3 Iptables parser and query library
4 (c) 2008-2009 Jo-Philipp Wich <jow@openwrt.org>
5 (c) 2008-2009 Steven Barth <steven@midlink.org>
7 Licensed under the Apache License, Version 2.0 (the "License");
8 you may not use this file except in compliance with the License.
9 You may obtain a copy of the License at
11 http://www.apache.org/licenses/LICENSE-2.0
18 luci.util = require "luci.util"
19 luci.sys = require "luci.sys"
20 luci.ip = require "luci.ip"
23 local io = require "io"
24 local tonumber, ipairs, table = tonumber, ipairs, table
26 module("luci.sys.iptparser")
28 IptParser = luci.util.class()
30 function IptParser.__init__( self, family )
31 self._family = (tonumber(family) == 6) and 6 or 4
36 local t = self._tables
37 local s = self:_supported_tables(self._family)
39 if s.filter then t[#t+1] = "filter" end
40 if s.nat then t[#t+1] = "nat" end
41 if s.mangle then t[#t+1] = "mangle" end
42 if s.raw then t[#t+1] = "raw" end
44 if self._family == 4 then
45 self._nulladdr = "0.0.0.0/0"
46 self._command = "iptables -t %s --line-numbers -nxvL"
48 self._nulladdr = "::/0"
49 self._command = "ip6tables -t %s --line-numbers -nxvL"
55 function IptParser._supported_tables( self, family )
57 local ok, lines = pcall(io.lines,
58 (family == 6) and "/proc/net/ip6_tables_names"
59 or "/proc/net/ip_tables_names")
71 -- search criteria as only argument. If args is nil or an empty table then all
72 -- rules will be returned.
74 -- The following keys in the args table are recognized:
76 -- <li> table - Match rules that are located within the given table
77 -- <li> chain - Match rules that are located within the given chain
78 -- <li> target - Match rules with the given target
79 -- <li> protocol - Match rules that match the given protocol, rules with
80 -- protocol "all" are always matched
81 -- <li> source - Match rules with the given source, rules with source
82 -- "0.0.0.0/0" (::/0) are always matched
83 -- <li> destination - Match rules with the given destination, rules with
84 -- destination "0.0.0.0/0" (::/0) are always matched
85 -- <li> inputif - Match rules with the given input interface, rules
86 -- with input interface "*" (=all) are always matched
87 -- <li> outputif - Match rules with the given output interface, rules
88 -- with output interface "*" (=all) are always matched
89 -- <li> flags - Match rules that match the given flags, current
90 -- supported values are "-f" (--fragment)
91 -- and "!f" (! --fragment)
92 -- <li> options - Match rules containing all given options
94 -- The return value is a list of tables representing the matched rules.
95 -- Each rule table contains the following fields:
97 -- <li> index - The index number of the rule
98 -- <li> table - The table where the rule is located, can be one
99 -- of "filter", "nat" or "mangle"
100 -- <li> chain - The chain where the rule is located, e.g. "INPUT"
101 -- or "postrouting_wan"
102 -- <li> target - The rule target, e.g. "REJECT" or "DROP"
103 -- <li> protocol The matching protocols, e.g. "all" or "tcp"
104 -- <li> flags - Special rule options ("--", "-f" or "!f")
105 -- <li> inputif - Input interface of the rule, e.g. "eth0.0"
106 -- or "*" for all interfaces
107 -- <li> outputif - Output interface of the rule,e.g. "eth0.0"
108 -- or "*" for all interfaces
109 -- <li> source - The source ip range, e.g. "0.0.0.0/0" (::/0)
110 -- <li> destination - The destination ip range, e.g. "0.0.0.0/0" (::/0)
111 -- <li> options - A list of specific options of the rule,
112 -- e.g. { "reject-with", "tcp-reset" }
113 -- <li> packets - The number of packets matched by the rule
114 -- <li> bytes - The number of total bytes matched by the rule
118 -- ip = luci.sys.iptparser.IptParser()
119 -- result = ip.find( {
122 -- options={ "reject-with", "tcp-reset" }
125 -- This will match all rules with target "-j REJECT",
126 -- protocol "-p tcp" (or "-p all")
127 -- and the option "--reject-with tcp-reset".
