IPTables::Parse(3pm)					User Contributed Perl Documentation				      IPTables::Parse(3pm)

NAME

       IPTables::Parse - Perl extension for parsing iptables and ip6tables policies

SYNOPSIS

	 use IPTables::Parse;

	 my $ipt_bin = '/sbin/iptables'; # can set this to /sbin/ip6tables

	 my %opts = (
	     'iptables' => $ipt_bin,
	     'iptout'	=> '/tmp/iptables.out',
	     'ipterr'	=> '/tmp/iptables.err',
	     'debug'	=> 0,
	     'verbose'	=> 0
	 );

	 my $ipt_obj = new IPTables::Parse(%opts)
	     or die "[*] Could not acquire IPTables::Parse object";

	 my $rv = 0;

	 my $table = 'filter';
	 my $chain = 'INPUT';

	 my ($ipt_hr, $rv) = $ipt_obj->default_drop($table, $chain);
	 if ($rv) {
	     if (defined $ipt_hr->{'all'}) {
		 print "The INPUT chain has a default DROP rule for all protocols.
";
	     } else {
		 for my $proto (qw/tcp udp icmp/) {
		     if (defined $ipt_hr->{$proto}) {
			 print "The INPUT chain drops $proto by default.
";
		     }
		 }
	     }
	 } else {
	     print "[-] Could not parse $ipt_obj->{'_ipt_bin_name'} policy
";
	 }

	 ($ipt_hr, $rv) = $ipt_obj->default_log($table, $chain);
	 if ($rv) {
	     if (defined $ipt_hr->{'all'}) {
		 print "The INPUT chain has a default LOG rule for all protocols.
";
	     } else {
		 for my $proto (qw/tcp udp icmp/) {
		     if (defined $ipt_hr->{$proto}) {
			 print "The INPUT chain logs $proto by default.
";
		     }
		 }
	     }
	 } else {
	     print "[-] Could not parse $ipt_obj->{'_ipt_bin_name'} policy
";
	 }

DESCRIPTION

       The "IPTables::Parse" package provides an interface to parse iptables or ip6tables rules on Linux systems through the direct execution of
       iptables/ip6tables commands, or from parsing a file that contains an iptables/ip6tables policy listing.	You can get the current policy
       applied to a table/chain, look for a specific user-defined chain, check for a default DROP policy, or determing whether or not logging
       rules exist.

FUNCTIONS

       The IPTables::Parse extension provides an object interface to the following functions:

       chain_policy($table, $chain)
	   This function returns the policy (e.g. 'DROP', 'ACCEPT', etc.) for the specified table and chain:

	     print "INPUT policy: ", $ipt_obj->chain_policy('filter', 'INPUT'), "
";

       chain_rules($table, $chain)
	   This function parses the specified chain and table and returns an array reference for all rules in the chain.  Each element in the
	   array reference is a hash with the following keys (that contain values depending on the rule): "src", "dst", "protocol", "s_port",
	   "d_port", "target", "packets", "bytes", "intf_in", "intf_out", "to_ip", "to_port", "state", "raw", and "extended".  The "extended"
	   element contains the rule output past the protocol information, and the "raw" element contains the complete rule itself as reported by
	   iptables or ip6tables.

       default_drop($table, $chain)
	   This function parses the running iptables or ip6tables policy in order to determine if the specified chain contains a default DROP
	   rule.  Two values are returned, a hash reference whose keys are the protocols that are dropped by default if a global ACCEPT rule has
	   not accepted matching packets first, along with a return value that tells the caller if parsing the iptables or ip6tables policy was
	   successful.	Note that if all protocols are dropped by default, then the hash key 'all' will be defined.

	     ($ipt_hr, $rv) = $ipt_obj->default_drop('filter', 'INPUT');

       default_log($table, $chain)
	   This function parses the running iptables or ip6tables policy in order to determine if the specified chain contains a default LOG rule.
	   Two values are returned, a hash reference whose keys are the protocols that are logged by default if a global ACCEPT rule has not
	   accepted matching packets first, along with a return value that tells the caller if parsing the iptables or ip6tables policy was
	   successful.	Note that if all protocols are logged by default, then the hash key 'all' will be defined.  An example invocation is:

	     ($ipt_hr, $rv) = $ipt_obj->default_log('filter', 'INPUT');

AUTHOR

       Michael Rash, <mbr@cipherdyne.org>

SEE ALSO

       The IPTables::Parse is used by the IPTables::ChainMgr extension in support of the psad and fwsnort projects to parse iptables or ip6tables
       policies (see the psad(8), and fwsnort(8) man pages).  As always, the iptables(8) and ip6tables(8) man pages provide the best information
       on command line execution and theory behind iptables and ip6tables.

       Although there is no mailing that is devoted specifically to the IPTables::Parse extension, questions about the extension will be answered
       on the following lists:

	 The psad mailing list: http://lists.sourceforge.net/lists/listinfo/psad-discuss
	 The fwsnort mailing list: http://lists.sourceforge.net/lists/listinfo/fwsnort-discuss

       The latest version of the IPTables::Parse extension can be found on CPAN and also here:

	 http://www.cipherdyne.org/modules/

       Source control is provided by git:

	 http://www.cipherdyne.org/git/IPTables-Parse.git
	 http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p=IPTables-Parse.git;a=summary

CREDITS

       Thanks to the following people:

	 Franck Joncourt <franck.mail@dthconnex.com>
	 Grant Ferley

AUTHOR

       The IPTables::Parse extension was written by Michael Rash <mbr@cipherdyne.org> to support the psad and fwsnort projects.  Please send email
       to this address if there are any questions, comments, or bug reports.

COPYRIGHT AND LICENSE

       Copyright (C) 2005-2012 Michael Rash.  All rights reserved.

       This module is free software.  You can redistribute it and/or modify it under the terms of the Artistic License 2.0.  More information can
       be found here: http://www.perl.com/perl/misc/Artistic.html

       This program is distributed "as is" in the hope that it will be useful, but without any warranty; without even the implied warranty of
       merchantability or fitness for a particular purpose.

perl v5.14.2							    2012-03-05						      IPTables::Parse(3pm)