File Coverage

blib/lib/IPTables/Parse.pm

Criterion	Covered	Total	%
statement	20	439	4.5
branch	0	276	0.0
condition	0	232	0.0
subroutine	7	21	33.3
pod	5	12	41.6
total	32	980	3.2

#
##################################################################
#
# File: IPTables::Parse.pm
#
# Purpose: Perl interface to parse iptables and ip6tables rulesets.
#
# Author: Michael Rash ([e-mail])
#
# Version: 1.6
#
##################################################################
#

package IPTables::Parse;

use 5.006;
use POSIX ":sys_wait_h";
use Carp;
use File::Temp;
use strict;
use warnings;
use vars qw($VERSION);

$VERSION = '1.6';

sub new() {
    my $class = shift;
    my %args  = @_;

    my $ipt_bin  = '/sbin/iptables';
    my $ipt6_bin = '/sbin/ip6tables';
    my $fwc_bin  = '/usr/bin/firewall-cmd';

    my $self = {
        _iptables        => $args{'iptables'} || $args{'ip6tables'} || '',
        _firewall_cmd    => $args{'firewall-cmd'} || '',
        _fwd_args        => $args{'fwd_args'}     || '--direct --passthrough ipv4',
        _ipv6            => $args{'use_ipv6'}     || 0,
        _iptout          => $args{'iptout'}       || mktemp('/tmp/ipt.out.XXXXXX'),
        _ipterr          => $args{'ipterr'}       || mktemp('/tmp/ipt.err.XXXXXX'),
        _ipt_alarm       => $args{'ipt_alarm'}    || 30,
        _debug           => $args{'debug'}        || 0,
        _verbose         => $args{'verbose'}      || 0,
        _ipt_rules_file  => $args{'ipt_rules_file'}  || '',
        _ipt_exec_style  => $args{'ipt_exec_style'}  || 'waitpid',
        _ipt_exec_sleep  => $args{'ipt_exec_sleep'}  || 0,
        _sigchld_handler => $args{'sigchld_handler'} || \&REAPER,
        _skip_ipt_exec_check => $args{'skip_ipt_exec_check'} || 0,
        _lockless_ipt_exec   => $args{'lockless_ipt_exec'}   || 0,
    };

    if ($self->{'_skip_ipt_exec_check'}) {
        unless ($self->{'_firewall_cmd'} or $self->{'_iptables'}) {
            ### default
            $self->{'_iptables'} = $ipt_bin;
        }
    } else {
        if ($self->{'_firewall_cmd'}) {
            croak "[*] $self->{'_firewall_cmd'} incorrect path.\n"
                unless -e $self->{'_firewall_cmd'};
            croak "[*] $self->{'_firewall_cmd'} not executable.\n"
                unless -x $self->{'_firewall_cmd'};
        } elsif ($self->{'_iptables'}) {
            croak "[*] $self->{'_iptables'} incorrect path.\n"
                unless -e $self->{'_iptables'};
            croak "[*] $self->{'_iptables'} not executable.\n"
                unless -x $self->{'_iptables'};
        } else {
            ### check for firewall-cmd first since systems with it
            ### will have iptables installed as well (but firewall-cmd
            ### should be used instead if it exists)
            if (-e $fwc_bin and -x $fwc_bin) {
                $self->{'_firewall_cmd'} = $fwc_bin;
            } elsif (-e $ipt_bin and -x $ipt_bin) {
                $self->{'_iptables'} = $ipt_bin;
            } elsif (-e $ipt6_bin and -x $ipt6_bin) {
                $self->{'_iptables'} = $ipt6_bin;
            } else {
                croak "[*] Could not find/execute iptables, " .
                    "specify path via _iptables\n";
            }
        }
    }

    if ($self->{'_ipv6'} and $self->{'_iptables'} eq $ipt_bin) {
        if (-e $ipt6_bin and -x $ipt6_bin) {
            $self->{'_iptables'} = $ipt6_bin;
        } else {
            croak "[*] Could not find/execute ip6tables, " .
                "specify path via _iptables\n";
        }
    }

    ### set the firewall binary name
    $self->{'_ipt_bin_name'} = 'iptables';
    if ($self->{'_firewall_cmd'}) {
        $self->{'_ipt_bin_name'} = $1 if $self->{'_firewall_cmd'} =~ m|.*/(\S+)|;
    } else {
        $self->{'_ipt_bin_name'} = $1 if $self->{'_iptables'} =~ m|.*/(\S+)|;
    }

