s 1.1.1.1/32 -m comment --comment "foobar baz fooo foo baz"
60
+ -A INPUT -s 1.1.1.1/32 -m connbytes --connbytes 10:1000 --connbytes-mode packets --connbytes-dir both
61
+ -A INPUT -s 1.1.1.1/32 -m connbytes ! --connbytes 10:1000 --connbytes-mode packets --connbytes-dir both
62
+ -A INPUT -s 1.1.1.1/32 -m connlimit --connlimit-above 1 --connlimit-mask 32
63
+ -A INPUT -s 1.1.1.1/32 -m connlimit ! --connlimit-above 1 --connlimit-mask 32
64
+ -A INPUT -s 1.1.1.1/32 -m connlimit --connlimit-above 1 --connlimit-mask 24
65
+ -A INPUT -s 1.1.1.1/32 -m connlimit ! --connlimit-above 1 --connlimit-mask 24
66
+ -A INPUT -s 1.1.1.1/32 -m connmark --mark 0x18/0x1
67
+ -A INPUT -s 1.1.1.1/32 -m connmark ! --mark 0x18/0x1
68
+ -A INPUT -s 1.1.1.1/32 -m connmark ! --mark 0x18/0x1 -m connmark --mark 0x3/0x1
69
+ -A INPUT -p ah -m ah ! --ahspi 1 -m ah --ahspi 3
70
+ -A INPUT -p ah -m ah ! --ahspi 1 -m connmark --mark 0x3/0x1 -m ah --ahspi 3
71
+ -A INPUT -p ah -m ah ! --ahspi 1 -m connmark --mark 0x3/0x1 -m ah --ahspi 3 -m connmark ! --mark 0x18/0x1
72
+ -A INPUT -p ah -m ah ! --ahspi 1 -m ah ! --ahspi 1
73
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctstate NEW
74
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctstate NEW
75
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctproto 3
76
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctproto 3
77
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigsrc 1.1.1.0
78
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigsrc 1.1.1.0
79
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigdst 1.1.1.0
80
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigdst 1.1.1.0
81
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctreplsrc 1.1.1.0
82
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctreplsrc 1.1.1.0
83
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctrepldst 1.1.1.0
84
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctrepldst 1.1.1.0
85
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigsrcport 2
86
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigsrcport 2
87
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigdstport 2
88
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigdstport 2
89
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigsrcport 2
90
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigsrcport 3
91
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctreplsrcport 3
92
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctreplsrcport 3
93
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctstatus NONE
94
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctstatus NONE
95
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctexpire 12
96
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctexpire 12
97
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctdir ORIGINAL
98
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --sport 3
99
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp ! --sport 3
100
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dport 3
101
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp ! --dport 3
102
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-type REQUEST,DATA
103
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-type ! REQUEST,DATA
104
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-option 1
105
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-option 1
106
+ -A INPUT -s 1.1.1.1/32 -m dscp --dscp 0x01
107
+ -A INPUT -s 1.1.1.1/32 -m dscp ! --dscp 0x01
108
+ -A INPUT -s 1.1.1.1/32 -m dscp --dscp 0x00
109
+ -A INPUT -s 1.1.1.1/32 -m dscp ! --dscp 0x00
110
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn --ecn-tcp-cwr
111
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn --ecn-tcp-ece
112
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn ! --ecn-tcp-cwr
113
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn ! --ecn-tcp-ece
114
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn --ecn-ip-ect 3
