iptables 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. data/.gitignore +3 -0
  2. data/.ruby-version +1 -0
  3. data/.travis.yml +12 -0
  4. data/Gemfile +3 -0
  5. data/README.md +17 -0
  6. data/bin/iptables-decode +18 -0
  7. data/iptables.gemspec +21 -0
  8. data/lib/iptables.rb +327 -0
  9. data/sample_data/complex-iptables-135 +219 -0
  10. data/sample_data/complex-iptables-147 +270 -0
  11. data/spec/spec_helper.rb +2 -0
  12. data/spec/unit/iptables/decoder/basic_spec.rb +7 -0
  13. data/spec/unit/iptables/decoder/rule_spec.rb +151 -0
  14. data/spec/unit/iptables/decoder/shellsplit_spec.rb +27 -0
  15. data/spec/unit/iptables/decoder/switch_hash_spec.rb +131 -0
  16. metadata +112 -0
data/sample_data/complex-iptables-147 ADDED
@@ -0,0 +1,270 @@
1
+ # Generated by iptables-save v1.4.7 on Sun Feb 24 00:48:11 2013
2
+ *mangle
3
+ :PREROUTING ACCEPT [756:54757]
4
+ :INPUT ACCEPT [756:54757]
5
+ :FORWARD ACCEPT [0:0]
6
+ :OUTPUT ACCEPT [578:527896]
7
+ :POSTROUTING ACCEPT [578:527896]
8
+ -A INPUT -s 1.1.1.2/32 -j CHECKSUM --checksum-fill
9
+ -A OUTPUT -s 1.1.1.2/32 -j CLASSIFY --set-class 0004:0056
10
+ COMMIT
11
+ # Completed on Sun Feb 24 00:48:11 2013
12
+ # Generated by iptables-save v1.4.7 on Sun Feb 24 00:48:11 2013
13
+ *filter
14
+ :INPUT ACCEPT [0:0]
15
+ :FORWARD ACCEPT [0:0]
16
+ :OUTPUT ACCEPT [1096:944096]
17
+ :foo - [0:0]
18
+ -A INPUT -p tcp -m comment --comment "000 foo" -j ACCEPT
19
+ -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
20
+ -A INPUT -p icmp -j ACCEPT
21
+ -A INPUT -i lo -j ACCEPT
22
+ -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
23
+ -A INPUT -j REJECT --reject-with icmp-host-prohibited
24
+ -A INPUT -p tcp
25
+ -A INPUT -s 1.1.1.1/32
26
+ -A INPUT -s 1.1.1.0/24
27
+ -A INPUT -d 1.1.1.0/24
28
+ -A INPUT -d 1.1.0.0/16
29
+ -A INPUT ! -p tcp
30
+ -A INPUT ! -s 1.1.1.0/24
31
+ -A INPUT ! -s 1.1.1.1/32
32
+ -A INPUT ! -d 1.1.0.0/16
33
+ -A INPUT -s 1.1.1.0/24
34
+ -A INPUT -s 1.1.2.1/24
35
+ -A INPUT -j ACCEPT
36
+ -A INPUT -s 1.1.1.1/32 -g foo
37
+ -A INPUT -i eth0
38
+ -A INPUT ! -i eth0
39
+ -A INPUT -i eth0:0
40
+ -A INPUT ! -i eth0:0
41
+ -A INPUT -m addrtype --src-type UNSPEC
42
+ -A INPUT -m addrtype --src-type LOCAL
43
+ -A INPUT -m addrtype ! --src-type LOCAL
44
+ -A INPUT -m addrtype --dst-type UNSPEC
45
+ -A INPUT -m addrtype --dst-type LOCAL
46
+ -A INPUT -m addrtype ! --dst-type LOCAL
47
+ -A INPUT -m addrtype ! --dst-type UNSPEC
48
+ -A INPUT -m addrtype --src-type UNSPEC --limit-iface-in
49
+ -A INPUT -m addrtype ! --src-type UNSPEC --limit-iface-in
50
+ -A INPUT -m addrtype ! --src-type UNSPEC --limit-iface-out
51
+ -A INPUT -m addrtype --src-type UNSPEC --limit-iface-out
52
+ -A INPUT -p ah -m ah --ahspi 1
53
+ -A INPUT -p ah -m ah --ahspi 1
54
+ -A INPUT -p ah -m ah ! --ahspi 1
55
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
56
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
57
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
58
+ -A INPUT -s 1.1.1.1/32 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 1 --cluster-hash-seed 0x00000001
59
+ -A INPUT -s 1.1.1.1/32 -m comment --comment "foobar baz fooo foo baz"
60
+ -A INPUT -s 1.1.1.1/32 -m connbytes --connbytes 10:1000 --connbytes-mode packets --connbytes-dir both