    ### handle ipv6
    if ($self->{'_ipv6'}) {
        if ($self->{'_firewall_cmd'}) {
            if ($self->{'_fwd_args'} =~ /ipv4/i) {
                $self->{'_fwd_args'} = '--direct --passthrough ipv6';
            }
        } else {
            if ($self->{'_ipt_bin_name'} eq 'iptables') {
                unless ($self->{'_skip_ipt_exec_check'}) {
                    croak "[*] use_ipv6 is true, " .
                        "but $self->{'_iptables'} not ip6tables.\n";
                }
            }
        }
    }

    $self->{'_ipv6'} = 1 if $self->{'_ipt_bin_name'} eq 'ip6tables';
    if ($self->{'_firewall_cmd'}) {
        $self->{'_ipv6'} = 1 if $self->{'_fwd_args'} =~ /ipv6/;
    }

    ### set the main command string to allow for iptables execution
    ### via firewall-cmd if necessary
    $self->{'_cmd'} = $self->{'_iptables'};
    if ($self->{'_firewall_cmd'}) {
        $self->{'_cmd'} = "$self->{'_firewall_cmd'} $self->{'_fwd_args'}";
    }

    unless ($self->{'_skip_ipt_exec_check'}) {
        unless ($self->{'_lockless_ipt_exec'}) {
            ### now that we have the iptables command defined, see whether
            ### it supports -w to acquire an exclusive lock
            my ($rv, $out_ar, $err_ar) = &exec_iptables($self,
                "$self->{'_cmd'} -w -t filter -n -L INPUT");
            $self->{'_cmd'} .= ' -w' if $rv;
        }
    }

    $self->{'parse_keys'} = &parse_keys();

    bless $self, $class;
}

sub DESTROY {
    my $self = shift;

    ### clean up tmp files
    unless ($self->{'_debug'}) {
        unlink $self->{'_iptout'};
        unlink $self->{'_ipterr'};
    }

    return;
}

sub parse_keys() {
    my $self = shift;

    ### only used for IPv4 + NAT
    my $ipv4_re = qr|(?:[0-2]?\d{1,2}\.){3}[0-2]?\d{1,2}|;

    my %keys = (
        'regular' => {
            'packets'  => {
                'regex'     => '',
                'ipt_match' => ''
            },
            'bytes'    => {
                'regex'     => '',
                'ipt_match' => ''
            },
            'target'   => {
                'regex'     => '',
                'ipt_match' => ''
            },
            'protocol' => {
                'regex'     => '',
                'ipt_match' => '-p'
            },
            'proto'    => {
                'regex'     => '',
                'ipt_match' => '-p'
            },
            'intf_in'  => {
                'regex'     => '',
                'ipt_match' => '-i'
            },
            'intf_out' => {
                'regex'     => '',
                'ipt_match' => '-o'
            },
            'src'      => {
                'regex'     => '',
                'ipt_match' => '-s'
            },
            'dst'      => {
                'regex'     => '',
                'ipt_match' => '-d'
            }
        },
        'extended' => {
            's_port' => {
                'regex'     => qr/\bspts?:(\S+)/,
                'ipt_match' => '--sport'
            },
            'sport' => {
                'regex'     => qr/\bspts?:(\S+)/,
                'ipt_match' => '--sport'
            },
            'd_port' => {
                'regex'     => qr/\bdpts?:(\S+)/,
                'ipt_match' => '--dport'
            },
            'dport' => {
                'regex'     => qr/\bdpts?:(\S+)/,
                'ipt_match' => '--dport'
            },
            'to_ip' => {
                'regex'     => qr/\bto:($ipv4_re):\d+/,
                'ipt_match' => ''
            },
            'to_port' => {
                'regex'     => qr/\bto:$ipv4_re:(\d+)/,
                'ipt_match' => ''
            },
            'mac_source' => {
                'regex'     => qr/\bMAC\s+(\S+)/,
                'ipt_match' => '-m mac --mac-source'
            },
            'state' => {
                'regex'     => qr/\bstate\s+(\S+)/,
                'ipt_match' => '-m state --state'
            },
            'ctstate' => {
                'regex'     => qr/\bctstate\s+(\S+)/,
                'ipt_match' => '-m conntrack --ctstate'
            },
            'comment' => {
                'regex'      => qr|\/\*\s(.*?)\s\*\/|,
                'ipt_match'  => '-m comment --comment',
                'use_quotes' => 1
            },
            'string' => {
                'regex'      => qr|STRING\s+match\s+\"(.*?)\"|,
                'ipt_match'  => '-m string --algo bm --string',
                'use_quotes' => 1
            },
            'length' => {
                'regex'      => qr|\blength\s(\S+)|,
                'ipt_match'  => '-m length --length',
            },
        },
        'rule_num' => '',
        'raw' => ''
    );