115
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn ! --ecn-ip-ect 3
116
+ -A INPUT -s 1.1.1.1/32 -p esp -m esp --espspi 1
117
+ -A INPUT -s 1.1.1.1/32 -p esp -m esp --espspi 1:24
118
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-upto 1/sec --hashlimit-name foo
119
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-upto 1/sec --hashlimit-name foo
120
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-upto 1/min --hashlimit-name foo
121
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo
122
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo
123
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-mode srcip --hashlimit-name foo
124
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-srcmask 24
125
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-dstmask 24
126
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-htable-size 3
127
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo
128
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-htable-gcinterval 10000
129
+ -A INPUT -s 1.1.1.1/32 -m helper --helper "foo"
130
+ -A INPUT -s 1.1.1.1/32 -m helper ! --helper "foo"
131
+ -A INPUT -s 1.1.1.1/32 -p icmp -m icmp --icmp-type 12/0
132
+ -A INPUT -s 1.1.1.1/32 -p icmp -m icmp ! --icmp-type 12/0
133
+ -A INPUT -m iprange ! --src-range 1.1.1.1-2.2.2.2
134
+ -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2
135
+ -A INPUT -m iprange --dst-range 1.1.1.1-2.2.2.2
136
+ -A INPUT -m iprange ! --dst-range 1.1.1.1-2.2.2.2
137
+ -A INPUT -m length --length 1:20
138
+ -A INPUT -m length ! --length 1:20
139
+ -A INPUT -m limit --limit 3/sec
140
+ -A INPUT -m limit --limit 3/hour --limit-burst 4
141
+ -A INPUT -m mac --mac-source AA:AA:AA:AA:AA:AA
142
+ -A INPUT -m mac ! --mac-source AA:AA:AA:AA:AA:AA
143
+ -A INPUT -m mark --mark 0x4/0x5
144
+ -A INPUT -m mark ! --mark 0x4/0x5
145
+ -A INPUT -p dccp -m multiport --sports 1,2,3,4,5:6
146
+ -A INPUT -p dccp -m multiport ! --sports 1,2,3,4,5:6
147
+ -A INPUT -p dccp -m multiport --dports 3,4,5,6
148
+ -A INPUT -p dccp -m multiport ! --dports 3,4,5,6
149
+ -A INPUT -p dccp -m multiport ! --ports 3,4,5,6
150
+ -A INPUT -p dccp -m multiport --ports 3,4,5,6
151
+ -A INPUT -p dccp -m owner --uid-owner root
152
+ -A INPUT -p dccp -m owner ! --uid-owner root
153
+ -A INPUT -p dccp -m owner --uid-owner 5000-6000
154
+ -A INPUT -p dccp -m owner ! --uid-owner 5000-6000
155
+ -A INPUT -p dccp -m owner --gid-owner wheel
156
+ -A INPUT -p dccp -m owner ! --gid-owner wheel
157
+ -A INPUT -p dccp -m owner --socket-exists
158
+ -A INPUT -p dccp -m owner ! --socket-exists
159
+ -A INPUT -p dccp -m physdev --physdev-in eth0
160
+ -A INPUT -p dccp -m physdev --physdev-in eth0:0
161
+ -A INPUT -p dccp -m physdev ! --physdev-in eth0:0
162
+ -A INPUT -p dccp -m physdev --physdev-out eth0:0
163
+ -A INPUT -p dccp -m physdev ! --physdev-out eth0:0
164
+ -A INPUT -p dccp -m physdev --physdev-is-in
165
+ -A INPUT -p dccp -m physdev ! --physdev-is-in
166
+ -A INPUT -p dccp -m physdev --physdev-is-out
167
+ -A INPUT -p dccp -m physdev ! --physdev-is-out
168
+ -A INPUT -p dccp -m physdev --physdev-is-bridged
169
+ -A INPUT -p dccp -m physdev ! --physdev-is-bridged
170
+ -A INPUT -p dccp -m pkttype --pkt-type unicast
171
+ -A INPUT -p dccp -m pkttype ! --pkt-type unicast
172
+ -A INPUT -p dccp -m policy --dir in --pol ipsec
173
+ -A INPUT -p dccp -m policy --dir out --pol ipsec
174
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --strict --reqid 3
175
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --reqid 3
176
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --reqid 3
177
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --spi 0x3
178
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --spi 0x3
179
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --proto ah
180
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --proto ah
181
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel
182
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --mode tunnel
183
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel --tunnel-src 1.1.1.0/24
184
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel ! --tunnel-src 1.1.1.0/24
185
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel --tunnel-dst 1.1.1.0/24
186
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel ! --tunnel-dst 1.1.1.0/24
187
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --strict --mode tunnel
188
+ -A INPUT -p dccp -m quota --quota 0
189
+ -A INPUT -p dccp -m quota --quota 56
190
+ -A INPUT -p dccp -m realm --realm 0x22/0x18
191
+ -A INPUT -p dccp -m realm ! --realm 0x22/0x18
192
+ -A INPUT -p dccp -m recent --set --name foo --rsource
193
+ -A INPUT -p dccp -m recent ! --set --name foo --rsource
194
+ -A INPUT -p dccp -m recent --set --name DEFAULT --rsource
195
+ -A INPUT -p dccp -m recent --set --name DEFAULT --rdest
196
+ -A INPUT -p dccp -m recent --rcheck --name DEFAULT --rsource
197
+ -A INPUT -p dccp -m recent ! --rcheck --name DEFAULT --rsource
198
+ -A INPUT -p dccp -m recent --update --name DEFAULT --rsource
199
+ -A INPUT -p dccp -m recent ! --update --name DEFAULT --rsource
200
+ -A INPUT -s 1.1.1.1/32 -p icmp -m recent --remove --name DEFAULT --rsource
201
+ -A INPUT -s 1.1.1.1/32 -p icmp -m recent --update --rttl --name DEFAULT --rsource
202
+ -A INPUT -p sctp -m sctp --sport 1
203
+ -A INPUT -p sctp -m sctp --sport 1:3
204
+ -A INPUT -p sctp -m sctp ! --sport 1:3
205
+ -A INPUT -p sctp -m sctp ! --sport 1:3
206
+ -A INPUT -p sctp -m sctp --dport 3
207
+ -A INPUT -p sctp -m sctp ! --dport 3
208
+ -A INPUT -p sctp -m sctp --chunk-types all DATA
209
+ -A INPUT -p sctp -m sctp --chunk-types all DATA:U
210
+ -A INPUT -p sctp -m sctp ! --chunk-types all DATA:U
211
+ -A INPUT -p sctp -m set --match-set foo src
212
+ -A INPUT -p sctp -m set ! --match-set foo src,dst
213
+ -A INPUT -p sctp -m socket
214
+ -A INPUT -p sctp -m socket --transparent
215
+ -A INPUT -p sctp -m state --state INVALID
216
+ -A INPUT -p sctp -m state --state NEW,RELATED,ESTABLISHED,UNTRACKED
217
+ -A INPUT -p sctp -m statistic --mode nth --every 1
218
+ -A INPUT -p sctp -m statistic --mode random --probability 0.000000
219
+ -A INPUT -p sctp -m statistic --mode random --probability 1.000000
220
+ -A INPUT -p sctp -m statistic --mode nth --every 4
221
+ -A INPUT -p sctp -m statistic --mode nth --every 4 --packet 2
222
+ -A INPUT -p sctp -m string --string "foo" --algo bm --to 65535
223
+ -A INPUT -p sctp -m string --string "foo" --algo bm --from 5 --to 65535
224
+ -A INPUT -p sctp -m string --string "foo" --algo bm --to 5
225
+ -A INPUT -p sctp -m string ! --string "foo" --algo bm --to 65535
226
+ -A INPUT -p sctp -m string --string "00BBCC" --algo bm --to 65535
227
+ -A INPUT -p sctp -m string ! --string "00BBCC" --algo bm --to 65535
228
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --sport 5
229
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --sport 5:66
230
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --sport 5
231
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --dport 1
232
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --dport 1:45
233
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --tcp-flags SYN,ACK SYN
234
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --tcp-flags SYN,ACK SYN
235
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --dport 1:45
236
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN
237
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN
238
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --tcp-option 4
239
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --tcp-option 4
240
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestart 1979-12-31T23:00:00 --datestop 2038-01-19T03:14:07
241
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestop 1980-01-01T00:00:00
242