61
+ -A INPUT -s 1.1.1.1/32 -m connbytes ! --connbytes 10:1000 --connbytes-mode packets --connbytes-dir both
62
+ -A INPUT -s 1.1.1.1/32 -m connlimit --connlimit-above 1 --connlimit-mask 32
63
+ -A INPUT -s 1.1.1.1/32 -m connlimit ! --connlimit-above 1 --connlimit-mask 32
64
+ -A INPUT -s 1.1.1.1/32 -m connlimit --connlimit-above 1 --connlimit-mask 24
65
+ -A INPUT -s 1.1.1.1/32 -m connlimit ! --connlimit-above 1 --connlimit-mask 24
66
+ -A INPUT -s 1.1.1.1/32 -m connmark --mark 0x18/0x1
67
+ -A INPUT -s 1.1.1.1/32 -m connmark ! --mark 0x18/0x1
68
+ -A INPUT -s 1.1.1.1/32 -m connmark ! --mark 0x18/0x1 -m connmark --mark 0x3/0x1
69
+ -A INPUT -p ah -m ah ! --ahspi 1 -m ah --ahspi 3
70
+ -A INPUT -p ah -m ah ! --ahspi 1 -m connmark --mark 0x3/0x1 -m ah --ahspi 3
71
+ -A INPUT -p ah -m ah ! --ahspi 1 -m connmark --mark 0x3/0x1 -m ah --ahspi 3 -m connmark ! --mark 0x18/0x1
72
+ -A INPUT -p ah -m ah ! --ahspi 1 -m ah ! --ahspi 1
73
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctstate NEW
74
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctstate NEW
75
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctproto 3
76
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctproto 3
77
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigsrc 1.1.1.0
78
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigsrc 1.1.1.0
79
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigdst 1.1.1.0
80
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigdst 1.1.1.0
81
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctreplsrc 1.1.1.0
82
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctreplsrc 1.1.1.0
83
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctrepldst 1.1.1.0
84
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctrepldst 1.1.1.0
85
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigsrcport 2
86
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigsrcport 2
87
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigdstport 2
88
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigdstport 2
89
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctorigsrcport 2
90
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctorigsrcport 3
91
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctreplsrcport 3
92
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctreplsrcport 3
93
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctstatus NONE
94
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctstatus NONE
95
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctexpire 12
96
+ -A INPUT -s 1.1.1.1/32 -m conntrack ! --ctexpire 12
97
+ -A INPUT -s 1.1.1.1/32 -m conntrack --ctdir ORIGINAL
98
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --sport 3
99
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp ! --sport 3
100
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dport 3
101
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp ! --dport 3
102
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-type REQUEST,DATA
103
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-type ! REQUEST,DATA
104
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-option 1
105
+ -A INPUT -s 1.1.1.1/32 -p dccp -m dccp --dccp-option 1
106
+ -A INPUT -s 1.1.1.1/32 -m dscp --dscp 0x01