    return \%keys;
}

sub list_table_chains() {
    my $self   = shift;
    my $table  = shift || croak '[*] Specify a table, e.g. "nat"';
    my $file   = shift || '';

    my @ipt_lines = ();
    my @chains = ();

    if ($self->{'_ipt_rules_file'} and not $file) {
        $file = $self->{'_ipt_rules_file'};
    }

    if ($file) {
        ### read the iptables rules out of $file instead of executing
        ### the iptables command.
        open F, "< $file" or croak "[*] Could not open file $file: $!";
        @ipt_lines = ;
        close F;
    } else {
        my ($rv, $out_ar, $err_ar) = $self->exec_iptables(
                "$self->{'_cmd'} -t $table -v -n -L");
        @ipt_lines = @$out_ar;
    }

    for (@ipt_lines) {
        if (/^\s*Chain\s(.*?)\s\(/) {
            push @chains, $1;
        }
    }
    return \@chains;
}

sub chain_policy() {
    my $self   = shift;
    my $table  = shift || croak '[*] Specify a table, e.g. "nat"';
    my $chain  = shift || croak '[*] Specify a chain, e.g. "OUTPUT"';
    my $file   = shift || '';

    my @ipt_lines = ();

    if ($self->{'_ipt_rules_file'} and not $file) {
        $file = $self->{'_ipt_rules_file'};
    }

    if ($file) {
        ### read the iptables rules out of $file instead of executing
        ### the iptables command.
        open F, "< $file" or croak "[*] Could not open file $file: $!";
        @ipt_lines = ;
        close F;
    } else {
        my ($rv, $out_ar, $err_ar) = $self->exec_iptables(
                "$self->{'_cmd'} -t $table -v -n -L $chain");
        @ipt_lines = @$out_ar;
    }

    my $policy = '';

    for my $line (@ipt_lines) {
        ### Chain INPUT (policy ACCEPT 16 packets, 800 bytes)
        if ($line =~ /^\s*Chain\s+$chain\s+\(policy\s+(\w+)/) {
            $policy = $1;
            last;
        }
    }

    return $policy;
}

sub chain_action_rules() {
    return &chain_rules();
}

sub chain_rules() {
    my $self   = shift;
    my $table  = shift || croak '[*] Specify a table, e.g. "nat"';
    my $chain  = shift || croak '[*] Specify a chain, e.g. "OUTPUT"';
    my $file   = shift || '';

    my $found_chain  = 0;
    my @ipt_lines = ();

    my $fh = *STDERR;
    $fh = *STDOUT if $self->{'_verbose'};

    ### only used for IPv4 + NAT
    my $ip_re = qr|(?:[0-2]?\d{1,2}\.){3}[0-2]?\d{1,2}|;

    ### array of hash refs
    my @chain = ();
    my @global_accept_state = ();

    if ($self->{'_ipt_rules_file'} and not $file) {
        $file = $self->{'_ipt_rules_file'};
    }

    if ($file) {
        ### read the iptables rules out of $file instead of executing
        ### the iptables command.
        open F, "< $file" or croak "[*] Could not open file $file: $!";
        @ipt_lines = ;
        close F;
    } else {
        my ($rv, $out_ar, $err_ar) = $self->exec_iptables(
                "$self->{'_cmd'} -t $table -v -n -L $chain --line-numbers");
        @ipt_lines = @$out_ar;
    }

    ### determine the output style (e.g. "-nL -v" or just plain "-nL"; if the
    ### policy data came from a file then -v might not have been used)
    my $ipt_verbose = 0;
    for my $line (@ipt_lines) {
        if ($line =~ /\spkts\s+bytes\s+target/) {
            $ipt_verbose = 1;
            last;
        }
    }
    my $has_line_numbers = 0;
    for my $line (@ipt_lines) {
        if ($line =~ /^num\s+pkts\s+bytes\s+target/) {
            $has_line_numbers = 1;
            last;
        }
    }

    my $rule_num = 0;

    LINE: for my $line (@ipt_lines) {
        chomp $line;

        last LINE if ($found_chain and $line =~ /^\s*Chain\s+/);

        if ($line =~ /^\s*Chain\s\Q$chain\E\s\(/i) {
            $found_chain = 1;
            next LINE;
        }
        next LINE if $line =~ /\starget\s{2,}prot/i;
        next LINE unless $found_chain;
        next LINE unless $line;

        ### track the rule number independently of --line-numbers,
        ### but the values should always match
        $rule_num++;

