Provided by: libiptables-parse-perl_1.6-1_all 
NAME
IPTables::Parse - Perl extension for parsing iptables and ip6tables policies
SYNOPSIS
use IPTables::Parse;
my %opts = (
'use_ipv6' => 0, # can set to 1 to force ip6tables usage
'ipt_rules_file' => '', # optional file path from
# which to read iptables rules
'debug' => 0,
'verbose' => 0
);
my $ipt_obj = IPTables::Parse->new(%opts)
or die "[*] Could not acquire IPTables::Parse object";
my $rv = 0;
### look for default DROP rules in the filter table INPUT chain
my ($ipt_hr, $rv) = $ipt_obj->default_drop('filter', 'INPUT');
if ($rv) {
if (defined $ipt_hr->{'all'}) {
print "The INPUT chain has a default DROP rule for all protocols.\n";
} else {
my $found = 0;
for my $proto (qw/tcp udp icmp/) {
if (defined $ipt_hr->{$proto}) {
print "The INPUT chain drops $proto by default.\n";
$found = 1;
}
}
unless ($found) {
print "The INPUT chain does not have any default DROP rule.\n";
}
}
} else {
print "[-] Could not parse $ipt_obj->{'_ipt_bin_name'} policy\n";
}
### look for default LOG rules in the filter table INPUT chain
($ipt_hr, $rv) = $ipt_obj->default_log('filter', 'INPUT');
if ($rv) {
if (defined $ipt_hr->{'all'}) {
print "The INPUT chain has a default LOG rule for all protocols.\n";
} else {
my $found = 0;
for my $proto (qw/tcp udp icmp/) {
if (defined $ipt_hr->{$proto}) {
print "The INPUT chain logs $proto by default.\n";
$found = 1;
}
}
unless ($found) {
print "The INPUT chain does not have any default LOG rule.\n";
}
}
} else {
print "[-] Could not parse $ipt_obj->{'_ipt_bin_name'} policy\n";
}
### print all chains in the filter table
for my $chain (@{$ipt_obj->list_table_chains('filter')}) {
print $chain, "\n";
}
DESCRIPTION
The "IPTables::Parse" package provides an interface to parse iptables or ip6tables rules
on Linux systems through the direct execution of iptables/ip6tables commands, or from
parsing a file that contains an iptables/ip6tables policy listing. Note that the
'firewalld' infrastructure on Fedora21 is also supported through execution of the
'firewall-cmd' binary. By default, the path to iptables is assumed to be
'/sbin/iptables', but if the firewall is 'firewalld', then the '/usr/bin/firewall-cmd' is
used.
With this module, you can get the current policy applied to a table/chain, look for a
specific user-defined chain, check for a default DROP policy, or determine whether or not
a default LOG rule exists. Also, you can get a listing of all rules in a chain with each
rule parsed into its own hash.
Note that if you initialize the IPTables::Parse object with the 'ipt_rules_file' key, then
all parsing routines will open the specified file for iptables rules data. So, you can
create this file with a command like 'iptables -t filter -nL -v > ipt.rules', and then
initialize the object with IPTables::Parse->new('ipt_rules_file' => 'ipt.rules'). Further,
if you are running on a system without iptables installed, but you have an iptables policy
written to the ipt.rules file, then you can pass in 'skip_ipt_exec_check=>1' in order to
analyze the file without having IPTables::Parse check for the iptables binary.
In summary, in addition to the hash keys mentioned above, optional keys that can be passed
to new() include 'iptables' (set path to iptables binary), 'firewall_cmd' (set path to
'firewall-cmd' binary for systems with 'firewalld'), 'fwd_args' (set 'firewall-cmd' usage
args; defaults to '--direct --passthrough ipv4'), 'ipv6' (set IPv6 mode for ip6tables),
'debug', 'verbose', and 'lockless_ipt_exec' (disable usage of the iptables '-w' argument
that acquires an exclusive lock on command execution).