107
+ -A INPUT -s 1.1.1.1/32 -m dscp ! --dscp 0x01
108
+ -A INPUT -s 1.1.1.1/32 -m dscp --dscp 0x00
109
+ -A INPUT -s 1.1.1.1/32 -m dscp ! --dscp 0x00
110
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn --ecn-tcp-cwr
111
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn --ecn-tcp-ece
112
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn ! --ecn-tcp-cwr
113
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn ! --ecn-tcp-ece
114
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn --ecn-ip-ect 3
115
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ecn ! --ecn-ip-ect 3
116
+ -A INPUT -s 1.1.1.1/32 -p esp -m esp --espspi 1
117
+ -A INPUT -s 1.1.1.1/32 -p esp -m esp --espspi 1:24
118
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-upto 1/sec --hashlimit-name foo
119
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-upto 1/sec --hashlimit-name foo
120
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-upto 1/min --hashlimit-name foo
121
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo
122
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo
123
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-mode srcip --hashlimit-name foo
124
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-srcmask 24
125
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-dstmask 24
126
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-htable-size 3
127
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo
128
+ -A INPUT -s 1.1.1.1/32 -m hashlimit --hashlimit-above 4/sec --hashlimit-name foo --hashlimit-htable-gcinterval 10000
129
+ -A INPUT -s 1.1.1.1/32 -m helper --helper "foo"
130
+ -A INPUT -s 1.1.1.1/32 -m helper ! --helper "foo"
131
+ -A INPUT -s 1.1.1.1/32 -p icmp -m icmp --icmp-type 12/0
132
+ -A INPUT -s 1.1.1.1/32 -p icmp -m icmp ! --icmp-type 12/0
133
+ -A INPUT -m iprange ! --src-range 1.1.1.1-2.2.2.2
134
+ -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2
135
+ -A INPUT -m iprange --dst-range 1.1.1.1-2.2.2.2
136
+ -A INPUT -m iprange ! --dst-range 1.1.1.1-2.2.2.2
137
+ -A INPUT -m length --length 1:20
138
+ -A INPUT -m length ! --length 1:20
139
+ -A INPUT -m limit --limit 3/sec
140
+ -A INPUT -m limit --limit 3/hour --limit-burst 4
141
+ -A INPUT -m mac --mac-source AA:AA:AA:AA:AA:AA
142
+ -A INPUT -m mac ! --mac-source AA:AA:AA:AA:AA:AA
143
+ -A INPUT -m mark --mark 0x4/0x5
144
+ -A INPUT -m mark ! --mark 0x4/0x5
145
+ -A INPUT -p dccp -m multiport --sports 1,2,3,4,5:6
146
+ -A INPUT -p dccp -m multiport ! --sports 1,2,3,4,5:6
147
+ -A INPUT -p dccp -m multiport --dports 3,4,5,6
148
+ -A INPUT -p dccp -m multiport ! --dports 3,4,5,6
149
+ -A INPUT -p dccp -m multiport ! --ports 3,4,5,6
150
+ -A INPUT -p dccp -m multiport --ports 3,4,5,6
151
+ -A INPUT -p dccp -m owner --uid-owner root
152
+ -A INPUT -p dccp -m owner ! --uid-owner root
153
+ -A INPUT -p dccp -m owner --uid-owner 5000-6000
154
+ -A INPUT -p dccp -m owner ! --uid-owner 5000-6000
155
+ -A INPUT -p dccp -m owner --gid-owner wheel
156
+ -A INPUT -p dccp -m owner ! --gid-owner wheel
157
+ -A INPUT -p dccp -m owner --socket-exists
158
+ -A INPUT -p dccp -m owner ! --socket-exists
159
+ -A INPUT -p dccp -m physdev --physdev-in eth0
160
+ -A INPUT -p dccp -m physdev --physdev-in eth0:0