        ### initialize hash
        my %rule = (
            'extended' => '',
            'raw'      => $line,
            'rule_num' => $rule_num
        );
        for my $key (keys %{$self->{'parse_keys'}->{'regular'}}) {
            $rule{$key} = '';
        }
        for my $key (keys %{$self->{'parse_keys'}->{'extended'}}) {
            $rule{$key} = '';
        }

        my $rule_body = '';
        my $packets   = '';
        my $bytes     = '';
        my $rnum      = '';

        if ($ipt_verbose) {
            if ($has_line_numbers) {
                if ($line =~ /^\s*(\d+)\s+(\S+)\s+(\S+)\s+(.*)/) {
                    $rnum      = $1;
                    $packets   = $2;
                    $bytes     = $3;
                    $rule_body = $4;
                }
            } else {
                if ($line =~ /^\s*(\S+)\s+(\S+)\s+(.*)/) {
                    $packets   = $1;
                    $bytes     = $2;
                    $rule_body = $3;
                }
            }
        } else {
            if ($has_line_numbers) {
                if ($line =~ /^\s*(\d+)\s+(.*)/) {
                    $rnum      = $1;
                    $rule_body = $2;
                }
            } else {
                $rule_body = $line;
                $rnum      = $rule_num;
                $rnum      = $rule_num;
            }
        }

        if ($rnum and $rnum ne $rule_num) {
            croak "[*] Rule number mis-match.";
        }

        if ($ipt_verbose) {

            ### iptables:
            ### 0     0 ACCEPT  tcp  --  eth1 * 192.168.10.3  0.0.0.0/0  tcp dpt:80
            ### 0     0 ACCEPT  tcp  --  eth1 * 192.168.10.15 0.0.0.0/0  tcp dpt:22
            ### 33 2348 ACCEPT  tcp  --  eth1 * 192.168.10.2  0.0.0.0/0  tcp dpt:22
            ### 0     0 ACCEPT  tcp  --  eth1 * 192.168.10.2  0.0.0.0/0  tcp dpt:80
            ### 0     0 DNAT    tcp  --  *    * 123.123.123.123 0.0.0.0/0 tcp dpt:55000 to:192.168.12.12:80

            ### ip6tables:
            ### 0     0 ACCEPT  tcp   *   *   ::/0     fe80::aa:0:1/128    tcp dpt:12345
            ### 0     0 LOG     all   *   *   ::/0     ::/0                LOG flags 0 level 4

            my $match_re = qr/^(\S+)\s+(\S+)\s+\-\-\s+
                                (\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s*(.*)/x;

            if ($self->{'_ipt_bin_name'} eq 'ip6tables'
                    or ($self->{'_ipt_bin_name'} eq 'firewall-cmd'
                    and $self->{'_fwd_args'} =~ /\sipv6/)) {
                $match_re = qr/^(\S+)\s+(\S+)\s+
                                (\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s*(.*)/x;
            }

            if ($rule_body =~ $match_re) {
                $rule{'packets'}  = $packets;
                $rule{'bytes'}    = $bytes;
                $rule{'target'}   = $1;
                my $proto = $2;
                $proto = 'all' if $proto eq '0';
                $rule{'protocol'} = $rule{'proto'} = lc($proto);
                $rule{'intf_in'}  = $3;
                $rule{'intf_out'} = $4;
                $rule{'src'}      = $5;
                $rule{'dst'}      = $6;
                $rule{'extended'} = $7 || '';

                &parse_rule_extended(\%rule, $self->{'parse_keys'}->{'extended'});
            } else {
                if ($self->{'_debug'}) {
                    print $fh localtime() . "     -v Did not match parse regex: $line\n";
                }
            }
        } else {

            ### iptables:
            ### ACCEPT tcp  -- 164.109.8.0/24  0.0.0.0/0  tcp dpt:22 flags:0x16/0x02
            ### ACCEPT tcp  -- 216.109.125.67  0.0.0.0/0  tcp dpts:7000:7500
            ### ACCEPT udp  -- 0.0.0.0/0       0.0.0.0/0  udp dpts:7000:7500
            ### ACCEPT udp  -- 0.0.0.0/0       0.0.0.0/0  udp dpt:!7000
            ### ACCEPT icmp --  0.0.0.0/0      0.0.0.0/0
            ### ACCEPT tcp  --  0.0.0.0/0      0.0.0.0/0  tcp spt:35000 dpt:5000
            ### ACCEPT tcp  --  10.1.1.1       0.0.0.0/0