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --timestart 12:34:11 --timestop 23:59:59 --datestop 2038-01-19T03:14:07
243
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --timestart 00:00:00 --timestop 12:23:00 --datestop 2038-01-19T03:14:07
244
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --timestart 00:00:00 --timestop 12:23:11 --datestop 2038-01-19T03:14:07
245
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --monthdays 4 --datestop 2038-01-19T03:14:07
246
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --monthdays 1,2,3,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 --datestop 2038-01-19T03:14:07
247
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --weekdays Fri --datestop 2038-01-19T03:14:07
248
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --weekdays Fri,Sun --datestop 2038-01-19T03:14:07
249
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --weekdays Mon,Tue,Wed,Thu,Sat --datestop 2038-01-19T03:14:07
250
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestop 2038-01-19T03:14:07 --utc
251
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestop 2038-01-19T03:14:07
252
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos --tos 0x05/0xff
253
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos --tos 0x05/0x06
254
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos ! --tos 0x05/0x06
255
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos --tos 0x04/0xff
256
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos ! --tos 0x04/0xff
257
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ttl --ttl-eq 5
258
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ttl --ttl-gt 6
259
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ttl --ttl-lt 6
260
+ -A INPUT -s 1.1.1.1/32 -p tcp -m u32 --u32 0x0&0xffff=0x100:0xffff
261
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp --sport 55
262
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp ! --sport 55
263
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp --dport 66:67
264
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp ! --dport 66:67
265
+ -A FORWARD -j REJECT --reject-with icmp-host-prohibited
266
+ -A OUTPUT -o eth0
267
+ -A OUTPUT ! -o eth0
268
+ -A OUTPUT ! -o eth0:0
269
+ COMMIT
270
+ # Completed on Sun Feb 24 00:48:11 2013
data/spec/spec_helper.rb ADDED
@@ -0,0 +1,2 @@
1
+ require 'bundler/setup'
2
+ Bundler.require :default
data/spec/unit/iptables/decoder/basic_spec.rb ADDED
@@ -0,0 +1,7 @@
1
+ require 'spec_helper'
2
+
3
+ describe Iptables::Decoder do
4
+ it 'should allow instantiation' do
5
+ Iptables::Decoder.new
6
+ end
7
+ end
data/spec/unit/iptables/decoder/rule_spec.rb ADDED
@@ -0,0 +1,151 @@
1
+ require 'spec_helper'
2
+
3
+ describe 'Iptables::Decoder#rule_hash' do
4
+ subject do
5
+ Iptables::Decoder.new
6
+ end
7
+
8
+ tests = [
9
+ {:name => "basic destination option 1",
10
+ :input => [
11
+ {:values=>["OUTPUT"], :switch=>"A"},
12
+ {:values=>["1.1.1.2/32"], :switch=>"s"},
13
+ {:values=>["CLASSIFY"], :switch=>"j"},
14
+ {:values=>["0004:0056"], :switch=>"set-class"}],
15
+ :output => {
16
+ :chain => "OUTPUT",
17
+ :parameters => {
18
+ "s" => ["1.1.1.2/32"],
19
+ },
20
+ :matches => [],
21
+ :target => "CLASSIFY",
22
+ :target_options => {
23
+ "set-class" => ["0004:0056"],
24
+ },
25
+ }},
26
+ {:name => "negate parameter 1",
27
+ :input => [
28
+ {:values=>["OUTPUT"], :switch=>"A"},
29
+ {:negate=>true, :values=>["eth0"], :switch=>"o"}],
30
+ :output => {
31
+ :chain => "OUTPUT",
32
+ :parameters => {
33
+ "!o" => ["eth0"],
34
+ },
35
+ :matches => [],
36
+ :target => nil,
37
+ :target_options => {},
38
+ }},
39
+ {:name => "match with options 1",
40
+ :input => [
41
+ {:values=>["INPUT"], :switch=>"A"},
42
+ {:values=>["1.1.1.1/32"], :switch=>"s"},
43
+ {:values=>["tcp"], :switch=>"p"},
44
+ {:values=>["tcp"], :switch=>"m"},
45
+ {:negate=>true, :values=>["FIN,SYN,RST,ACK", "SYN"], :switch=>"tcp-flags"}],
46
+ :output => {
47
+ :chain => "INPUT",
48