FUNCTIONS
The IPTables::Parse extension provides an object interface to the following functions:
chain_policy($table, $chain)
This function returns the policy (e.g. 'DROP', 'ACCEPT', etc.) for the specified table
and chain:
print "INPUT policy: ",
$ipt_obj->chain_policy('filter', 'INPUT'), "\n";
chain_rules($table, $chain)
This function parses the specified chain and table and returns an array reference for
all rules in the chain. Each element in the array reference is a hash with the
following keys (that contain values depending on the rule): "src", "dst", "protocol",
"s_port", "d_port", "target", "packets", "bytes", "intf_in", "intf_out", "to_ip",
"to_port", "state", "raw", and "extended". The "extended" element contains the rule
output past the protocol information, and the "raw" element contains the complete rule
itself as reported by iptables or ip6tables. Here is an example of checking whether
the second rule in the INPUT chain (array index 1) allows traffic from any IP to TCP
port 80:
$rules_ar = $ipt_obj->chain_rules('filter', 'INPUT);
if ($rules_ar->[1]->{'src'} eq '0.0.0.0/0'
and $rules_ar->[1]->{'protocol'} eq 'tcp'
and $rules_ar->[1]->{'d_port'} eq '80'
and $rules_ar->[1]->{'target'} eq 'ACCEPT') {
print "traffic accepted to TCP port 80 from anywhere\n";
}
default_drop($table, $chain)
This function parses the running iptables or ip6tables policy in order to determine if
the specified chain contains a default DROP rule. Two values are returned, a hash
reference whose keys are the protocols that are dropped by default (if a global ACCEPT
rule has not accepted matching packets first), along with a return value that tells
the caller if parsing the iptables or ip6tables policy was successful. Note that if
all protocols are dropped by default, then the hash key 'all' will be defined.
($ipt_hr, $rv) = $ipt_obj->default_drop('filter', 'INPUT');
default_log($table, $chain)
This function parses the running iptables or ip6tables policy in order to determine if
the specified chain contains a default LOG rule. Two values are returned, a hash
reference whose keys are the protocols that are logged by default (if a global ACCEPT
rule has not accepted matching packets first), along with a return value that tells
the caller if parsing the iptables or ip6tables policy was successful. Note that if
all protocols are logged by default, then the hash key 'all' will be defined. An
example invocation is:
($ipt_hr, $rv) = $ipt_obj->default_log('filter', 'INPUT');
list_table_chains($table)
This function parses the specified table for all chains that are defined within the
table. Data is returned as an array reference. For example, if there are no user-
defined chains in the 'filter' table, then the returned array reference will contain
the strings 'INPUT', 'FORWARD', and 'OUTPUT'.
for my $chain (@{$ipt_obj->list_table_chains('filter')}) {
print $chain, "\n";
}
AUTHOR
Michael Rash, <mbr@cipherdyne.org>
SEE ALSO
The IPTables::Parse module is used by the IPTables::ChainMgr extension in support of the
psad and fwsnort projects to parse iptables or ip6tables policies (see the psad(8), and
fwsnort(8) man pages). As always, the iptables(8) and ip6tables(8) man pages provide the
best information on command line execution and theory behind iptables and ip6tables.
Although there is no mailing that is devoted specifically to the IPTables::Parse
extension, questions about the extension will be answered on the following lists:
The psad mailing list: http://lists.sourceforge.net/lists/listinfo/psad-discuss
The fwsnort mailing list: http://lists.sourceforge.net/lists/listinfo/fwsnort-discuss
The latest version of the IPTables::Parse extension can be found on CPAN and also here:
http://www.cipherdyne.org/modules/
Source control is provided by git:
https://github.com/mrash/IPTables-Parse.git
CREDITS
Thanks to the following people:
Franck Joncourt <franck.mail@dthconnex.com>
Stuart Schneider
Grant Ferley
Fabien Mazieres
Miloslav TrmaX
AUTHOR
The IPTables::Parse extension was written by Michael Rash <mbr@cipherdyne.org> to support
the psad and fwsnort projects. Please send email to this address if there are any
questions, comments, or bug reports.
VERSION
Version 1.6 (November, 2015)
COPYRIGHT AND LICENSE
Copyright (C) 2005-2015 Michael Rash. All rights reserved.
This module is free software. You can redistribute it and/or modify it under the terms of
the Artistic License 2.0. More information can be found here:
http://www.perl.com/perl/misc/Artistic.html
This program is distributed "as is" in the hope that it will be useful, but without any
warranty; without even the implied warranty of merchantability or fitness for a particular
purpose.