            ### LOG  all  --  0.0.0.0/0  0.0.0.0/0  LOG flags 0 level 4 prefix `DROP '
            ### LOG  all  --  127.0.0.2  0.0.0.0/0  LOG flags 0 level 4
            ### DNAT tcp  --  123.123.123.123  0.0.0.0/0  tcp dpt:55000 to:192.168.12.12:80

            ### ip6tables:
            ### ACCEPT     tcp   ::/0     fe80::aa:0:1/128    tcp dpt:12345
            ### LOG        all   ::/0     ::/0                LOG flags 0 level 4

            my $match_re = qr/^(\S+)\s+(\S+)\s+\-\-\s+(\S+)\s+(\S+)\s*(.*)/;

            if ($self->{'_ipt_bin_name'} eq 'ip6tables'
                    or ($self->{'_ipt_bin_name'} eq 'firewall-cmd'
                    and $self->{'_fwd_args'} =~ /\sipv6/)) {
                $match_re = qr/^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s*(.*)/;
            }

            if ($rule_body =~ $match_re) {
                $rule{'target'}   = $1;
                my $proto = $2;
                $proto = 'all' if $proto eq '0';
                $rule{'protocol'} = $rule{'proto'} = lc($proto);
                $rule{'src'}      = $3;
                $rule{'dst'}      = $4;
                $rule{'extended'} = $5 || '';

                &parse_rule_extended(\%rule, $self->{'parse_keys'}->{'extended'});
            } else {
                if ($self->{'_debug'}) {
                    print $fh localtime() . "     Did not match parse regex: $line\n";
                }
            }
        }
        push @chain, \%rule;
    }
    return \@chain;
}

sub parse_rule_extended() {
    my ($rule_hr, $ext_keys_hr) = @_;

    for my $key (keys %$ext_keys_hr) {
        if ($rule_hr->{'extended'}
                =~ /$ext_keys_hr->{$key}->{'regex'}/) {
            $rule_hr->{$key} = $1;
        }
    }

    if ($rule_hr->{'protocol'} eq '0') {
        $rule_hr->{'s_port'} = $rule_hr->{'sport'} = 0;
        $rule_hr->{'d_port'} = $rule_hr->{'dport'} = 0;
    } elsif ($rule_hr->{'protocol'} eq 'tcp'
            or $rule_hr->{'protocol'} eq 'udp') {
        $rule_hr->{'s_port'} = $rule_hr->{'sport'} = 0
            if $rule_hr->{'s_port'} eq '';
        $rule_hr->{'d_port'} = $rule_hr->{'dport'} = 0
            if $rule_hr->{'d_port'} eq '';
    }

    return;
}

sub default_drop() {
    my $self  = shift;
    my $table = shift || croak "[*] Specify a table, e.g. \"nat\"";
    my $chain = shift || croak "[*] Specify a chain, e.g. \"OUTPUT\"";
    my $file  = shift || '';

    my @ipt_lines = ();

    if ($self->{'_ipt_rules_file'} and not $file) {
        $file = $self->{'_ipt_rules_file'};
    }

    if ($file) {
        ### read the iptables rules out of $file instead of executing
        ### the iptables command.
        open F, "< $file" or croak "[*] Could not open file $file: $!";
        @ipt_lines = ;
        close F;
    } else {
### FIXME -v for interfaces?
        my ($rv, $out_ar, $err_ar) = $self->exec_iptables(
                "$self->{'_cmd'} -t $table -n -L $chain");
        @ipt_lines = @$out_ar;
    }

    return "[-] Could not get $self->{'_ipt_bin_name'} output!", 0
        unless @ipt_lines;

    my %protocols = ();
    my $found_chain = 0;
    my $found_default_drop = 0;
    my $rule_ctr = 1;
    my $prefix;
    my $policy = 'ACCEPT';
    my $any_ip_re = qr/(?:0\.){3}0\x2f0|\x3a{2}\x2f0/;

    LINE: for my $line (@ipt_lines) {
        chomp $line;

        last if ($found_chain and $line =~ /^\s*Chain\s+/);

        ### Chain INPUT (policy DROP)
        ### Chain FORWARD (policy ACCEPT)
        if ($line =~ /^\s*Chain\s+$chain\s+\(policy\s+(\w+)\)/) {
            $policy = $1;
            $found_chain = 1;
        }
        next LINE if $line =~ /^\s*target\s/i;
        next LINE unless $found_chain;

