FireWall/parseRule.py at master · bgreenb/FireWall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
import iptc

#It's not extensible, only used for match ip and ports
def initDic():
    d = {}
    d['-m'] = ''
    d['-p'] = ''
    d['-s'] = ''
    d['-d'] = ''
    d['-src-range'] = ''
    d['-dst-range'] = ''
    d['-sport'] = ''
    d['-dport'] = ''
    d['-j'] = ''
    return d

# no check for valid ipaddress range input
def createRule(cmdDic):
    rule = iptc.Rule()
    if cmdDic['-s'] != '':
        rule.src = cmdDic['-s']
    if cmdDic['-d'] != '':
        rule.dst = cmdDic['-p']
    if cmdDic['-p'] != '':
        rule.protocol = cmdDic['-p']
        match = iptc.Match(rule, cmdDic['-p'])
        if cmdDic['-dport'] != '':
            match.dport = cmdDic['-dport']
        if cmdDic['-sport'] != '':
            match.sport = cmdDic['-sport']
        rule.add_match(match)
    if cmdDic['-m'] != '':
        match = iptc.Match(rule, cmdDic['-m'])
        if cmdDic['-src-range'] != '':
            match.src_range = cmdDic['-src-range']
        if cmdDic['-dst-range'] != '':
            match.dst_range = cmdDic['-dst-range']
        rule.add_match(match)
    if cmdDic['-j'] != '':
        rule.target = iptc.Target(rule, cmdDic['-j'])

    return rule


with open('rules.txt', 'r') as f:
    for line in f.readlines():
        #print(line.strip())
        args = line.strip().split()
       	print 'args: ', args
        cmdDic = initDic()
        if args[0] != 'iptables':
            continue

        for i in range(3, len(args)):
            if args[i].startswith('-'):
                print args[i]
                cmdDic[args[i]] = args[i+1]

        rule = createRule(cmdDic)
        if args[1] == '-A':
            chain_name = args[2]
            chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), chain_name)
            chain.append_rule(rule)
        if args[1] == '-I':
            chain_name = args[2]
            chain_position = int(args[3])
            chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), chain_name)
            chain.insert_rule(rule, chain_position)
        if args[1] == '-R':
            chain_name = args[2]
            chain_position = int(args[3])
            chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), chain_name)
            chain.replace_rule(rule, chain_position)