Skip to content

Commit ee47dcf

Browse files
hleinhlein
committed
tests: config_format: iptables: Add many examples not currently supported
Other firewall-building tools (UFW, firewalld, etc.) craft their line prefix differently, causing the rest of the regex to fail. Also some errors and more exotic message contents. Signed-off-by: Hank Leininger <hlein@korelogic.com>
1 parent cf9c107 commit ee47dcf

File tree

2 files changed

+18
-2
lines changed

2 files changed

+18
-2
lines changed

‎conf/parsers_extra.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,9 @@ parsers:
7070
#/^[0-9A-F]{8}-[0-9A-F]{4}-[5][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
7171

7272
- name: iptables
73-
# Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
74-
# https://regex101.com/r/tzK8mr/1
73+
# Parse IP Tables rules
74+
# N.B. ipv4 only
75+
# https://rubular.com/r/VEqBcImT3lav1K
7576
format: regex
7677
regex: |
7778
(?x)

‎tests/internal/data/config_format/convert/parsers_extra.iptables.test‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,18 @@
1010
[LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK FIN URGP=0
1111
[LAN_LOCAL-default-A]IN=eth1.20 OUT= MAC=fc:ec:da:47:47:e6:14:0a:c5:8c:ae:e6:08:00:45:00:00:54 SRC=10.231.20.52 DST=10.231.20.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=44298 DF PROTO=ICMP TYPE=8 CODE=0 ID=56026 SEQ=47360
1212
[LAN_LOCAL-default-A]IN=eth1 OUT= MAC=fc:ec:da:47:47:e6:74:83:c2:d3:96:c9:08:00 SRC=10.231.1.2 DST=10.231.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=13257 DF PROTO=TCP SPT=8080 DPT=55045 WINDOW=348 RES=0x00 ACK PSH FIN URGP=0
13+
[17043827.627166] filter_IN_public_REJECT: IN=ens18 OUT= MAC=ff:ff:ff:ff:ff:ff:4c:41:42:60:17:f7:08:00 SRC=172.33.9.172 DST=172.54.7.213 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=715 PROTO=UDP SPT=138 DPT=138 LEN=209
14+
[17286083.004815] [UFW ALLOW] IN= OUT=ens18 SRC=172.27.6.134 DST=172.22.3.8 LEN=275 TOS=0x00 PREC=0x00 TTL=255 ID=1957 DF PROTO=UDP SPT=26622 DPT=514 LEN=255
15+
[17286084.151998] [UFW AUDIT] IN=ens18 OUT= MAC=bc:24:11:43:51:f1:90:e2:ba:03:35:f9:08:00 SRC=172.22.3.8 DST=172.27.6.134 LEN=48 TOS=0x00 PREC=0x00 TTL=255 ID=47061 DF PROTO=TCP SPT=43848 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
16+
[17377855.003423] [UFW BLOCK] IN=ens18 OUT= MAC=bc:24:11:43:51:f1:bc:24:11:90:09:82:08:00 SRC=172.15.5.77 DST=172.27.6.134 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=43316 DF PROTO=TCP SPT=43902 DPT=999 WINDOW=64240 RES=0x00 SYN URGP=0
17+
[UFW BLOCK] IN=ens18 OUT= MAC=01:00:5e:00:00:fb:4c:41:42:3c:cf:1c:08:00 SRC=172.79.1.173 DST=226.2.1.222 LEN=73 TOS=0x00 PREC=0x00 TTL=255 ID=37808 DF PROTO=UDP SPT=5353 DPT=5353 LEN=53
18+
[4805310.266869] FW: forward DROP IN=ppp0 OUT=eth1 MAC= SRC=49.208.208.102 DST=31.11.105.81 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=63854 PROTO=TCP SPT=41651 DPT=17828 SEQ=1604673260 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0
19+
FW: output ACCEPT IN= OUT=ppp0 SRC=80.45.189.60 DST=124.223.255.7 LEN=120 TOS=0x00 PREC=0x00 TTL=255 ID=26952 PROTO=UDP SPT=34698 DPT=53 LEN=100 UID=40 GID=40
20+
FW: input ACCEPT IN=eth0 OUT= MAC=b4:2e:99:a3:85:67:c4:ad:34:32:32:df:08:00 SRC=10.6.2.3 DST=10.24.22.19 LEN=576 TOS=0x00 PREC=0xC0 TTL=254 ID=64723 PROTO=ICMP TYPE=3 CODE=4 [SRC=10.24.22.19 DST=203.61.18.149 LEN=2083 TOS=0x00 PREC=0x00 TTL=254 ID=31331 DF PROTO=TCP SPT=18252 DPT=443 WINDOW=502 RES=0x00 ACK PSH URGP=0 ] MTU=1492
21+
FW: forward DROP IN=ppp0 OUT=eth1 MAC= SRC=19.155.185.156 DST=51.56.241.88 LEN=119 TOS=0x00 PREC=0xC0 TTL=53 ID=31027 PROTO=ICMP TYPE=3 CODE=3 [SRC=51.56.241.88 DST=19.155.185.156 LEN=91 TOS=0x00 PREC=0x00 TTL=243 ID=63387 PROTO=UDP SPT=46210 DPT=25172 LEN=71 ]
22+
[4805310.137667] nf_ct_proto_6: packet (index 1) in dir 1 ignored, state SYN_RECV IN=eth1 OUT= MAC=00:ec:ac:ce:b3:63:00:1b:21:54:1c:3d:08:00 SRC=39.76.232.40 DST=246.97.70.56 LEN=48 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=443 DPT=14129 SEQ=158435768 ACK=2043537019 WINDOW=65340 RES=0x00 ACK SYN URGP=0 OPT (020405AC01030307)
23+
nf_ct_proto_6: invalid new IN=eth2 OUT= MAC=00:ec:ac:ce:b3:64:50:e0:85:84:a1:61:08:00 SRC=192.168.9.182 DST=109.250.21.12 LEN=71 TOS=0x00 PREC=0x00 TTL=128 ID=29429 DF PROTO=TCP SPT=61919 DPT=443 SEQ=438203318 ACK=2825421336 WINDOW=510 RES=0x00 ACK PSH FIN URGP=0
24+
[4805337.689552] nf_ct_proto_6: bad checksum IN=ppp0 OUT= MAC= SRC=155.146.130.32 DST=39.76.232.40 LEN=447 TOS=0x00 PREC=0x00 TTL=55 ID=39575 DF PROTO=TCP SPT=36187 DPT=443 SEQ=3240783289 ACK=3631033297 WINDOW=1386 RES=0x00 ACK PSH URGP=0
25+
nf_ct_proto_6: packet (index 1) in dir 1 ignored, state ESTABLISHED IN=eth1 OUT= MAC=00:ec:ac:ce:b3:63:90:b1:1c:3e:e7:a2:08:00 SRC=64.99.143.10 DST=42.162.203.2 LEN=48 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=443 DPT=16426 SEQ=739183654 ACK=166439761 WINDOW=65340 RES=0x00 ACK SYN URGP=0 OPT (020405AC01030307)
26+
[ 1156.246182] calico-drop: IN=tunl0 OUT=cali76be879f658 MAC= SRC=192.168.128.30 DST=192.168.157.26 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=56743 DF PROTO=TCP SPT=56248 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0xa000000
27+
FW: input ACCEPT IN=ib0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:08:00:00:00 SRC=10.2.7.172 DST=10.2.6.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=51724 DF PROTO=TCP SPT=934 DPT=60219 SEQ=1823043416 ACK=0 WINDOW=65480 RES=0x00 SYN URGP=0

0 commit comments

Comments
 (0)