        ### include ULOG target as well
        my $log_re = qr/^\s*U?LOG\s+(\w+)\s+\-\-\s+.*
                $any_ip_re\s+$any_ip_re\s+(.*)/x;
        my $drop_re = qr/^DROP\s+(\w+)\s+\-\-\s+.*
            $any_ip_re\s+$any_ip_re\s*$/x;

        if ($self->{'_ipt_bin_name'} eq 'ip6tables'
                or ($self->{'_ipt_bin_name'} eq 'firewall-cmd'
                and $self->{'_fwd_args'} =~ /ipv6/)) {
            $log_re = qr/^\s*U?LOG\s+(\w+)\s+
                    $any_ip_re\s+$any_ip_re\s+(.*)/x;
            $drop_re = qr/^DROP\s+(\w+)\s+
                $any_ip_re\s+$any_ip_re\s*$/x;
        }

        ### might as well pick up any default logging rules as well
        if ($line =~ $log_re) {
            my $proto  = $1;
            my $p_tmp  = $2;
            my $prefix = 'NONE';

            ### some recent iptables versions return "0" instead of "all"
            ### for the protocol number
            $proto = 'all' if $proto eq '0';
            ### LOG flags 0 level 4 prefix `DROP '
            if ($p_tmp && $p_tmp =~ m|LOG.*\s+prefix\s+
                \`\s*(.+?)\s*\'|x) {
                $prefix = $1;
            }
            ### $proto may equal "all" here
            $protocols{$proto}{'LOG'}{'prefix'} = $prefix;
            $protocols{$proto}{'LOG'}{'rulenum'} = $rule_ctr;
        } elsif ($policy eq 'ACCEPT' and $line =~ $drop_re) {
            my $proto = $1;
            $proto = 'all' if $proto eq '0';
            ### DROP    all  --  0.0.0.0/0     0.0.0.0/0
            $protocols{$1}{'DROP'} = $rule_ctr;
            $found_default_drop = 1;
        }
        $rule_ctr++;
    }

    ### if the policy in the chain is DROP, then we don't
    ### necessarily need to find a default DROP rule.
    if ($policy eq 'DROP') {
        $protocols{'all'}{'DROP'} = 0;
        $found_default_drop = 1;
    }

    return "[-] There are no default drop rules in the " .
            "$self->{'_ipt_bin_name'} policy!", 0
        unless %protocols and $found_default_drop;

    return \%protocols, 1;
}

sub default_log() {
    my $self  = shift;
    my $table = shift || croak "[*] Specify a table, e.g. \"nat\"";
    my $chain = shift || croak "[*] Specify a chain, e.g. \"OUTPUT\"";
    my $file  = shift || '';

    my $any_ip_re  = qr/(?:0\.){3}0\x2f0|\x3a{2}\x2f0/;
    my @ipt_lines  = ();
    my %log_chains = ();
    my %log_rules  = ();

    if ($self->{'_ipt_rules_file'} and not $file) {
        $file = $self->{'_ipt_rules_file'};
    }

    ### note that we are not restricting the view to the current chain
    ### with the iptables -nL output; we are going to parse the given
    ### chain and all chains to which packets are jumped from the given
    ### chain.
    if ($file) {
        ### read the iptables rules out of $file instead of executing
        ### the iptables command.
        open F, "< $file" or croak "[*] Could not open file $file: $!";
        @ipt_lines = ;
        close F;
    } else {
        my ($rv, $out_ar, $err_ar) = $self->exec_iptables(
                "$self->{'_cmd'} -t $table -n -L $chain");
        @ipt_lines = @$out_ar;
    }

    ### determine the output style (e.g. "-nL -v" or just plain "-nL"; if the
    ### policy data came from a file then -v might not have been used)
    my $ipt_verbose = 0;
    for my $line (@ipt_lines) {
        if ($line =~ /^\s*pkts\s+bytes\s+target/) {
            $ipt_verbose = 1;
            last;
        }
    }

    return "[-] Could not get $self->{'_ipt_bin_name'} output!", 0
        unless @ipt_lines;

    ### first get all logging rules and associated chains
    my $log_chain;

    for my $line (@ipt_lines) {
        chomp $line;