+ :parameters => {
49
+ "s" => ["1.1.1.1/32"],
50
+ "p" => ["tcp"],
51
+ },
52
+ :matches => [
53
+ {:name => "tcp",
54
+ :options => {
55
+ "!tcp-flags" => ["FIN,SYN,RST,ACK", "SYN"],
56
+ }},
57
+ ],
58
+ :target => nil,
59
+ :target_options => {},
60
+ }},
61
+ {:name => "match with options 2",
62
+ :input => [
63
+ {:values=>["INPUT"], :switch=>"A"},
64
+ {:values=>["tcp"], :switch=>"p"},
65
+ {:values=>["comment"], :switch=>"m"},
66
+ {:values=>["000 foo"], :switch=>"comment"},
67
+ {:values=>["ACCEPT"], :switch=>"j"}],
68
+ :output => {
69
+ :chain => "INPUT",
70
+ :parameters => {
71
+ "p" => ["tcp"],
72
+ },
73
+ :target => "ACCEPT",
74
+ :matches => [
75
+ {:name => "comment",
76
+ :options => {
77
+ "comment" => ["000 foo"],
78
+ }},
79
+ ],
80
+ :target => "ACCEPT",
81
+ :target_options => {},
82
+ }},
83
+ {:name => "complex 1",
84
+ :input => [
85
+ {:values=>["INPUT"], :switch=>"A"},
86
+ {:values=>["ah"], :switch=>"p"},
87
+ {:values=>["ah"], :switch=>"m"},
88
+ {:negate=>true, :values=>["1"], :switch=>"ahspi"},
89
+ {:values=>["connmark"], :switch=>"m"},
90
+ {:values=>["0x3/0x1"], :switch=>"mark"},
91
+ {:values=>["ah"], :switch=>"m"},
92
+ {:values=>["3"], :switch=>"ahspi"},
93
+ {:values=>["connmark"], :switch=>"m"},
94
+ {:negate=>true, :values=>["0x18/0x1"], :switch=>"mark"}],
95
+ :output => {
96
+ :chain => "INPUT",
97
+ :parameters => {
98
+ "p" => ["ah"],
99
+ },
100
+ :matches => [
101
+ {:name => "ah",
102
+ :options => {
103
+ "!ahspi" => ["1"],
104
+ }},
105
+ {:name => "connmark",
106
+ :options => {
107
+ "mark" => ["0x3/0x1"],
108
+ }},
109
+ {:name => "ah",
110
+ :options => {
111
+ "ahspi" => ["3"],
112
+ }},
113
+ {:name => "connmark",
114
+ :options => {
115
+ "!mark" => ["0x18/0x1"],
116
+ }},
117
+ ],
118
+ :target => nil,
119
+ :target_options => {},
120
+ }},
121
+ {:name => "complex 2",
122
+ :input => [
123
+ {:values=>["INPUT"], :switch=>"A"},
124
+ {:values=>["1.1.1.1/32"], :switch=>"s"},
125
+ {:values=>["connbytes"], :switch=>"m"},
126
+ {:negate=>true, :values=>["10:1000"], :switch=>"connbytes"},
127
+ {:values=>["packets"], :switch=>"connbytes-mode"},
128
+ {:values=>["both"], :switch=>"connbytes-dir"}],
129
+ :output => {
130
+ :chain => "INPUT",
131
+ :parameters => {
132
+ "s" => ["1.1.1.1/32"],
133
+ },
134
+ :matches => [
135
+ {:name => "connbytes",
136
+ :options => {
137
+ "!connbytes" => ["10:1000"],
138
+ "connbytes-mode" => ["packets"],
139
+ "connbytes-dir" => ["both"],
140
+ }},
141
+ ],
142
+ :target => nil,
143
+ :target_options => {},
144
+ }},
145
+ ]
146
+ tests.each do |t|
147
+ it "run sample test [#{t[:name]}]" do
148
+ subject.rule(t[:input]).should eq t[:output]
149
+ end
150
+ end
151
+ end
data/spec/unit/iptables/decoder/shellsplit_spec.rb ADDED
@@ -0,0 +1,27 @@
1
+ require 'spec_helper'
2
+
3
+ describe 'Iptables::Decoder#shellsplit' do
4
+ subject do
5
+ Iptables::Decoder.new
6
+ end
7
+
8
+ tests = [
9
+ {:name => "basic 1",
10
+ :input => "-A INPUT -s 1.1.1.2/32 -j CHECKSUM --checksum-fill \n",
11
+ :output => ["-A", "INPUT", "-s", "1.1.1.2/32", "-j", "CHECKSUM", "--checksum-fill"]},
12
+ {:name => "with negation",
13
+ :input => "-A INPUT -s 1.1.1.1/32 -p tcp -m tos ! --tos 0x05/0x06 \n",
14
+ :output => ["-A", "INPUT", "-s", "1.1.1.1/32", "-p", "tcp", "-m", "tos", "!", "--tos", "0x05/0x06"]},
15
+ {:name => "with quotes",
16
+ :input => "-A INPUT -p sctp -m string ! --string \"00BBCC\" --algo bm --to 65535 \n",
17
+ :output => ["-A", "INPUT", "-p", "sctp", "-m", "string", "!", "--string", "00BBCC", "--algo", "bm", "--to", "65535"]},
18
+ {:name => "with quotes 2",
19
+ :input => "-A INPUT -p tcp -m comment --comment \"000 foo\" -j ACCEPT \n",
20
+ :output => ["-A", "INPUT", "-p", "tcp", "-m", "comment", "--comment", "000 foo", "-j", "ACCEPT" ]},
21
+ ]
22
+ tests.each do |t|
23
+ it "run sample test [#{t[:name]}]" do
24
+ subject.shellsplit(t[:input]).should eq t[:output]
25
+ end
26
+ end
27
+ end