128 function IptParser.find( self, args )
130 local args = args or { }
133 args.source = args.source and self:_parse_addr(args.source)
134 args.destination = args.destination and self:_parse_addr(args.destination)
136 for i, rule in ipairs(self._rules) do
140 if not ( not args.table or args.table:lower() == rule.table ) then
145 if not ( match == true and (
146 not args.chain or args.chain == rule.chain
152 if not ( match == true and (
153 not args.target or args.target == rule.target
159 if not ( match == true and (
160 not args.protocol or rule.protocol == "all" or
161 args.protocol:lower() == rule.protocol
167 if not ( match == true and (
168 not args.source or rule.source == self._nulladdr or
169 self:_parse_addr(rule.source):contains(args.source)
175 if not ( match == true and (
176 not args.destination or rule.destination == self._nulladdr or
177 self:_parse_addr(rule.destination):contains(args.destination)
182 -- match input interface
183 if not ( match == true and (
184 not args.inputif or rule.inputif == "*" or
185 args.inputif == rule.inputif
190 -- match output interface
191 if not ( match == true and (
192 not args.outputif or rule.outputif == "*" or
193 args.outputif == rule.outputif
198 -- match flags (the "opt" column)
199 if not ( match == true and (
200 not args.flags or rule.flags == args.flags
205 -- match specific options
206 if not ( match == true and (
208 self:_match_options( rule.options, args.options )
214 if match == true then
223 -- through external commands.
224 function IptParser.resync( self )
231 function IptParser.tables( self )
236 function IptParser.chains( self, table )
239 for _, r in ipairs(self:find({table=table})) do
240 if not lookup[r.chain] then
241 lookup[r.chain] = true
242 chains[#chains+1] = r.chain
249 -- and "rules". The "rules" field is a table of rule tables.
250 function IptParser.chain( self, table, chain )
251 return self._chains[table:lower()] and self._chains[table:lower()][chain]
255 function IptParser.is_custom_target( self, target )
256 for _, r in ipairs(self._rules) do
257 if r.chain == target then
265 -- [internal] Parse address according to family.
266 function IptParser._parse_addr( self, addr )
267 if self._family == 4 then
268 return luci.ip.IPv4(addr)
270 return luci.ip.IPv6(addr)
274 -- [internal] Parse iptables output from all tables.
275 function IptParser._parse_rules( self )
277 for i, tbl in ipairs(self._tables) do
279 self._chains[tbl] = { }
281 for i, rule in ipairs(luci.util.execl(self._command % tbl)) do
283 if rule:find( "^Chain " ) == 1 then
286 local cname, cpol, cpkt, cbytes = rule:match(
287 "^Chain ([^%s]*) %(policy (%w+) " ..
288 "(%d+) packets, (%d+) bytes%)"
292 cname, crefs = rule:match(
293 "^Chain ([^%s]*) %((%d+) references%)"
298 self._chains[tbl][cname] = {
300 packets = tonumber(cpkt or 0),
301 bytes = tonumber(cbytes or 0),
302 references = tonumber(crefs or 0),
307 if rule:find("%d") == 1 then
309 local rule_parts = luci.util.split( rule, "%s+", nil, true )
310 local rule_details = { }
312 -- cope with rules that have no target assigned
313 if rule:match("^%d+%s+%d+%s+%d+%s%s") then
314 table.insert(rule_parts, 4, nil)
317 -- ip6tables opt column is usually zero-width
318 if self._family == 6 then
319 table.insert(rule_parts, 6, "--")
322 rule_details["table"] = tbl
323 rule_details["chain"] = self._chain
324 rule_details["index"] = tonumber(rule_parts[1])
325 rule_details["packets"] = tonumber(rule_parts[2])
326 rule_details["bytes"] = tonumber(rule_parts[3])
327 rule_details["target"] = rule_parts[4]
328 rule_details["protocol"] = rule_parts[5]
329 rule_details["flags"] = rule_parts[6]
330 rule_details["inputif"] = rule_parts[7]
331 rule_details["outputif"] = rule_parts[8]
332 rule_details["source"] = rule_parts[9]
333 rule_details["destination"] = rule_parts[10]
334 rule_details["options"] = { }
336 for i = 11, #rule_parts do
337 if #rule_parts[i] > 0 then
338 rule_details["options"][i-10] = rule_parts[i]
342 self._rules[#self._rules+1] = rule_details
344 self._chains[tbl][self._chain].rules[
345 #self._chains[tbl][self._chain].rules + 1
356 -- [internal] Return true if optlist1 contains all elements of optlist 2.
357 -- Return false in all other cases.
358 function IptParser._match_options( self, o1, o2 )
360 -- construct a hashtable of first options list to speed up lookups
362 for i, opt in ipairs( o1 ) do oh[opt] = true end
364 -- iterate over second options list
365 -- each string in o2 must be also present in o1
366 -- if o2 contains a string which is not found in o1 then return false
367 for i, opt in ipairs( o2 ) do