        ### Chain INPUT (policy DROP)
        ### Chain fwsnort_INPUT_eth1 (1 references)
        if ($line =~ /^\s*Chain\s+(.*?)\s+\(/ and
                $line !~ /0\s+references/) {
            $log_chain = $1;
        }
        $log_chain = '' unless $line =~ /\S/;
        next unless $log_chain;

        my $proto = '';
        my $found = 0;
        if ($ipt_verbose) {
            if ($self->{'_ipt_bin_name'} eq 'ip6tables'
                    or ($self->{'_ipt_bin_name'} eq 'firewall-cmd'
                    and $self->{'_fwd_args'} =~ /\sipv6/)) {
                if ($line =~ m|^\s*\d+\s+\d+\s*U?LOG\s+(\w+)\s+
                        \S+\s+\S+\s+$any_ip_re
                        \s+$any_ip_re\s+.*U?LOG|x) {
                    $proto = $1;
                    $found = 1;
                }
            } else {
                if ($line =~ m|^\s*\d+\s+\d+\s*U?LOG\s+(\w+)\s+\-\-\s+
                        \S+\s+\S+\s+$any_ip_re
                        \s+$any_ip_re\s+.*U?LOG|x) {
                    $proto = $1;
                    $found = 1;
                }
            }
        } else {
            if ($self->{'_ipt_bin_name'} eq 'ip6tables'
                    or ($self->{'_ipt_bin_name'} eq 'firewall-cmd'
                    and $self->{'_fwd_args'} =~ /\sipv6/)) {
                if ($line =~ m|^\s*U?LOG\s+(\w+)\s+$any_ip_re
                        \s+$any_ip_re\s+.*U?LOG|x) {
                    $proto = $1;
                    $found = 1;
                }
            } else {
                if ($line =~ m|^\s*U?LOG\s+(\w+)\s+\-\-\s+$any_ip_re
                        \s+$any_ip_re\s+.*U?LOG|x) {
                    $proto = $1;
                    $found = 1;
                }
            }
        }

        if ($found) {
            $proto = 'all' if $proto eq '0';
            ### the above regex allows the limit target to be used
            $log_chains{$log_chain}{$proto} = '';  ### protocol
            $log_rules{$proto} = '' if $log_chain eq $chain;
        }
    }

    return "[-] There are no default logging rules " .
        "in the $self->{'_ipt_bin_name'} policy!", 0 unless %log_chains;

    my %sub_chains = ();

    ### get all sub-chains of the main chain we passed into default_log()
    &sub_chains($chain, \%sub_chains, \@ipt_lines);

    ### see which (if any) logging rules can be mapped back to the
    ### main chain we passed in.
    for my $log_chain (keys %log_chains) {
        if (defined $sub_chains{$log_chain}) {
            ### the logging rule is in the main chain (e.g. INPUT)
            for my $proto (keys %{$log_chains{$log_chain}}) {
                $log_rules{$proto} = '';
            }
        }
    }

    return \%log_rules, 1;
}

sub sub_chains() {
    my ($start_chain, $chains_hr, $ipt_lines_ar) = @_;
    my $found = 0;
    for my $line (@$ipt_lines_ar) {
        chomp $line;
        ### Chain INPUT (policy DROP)
        ### Chain fwsnort_INPUT_eth1 (1 references)
        if ($line =~ /^\s*Chain\s+\Q$start_chain\E\s+\(/ and
                $line !~ /0\s+references/) {
            $found = 1;
            next;
        }
        next unless $found;
        if ($found and $line =~ /^\s*Chain\s/) {
            last;
        }
        if ($line =~ m|^\s*(\S+)\s+\S+\s+|) {
            my $new_chain = $1;
            if ($new_chain ne 'LOG'
                    and $new_chain ne 'DROP'
                    and $new_chain ne 'REJECT'
                    and $new_chain ne 'ACCEPT'
                    and $new_chain ne 'RETURN'
                    and $new_chain ne 'QUEUE'
                    and $new_chain ne 'SNAT'
                    and $new_chain ne 'DNAT'
                    and $new_chain ne 'MASQUERADE'
                    and $new_chain ne 'pkts'
                    and $new_chain ne 'Chain'
                    and $new_chain ne 'target') {
                $chains_hr->{$new_chain} = '';
                &sub_chains($new_chain, $chains_hr, $ipt_lines_ar);
            }
        }
    }
    return;
}

sub exec_iptables() {
    my $self  = shift;
    my $cmd = shift || croak "[*] Must specify an " .
        "$self->{'_ipt_bin_name'} command to run.";
    my $iptout    = $self->{'_iptout'};
    my $ipterr    = $self->{'_ipterr'};
    my $debug     = $self->{'_debug'};
    my $ipt_alarm = $self->{'_ipt_alarm'};
    my $verbose   = $self->{'_verbose'};
    my $ipt_exec_style = $self->{'_ipt_exec_style'};
    my $ipt_exec_sleep = $self->{'_ipt_exec_sleep'};
    my $sigchld_handler = $self->{'_sigchld_handler'};

    croak "[*] $cmd does not look like an $self->{'_ipt_bin_name'} command."
        unless $cmd =~ m|^\s*iptables| or $cmd =~ m|^\S+/iptables|
            or $cmd =~ m|^\s*ip6tables| or $cmd =~ m|^\S+/ip6tables|
            or $cmd =~ m|^\s*firewall-cmd| or $cmd =~ m|^\S+/firewall-cmd|;

