Comments (3)
Hi @diekmann ,
--sports
happens to be interpreted as part of the protocol because, as explained in the readme, the syntax for custom iptables filters is abstract-rule | iptables-filters
.
So the correct way to write that rule is: * > local:22 tcp | --sports 22
.
This issue highlights that trust is given to users for writing correct protocol names. Maybe a warning for "unknown protocol" should be raised.
Happy playing with Mignis!
McCio
from mignis.
@diekmann
You can write any filter you want after |, but mignis cannot provide any correctness guarantee about the whole configuration if you do that.
The abstract model doesn't cover all the cases that could be generated by using filters, so we don't support them.
@McCio
I think this could be added.
Currently iptables considers a protocol string as valid in 4 different cases:
- special keyword "all".
- any number between 0 and 255.
- if matches any entry in /etc/protocols.
- if matches any element in the array
xtables_chain_protos
(hardcoded in libxtables, link)
The only problem I see is that, if /etc/protocol doesn't exist in the system (which is the reason for xtables_chain_protos
to exist), or nothing was matched, then mignis should somehow know beforehand the contents of that array, in order not to give a false "Unknown protocol" answer.
We could hardcode the current array in mignis but then only a warning could be raised, since it might not match very old iptables versions.
from mignis.
Awesome, thanks 👍
Now a rather tough question:
I can also use -m multiport --ports 22
to match on ports and Mignis does not complain. Looking at the code, this could be fixed easily.
Yet, let's get to the corner cases of iptables: I could use the modules string
, bpf
, u32
, ... to also match on ports and probably new match extensions might be added with new releases. Mignis also trusts the user not to do those things?
from mignis.
Related Issues (3)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from mignis.