161
+ -A INPUT -p dccp -m physdev ! --physdev-in eth0:0
162
+ -A INPUT -p dccp -m physdev --physdev-out eth0:0
163
+ -A INPUT -p dccp -m physdev ! --physdev-out eth0:0
164
+ -A INPUT -p dccp -m physdev --physdev-is-in
165
+ -A INPUT -p dccp -m physdev ! --physdev-is-in
166
+ -A INPUT -p dccp -m physdev --physdev-is-out
167
+ -A INPUT -p dccp -m physdev ! --physdev-is-out
168
+ -A INPUT -p dccp -m physdev --physdev-is-bridged
169
+ -A INPUT -p dccp -m physdev ! --physdev-is-bridged
170
+ -A INPUT -p dccp -m pkttype --pkt-type unicast
171
+ -A INPUT -p dccp -m pkttype ! --pkt-type unicast
172
+ -A INPUT -p dccp -m policy --dir in --pol ipsec
173
+ -A INPUT -p dccp -m policy --dir out --pol ipsec
174
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --strict --reqid 3
175
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --reqid 3
176
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --reqid 3
177
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --spi 0x3
178
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --spi 0x3
179
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --proto ah
180
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --proto ah
181
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel
182
+ -A INPUT -p dccp -m policy --dir out --pol ipsec ! --mode tunnel
183
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel --tunnel-src 1.1.1.0/24
184
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel ! --tunnel-src 1.1.1.0/24
185
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel --tunnel-dst 1.1.1.0/24
186
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --mode tunnel ! --tunnel-dst 1.1.1.0/24
187
+ -A INPUT -p dccp -m policy --dir out --pol ipsec --strict --mode tunnel
188
+ -A INPUT -p dccp -m quota --quota 0
189
+ -A INPUT -p dccp -m quota --quota 56
190
+ -A INPUT -p dccp -m realm --realm 0x22/0x18
191
+ -A INPUT -p dccp -m realm ! --realm 0x22/0x18
192
+ -A INPUT -p dccp -m recent --set --name foo --rsource
193
+ -A INPUT -p dccp -m recent ! --set --name foo --rsource
194
+ -A INPUT -p dccp -m recent --set --name DEFAULT --rsource
195
+ -A INPUT -p dccp -m recent --set --name DEFAULT --rdest
196
+ -A INPUT -p dccp -m recent --rcheck --name DEFAULT --rsource
197
+ -A INPUT -p dccp -m recent ! --rcheck --name DEFAULT --rsource
198
+ -A INPUT -p dccp -m recent --update --name DEFAULT --rsource
199
+ -A INPUT -p dccp -m recent ! --update --name DEFAULT --rsource
200
+ -A INPUT -s 1.1.1.1/32 -p icmp -m recent --remove --name DEFAULT --rsource
201
+ -A INPUT -s 1.1.1.1/32 -p icmp -m recent --update --rttl --name DEFAULT --rsource
202
+ -A INPUT -p sctp -m sctp --sport 1
203
+ -A INPUT -p sctp -m sctp --sport 1:3
204
+ -A INPUT -p sctp -m sctp ! --sport 1:3
205
+ -A INPUT -p sctp -m sctp ! --sport 1:3
206
+ -A INPUT -p sctp -m sctp --dport 3
207
+ -A INPUT -p sctp -m sctp ! --dport 3
208
+ -A INPUT -p sctp -m sctp --chunk-types all DATA
209
+ -A INPUT -p sctp -m sctp --chunk-types all DATA:U
210
+ -A INPUT -p sctp -m sctp ! --chunk-types all DATA:U
211
+ -A INPUT -p sctp -m set --match-set foo src
212
+ -A INPUT -p sctp -m set ! --match-set foo src,dst
213
+ -A INPUT -p sctp -m socket
214
+ -A INPUT -p sctp -m socket --transparent
215