    ### sanitize $cmd - this is not bullet proof, but better than
    ### nothing (especially for strange iptables chain names). Further,
    ### quotemeta() is too aggressive since things like IPv6 addresses
    ### contain ":" chars, etc.
    $cmd =~ s/([;<>\$\|`\@&\(\)\[\]\{\}])/\\$1/g;

    my $rv = 1;
    my @stdout = ();
    my @stderr = ();

    my $fh = *STDERR;
    $fh = *STDOUT if $verbose;

    if ($debug or $verbose) {
        print $fh localtime() . " [+] IPTables::Parse::",
            "exec_iptables(${ipt_exec_style}()) $cmd\n";
        if ($ipt_exec_sleep > 0) {
            print $fh localtime() . " [+] IPTables::Parse::",
                "exec_iptables() sleep seconds: $ipt_exec_sleep\n";
        }
    }

    if ($ipt_exec_sleep > 0) {
        if ($debug or $verbose) {
            print $fh localtime() . " [+] IPTables::Parse: ",
                "sleeping for $ipt_exec_sleep seconds before ",
                "executing $self->{'_ipt_bin_name'} command.\n";
        }
        sleep $ipt_exec_sleep;
    }

    if ($ipt_exec_style eq 'system') {
        system qq{$cmd > $iptout 2> $ipterr};
    } elsif ($ipt_exec_style eq 'popen') {
        open CMD, "$cmd 2> $ipterr |" or croak "[*] Could not execute $cmd: $!";
        @stdout = ;
        close CMD;
        open F, "> $iptout" or croak "[*] Could not open $iptout: $!";
        print F for @stdout;
        close F;
    } else {
        my $ipt_pid;

        if ($debug or $verbose) {
            print $fh localtime() . " [+] IPTables::Parse: " .
                "Setting SIGCHLD handler to: " . $sigchld_handler . "\n";
        }

        local $SIG{'CHLD'} = $sigchld_handler;
        if ($ipt_pid = fork()) {
            eval {
                ### iptables should never take longer than 30 seconds to execute,
                ### unless there is some absolutely enormous policy or the kernel
                ### is exceedingly busy
                local $SIG{'ALRM'} = sub {die "[*] $self->{'_ipt_bin_name'} " .
                    "command timeout.\n"};
                alarm $ipt_alarm;
                waitpid($ipt_pid, 0);
                alarm 0;
            };
            if ($@) {
                kill 9, $ipt_pid unless kill 15, $ipt_pid;
            }
        } else {
            croak "[*] Could not fork $self->{'_ipt_bin_name'}: $!"
                unless defined $ipt_pid;

            ### exec the iptables command and preserve stdout and stderr
            exec qq{$cmd > $iptout 2> $ipterr};
        }
    }

    if (-e $iptout) {
        open F, "< $iptout" or croak "[*] Could not open $iptout";
        @stdout = ;
        close F;
    }
    if (-e $ipterr) {
        open F, "< $ipterr" or croak "[*] Could not open $ipterr";
        @stderr = ;
        close F;

        $rv = 0 if @stderr;
    }

    if (@stdout) {
        if ($stdout[$#stdout] =~ /^success/) {
            pop @stdout;
        }
        if ($self->{'_ipt_bin_name'} eq 'firewall-cmd') {
            for (@stdout) {
                if (/COMMAND_FAILED/) {
                    $rv = 0;
                    last;
                }
            }
        }
    }

    if ($debug or $verbose) {
        print $fh localtime() . "     $self->{'_ipt_bin_name'} " .
            "command stdout:\n";
        for my $line (@stdout) {
            if ($line =~ /\n$/) {
                print $fh $line;
            } else {
                print $fh $line, "\n";
            }
        }
        print $fh localtime() . "     $self->{'_ipt_bin_name'} " .
            "command stderr:\n";
        for my $line (@stderr) {
            if ($line =~ /\n$/) {
                print $fh $line;
            } else {
                print $fh $line, "\n";
            }
        }
    }

    if ($debug or $verbose) {
        print $fh localtime() . "     Return value: $rv\n";
    }

    return $rv, \@stdout, \@stderr;
}

sub REAPER {
    my $stiff;
    while(($stiff = waitpid(-1,WNOHANG))>0){
        # do something with $stiff if you want
    }
    local $SIG{'CHLD'} = \&REAPER;
    return;
}

1;
__END__