+ -A INPUT -p sctp -m state --state INVALID
216
+ -A INPUT -p sctp -m state --state NEW,RELATED,ESTABLISHED,UNTRACKED
217
+ -A INPUT -p sctp -m statistic --mode nth --every 1
218
+ -A INPUT -p sctp -m statistic --mode random --probability 0.000000
219
+ -A INPUT -p sctp -m statistic --mode random --probability 1.000000
220
+ -A INPUT -p sctp -m statistic --mode nth --every 4
221
+ -A INPUT -p sctp -m statistic --mode nth --every 4 --packet 2
222
+ -A INPUT -p sctp -m string --string "foo" --algo bm --to 65535
223
+ -A INPUT -p sctp -m string --string "foo" --algo bm --from 5 --to 65535
224
+ -A INPUT -p sctp -m string --string "foo" --algo bm --to 5
225
+ -A INPUT -p sctp -m string ! --string "foo" --algo bm --to 65535
226
+ -A INPUT -p sctp -m string --string "00BBCC" --algo bm --to 65535
227
+ -A INPUT -p sctp -m string ! --string "00BBCC" --algo bm --to 65535
228
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --sport 5
229
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --sport 5:66
230
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --sport 5
231
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --dport 1
232
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --dport 1:45
233
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --tcp-flags SYN,ACK SYN
234
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --tcp-flags SYN,ACK SYN
235
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --dport 1:45
236
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN
237
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN
238
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp --tcp-option 4
239
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tcp ! --tcp-option 4
240
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestart 1979-12-31T23:00:00 --datestop 2038-01-19T03:14:07
241
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestop 1980-01-01T00:00:00
242
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --timestart 12:34:11 --timestop 23:59:59 --datestop 2038-01-19T03:14:07
243
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --timestart 00:00:00 --timestop 12:23:00 --datestop 2038-01-19T03:14:07
244
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --timestart 00:00:00 --timestop 12:23:11 --datestop 2038-01-19T03:14:07
245
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --monthdays 4 --datestop 2038-01-19T03:14:07
246
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --monthdays 1,2,3,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 --datestop 2038-01-19T03:14:07
247
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --weekdays Fri --datestop 2038-01-19T03:14:07
248
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --weekdays Fri,Sun --datestop 2038-01-19T03:14:07
249
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --weekdays Mon,Tue,Wed,Thu,Sat --datestop 2038-01-19T03:14:07
250
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestop 2038-01-19T03:14:07 --utc
251
+ -A INPUT -s 1.1.1.1/32 -p tcp -m time --datestop 2038-01-19T03:14:07
252
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos --tos 0x05/0xff
253
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos --tos 0x05/0x06
254
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos ! --tos 0x05/0x06
255
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos --tos 0x04/0xff
256
+ -A INPUT -s 1.1.1.1/32 -p tcp -m tos ! --tos 0x04/0xff
257
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ttl --ttl-eq 5
258
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ttl --ttl-gt 6
259
+ -A INPUT -s 1.1.1.1/32 -p tcp -m ttl --ttl-lt 6
260
+ -A INPUT -s 1.1.1.1/32 -p tcp -m u32 --u32 0x0&0xffff=0x100:0xffff
261
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp --sport 55
262
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp ! --sport 55
263
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp --dport 66:67
264
+ -A INPUT -s 1.1.1.1/32 -p udp -m udp ! --dport 66:67
265
+ -A FORWARD -j REJECT --reject-with icmp-host-prohibited
266
+ -A OUTPUT -o eth0
267
+ -A OUTPUT ! -o eth0
268
+ -A OUTPUT ! -o eth0:0
269
+ COMMIT
270
+ # Completed on Sun Feb 24 00:48:11 2013
data/spec/spec_helper.rb ADDED
@@ -0,0 +1,2 @@
1
+ require 'bundler/setup'
2
+ Bundler.require :default
data/spec/unit/iptables/decoder/basic_spec.rb ADDED
@@ -0,0 +1,7 @@
1
+ require 'spec_helper'
2
+
3
+ describe Iptables::Decoder do
4
+ it 'should allow instantiation' do
5
+ Iptables::Decoder.new
6
+ end
7
+ end
data/spec/unit/iptables/decoder/rule_spec.rb ADDED
@@ -0,0 +1,151 @@
1
+ require 'spec_helper'
2
+
3
+ describe 'Iptables::Decoder#rule_hash' do
4
+ subject do
5
+ Iptables::Decoder.new
6
+ end
7
+
8
+ tests = [
9
+ {:name => "basic destination option 1",
10
+ :input => [
11
+ {:values=>["OUTPUT"], :switch=>"A"},
12
+ {:values=>["1.1.1.2/32"], :switch=>"s"},
13
+ {:values=>["CLASSIFY"], :switch=>"j"},
14
+ {:values=>["0004:0056"], :switch=>"set-class"}],
15
+ :output => {
16
+ :chain => "OUTPUT",
17
+ :parameters => {
18
+ "s" => ["1.1.1.2/32"],
19
+ },
20
+ :matches => [],
21
+ :target => "CLASSIFY",
22
+ :target_options => {
23
+ "set-class" => ["0004:0056"],
24
+ },
25
+ }},
26
+ {:name => "negate parameter 1",
27
+ :input => [
28
+ {:values=>["OUTPUT"], :switch=>"A"},
29
+ {:negate=>true, :values=>["eth0"], :switch=>"o"}],
30
+ :output => {
31
+ :chain => "OUTPUT",
32
+ :parameters => {
33
+ "!o" => ["eth0"],
34
+ },
35
+ :matches => [],
36
+ :target => nil,
37
+ :target_options => {},
38
+ }},
39
+ {:name => "match with options 1",
40
+ :input => [
41
+ {:values=>["INPUT"], :switch=>"A"},
42
+ {:values=>["1.1.1.1/32"], :switch=>"s"},
43
+ {:values=>["tcp"], :switch=>"p"},
44
+ {:values=>["tcp"], :switch=>"m"},
45
+ {:negate=>true, :values=>["FIN,SYN,RST,ACK", "SYN"], :switch=>"tcp-flags"}],
46
+ :output => {
47
+ :chain => "INPUT",
48
+ :parameters => {
49
+ "s" => ["1.1.1.1/32"],
50
+ "p" => ["tcp"],
51
+ },
52
+ :matches => [
53
+ {:name => "tcp",
54
+ :options => {
55
+ "!tcp-flags" => ["FIN,SYN,RST,ACK", "SYN"],
56
+ }},
57
+ ],
58
+ :target => nil,
59
+ :target_options => {},
60
+ }},
61
+ {:name => "match with options 2",
62
+ :input => [
63
+ {:values=>["INPUT"], :switch=>"A"},
64
+ {:values=>["tcp"], :switch=>"p"},
65
+ {:values=>["comment"], :switch=>"m"},
66
+ {:values=>["000 foo"], :switch=>"comment"},
67
+ {:values=>["ACCEPT"], :switch=>"j"}],
68
+ :output => {
69
+ :chain => "INPUT",
70
+ :parameters => {
71
+ "p" => ["tcp"],
72
+ },
73
+ :target => "ACCEPT",
74
+ :matches => [
75
+ {:name => "comment",
76
+ :options => {
77
+ "comment" => ["000 foo"],
78
+ }},
79
+ ],
80
+ :target => "ACCEPT",
81
+ :target_options => {},
82
+ }},
83
+ {:name => "complex 1",
84
+ :input => [
85
+ {:values=>["INPUT"], :switch=>"A"},
86
+ {:values=>["ah"], :switch=>"p"},
87
+ {:values=>["ah"], :switch=>"m"},
88
+ {:negate=>true, :values=>["1"], :switch=>"ahspi"},
89
+ {:values=>["connmark"], :switch=>"m"},
90
+ {:values=>["0x3/0x1"], :switch=>"mark"},
91
+ {:values=>["ah"], :switch=>"m"},
92
+ {:values=>["3"], :switch=>"ahspi"},
93
+ {:values=>["connmark"], :switch=>"m"},
94
+ {:negate=>true, :values=>["0x18/0x1"], :switch=>"mark"}],
95
+ :output => {
96
+ :chain => "INPUT",
97
+ :parameters => {
98
+ "p" => ["ah"],
99
+ },
100
+ :matches => [
101
+ {:name => "ah",
102
+ :options => {
103
+ "!ahspi" => ["1"],
104
+ }},
105
+ {:name => "connmark",
106
+ :options => {
107
+ "mark" => ["0x3/0x1"],
108
+ }},
109
+ {:name => "ah",
110
+ :options => {
111
+ "ahspi" => ["3"],
112
+ }},
113
+ {:name => "connmark",
114
+ :options => {
115
+ "!mark" => ["0x18/0x1"],
116
+ }},
117
+ ],
118
+ :target => nil,
119
+ :target_options => {},
120
+ }},
121
+ {:name => "complex 2",
122
+ :input => [
123
+ {:values=>["INPUT"], :switch=>"A"},
124
+ {:values=>["1.1.1.1/32"], :switch=>"s"},
125
+ {:values=>["connbytes"], :switch=>"m"},
126
+ {:negate=>true, :values=>["10:1000"], :switch=>"connbytes"},
127
+ {:values=>["packets"], :switch=>"connbytes-mode"},
128
+ {:values=>["both"], :switch=>"connbytes-dir"}],
129
+ :output => {
130
+ :chain => "INPUT",
131
+ :parameters => {
132
+ "s" => ["1.1.1.1/32"],
133
+ },
134
+ :matches => [
135
+ {:name => "connbytes",
136
+ :options => {
137
+ "!connbytes" => ["10:1000"],
138
+ "connbytes-mode" => ["packets"],
139
+ "connbytes-dir" => ["both"],
140
+ }},
141
+ ],
142
+ :target => nil,
143
+ :target_options => {},
144
+ }},
145
+ ]
146
+ tests.each do |t|
147
+ it "run sample test [#{t[:name]}]" do
148
+ subject.rule(t[:input]).should eq t[:output]
149
+ end
150
+ end
151
+ end
data/spec/unit/iptables/decoder/shellsplit_spec.rb ADDED
@@ -0,0 +1,27 @@
1
+ require 'spec_helper'
2
+
3
+ describe 'Iptables::Decoder#shellsplit' do
4
+ subject do
5
+ Iptables::Decoder.new
6
+ end
7
+
8
+ tests = [
9
+ {:name => "basic 1",
10
+ :input => "-A INPUT -s 1.1.1.2/32 -j CHECKSUM --checksum-fill \n",
11
+ :output => ["-A", "INPUT", "-s", "1.1.1.2/32", "-j", "CHECKSUM", "--checksum-fill"]},
12
+ {:name => "with negation",
13
+ :input => "-A INPUT -s 1.1.1.1/32 -p tcp -m tos ! --tos 0x05/0x06 \n",
14
+ :output => ["-A", "INPUT", "-s", "1.1.1.1/32", "-p", "tcp", "-m", "tos", "!", "--tos", "0x05/0x06"]},
15
+ {:name => "with quotes",
16
+ :input => "-A INPUT -p sctp -m string ! --string \"00BBCC\" --algo bm --to 65535 \n",
17
+ :output => ["-A", "INPUT", "-p", "sctp", "-m", "string", "!", "--string", "00BBCC", "--algo", "bm", "--to", "65535"]},
18
+ {:name => "with quotes 2",
19
+ :input => "-A INPUT -p tcp -m comment --comment \"000 foo\" -j ACCEPT \n",
20
+ :output => ["-A", "INPUT", "-p", "tcp", "-m", "comment", "--comment", "000 foo", "-j", "ACCEPT" ]},
21
+ ]
22
+ tests.each do |t|
23
+ it "run sample test [#{t[:name]}]" do
24
+ subject.shellsplit(t[:input]).should eq t[:output]
25
+ end
26
+ end
27
+ end