Discussion:
[PATCH] Drop iptables-save comments and chain counters from iptables inventory.
Jan-Frode Myklebust
2011-06-05 20:45:58 UTC
Permalink
---
func/minion/modules/iptables/__init__.py | 15 ++++++++++++++-
1 files changed, 14 insertions(+), 1 deletions(-)

diff --git a/func/minion/modules/iptables/__init__.py b/func/minion/modules/iptables/__init__.py
index db11a23..ccc7645 100644
--- a/func/minion/modules/iptables/__init__.py
+++ b/func/minion/modules/iptables/__init__.py
@@ -12,6 +12,7 @@
# our modules
from func.minion.modules import func_module
from func.minion.modules.iptables.common import *
+import re

IPTABLES_SAVE_FILE = "/etc/sysconfig/iptables"

@@ -111,7 +112,19 @@ class Iptables(func_module.FuncModule):
return call_if_policy("INPUT", "DROP", "-I OUTPUT -d %s -j ACCEPT" % ip)

def inventory(self):
- return self.dump()
+ raw = self.dump()
+ output = ""
+ for line in raw.splitlines():
+ # Drop commentlines:
+ if re.search("^#", line):
+ continue
+ # Null chain counters:
+ if re.search("^:.*$", line):
+ nulled = re.sub('(^:.*)\[\d*:\d*\](.*$)', r'\1[0:0]\2', line)
+ output = output + nulled + "\n"
+ continue
+ output = output + line + "\n"
+ return output

def dump(self, counters=False):
"""
--
1.7.1
seth vidal
2011-06-06 15:59:21 UTC
Permalink
Post by Jan-Frode Myklebust
---
func/minion/modules/iptables/__init__.py | 15 ++++++++++++++-
1 files changed, 14 insertions(+), 1 deletions(-)
diff --git a/func/minion/modules/iptables/__init__.py b/func/minion/modules/iptables/__init__.py
index db11a23..ccc7645 100644
--- a/func/minion/modules/iptables/__init__.py
+++ b/func/minion/modules/iptables/__init__.py
@@ -12,6 +12,7 @@
# our modules
from func.minion.modules import func_module
from func.minion.modules.iptables.common import *
+import re
IPTABLES_SAVE_FILE = "/etc/sysconfig/iptables"
return call_if_policy("INPUT", "DROP", "-I OUTPUT -d %s -j ACCEPT" % ip)
iptables-save has -c option and it appears it is defaulting to on your
system?

take a look at the man page:
-c, --counters
include the current values of all packet and byte counters in
the output


b/c it seems to be behaving on mine.
-sv
Jan-Frode Myklebust
2011-06-06 21:35:39 UTC
Permalink
Post by seth vidal
iptables-save has -c option and it appears it is defaulting to on your
system?
-c, --counters
include the current values of all packet and byte counters in
the output
"iptables-save -c" gives me per rule counters as in:

[21:1260] -A RH-Firewall-1-INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

this is not defaulting to on. The problem I have is that iptables-save
(without -c) gives me the chain counters:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7568359:2744381371]
:RH-Firewall-1-INPUT - [0:0]

and OUTPUT ACCEPT is always changing. Also it gives the
timestamps in commented out lines, which also is noise for
func-inventory. So every host is daily adding something like
the following:

-# Generated by iptables-save v1.3.5 on Fri Jun 3 14:57:06 2011
+# Generated by iptables-save v1.3.5 on Fri Jun 3 15:08:54 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [26377:4434694]
+:OUTPUT ACCEPT [29222:4961577]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
@@ -22,4 +22,4 @@
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "FIREWALL: " --log-level 6
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
-# Completed on Fri Jun 3 14:57:06 2011
+# Completed on Fri Jun 3 15:08:54 2011
Post by seth vidal
b/c it seems to be behaving on mine.
You're not seeing these timestamps or counters ?


-jf
seth vidal
2011-06-06 21:53:18 UTC
Permalink
Post by Jan-Frode Myklebust
Post by seth vidal
iptables-save has -c option and it appears it is defaulting to on your
system?
-c, --counters
include the current values of all packet and byte counters in
the output
[21:1260] -A RH-Firewall-1-INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
this is not defaulting to on. The problem I have is that iptables-save
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7568359:2744381371]
:RH-Firewall-1-INPUT - [0:0]
and OUTPUT ACCEPT is always changing. Also it gives the
timestamps in commented out lines, which also is noise for
func-inventory. So every host is daily adding something like
-# Generated by iptables-save v1.3.5 on Fri Jun 3 14:57:06 2011
+# Generated by iptables-save v1.3.5 on Fri Jun 3 15:08:54 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [26377:4434694]
+:OUTPUT ACCEPT [29222:4961577]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
@@ -22,4 +22,4 @@
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "FIREWALL: " --log-level 6
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
-# Completed on Fri Jun 3 14:57:06 2011
+# Completed on Fri Jun 3 15:08:54 2011
Post by seth vidal
b/c it seems to be behaving on mine.
You're not seeing these timestamps or counters ?
I see the timestamps - I have no problem with that part of your patch.

I don't see the counters.

-sv
Jan-Frode Myklebust
2011-06-06 22:09:12 UTC
Permalink
Post by seth vidal
Post by Jan-Frode Myklebust
Post by seth vidal
b/c it seems to be behaving on mine.
You're not seeing these timestamps or counters ?
I see the timestamps - I have no problem with that part of your patch.
I don't see the counters.
Strange.. anybody else on this list care to chime in? Is it really just
me? AFAIK we're running with quite standard RHEL5/6 iptables configs..

RHEL5:
----------------------------------------------
# /sbin/iptables-save
# Generated by iptables-save v1.3.5 on Tue Jun 7 00:04:37 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7617151:2762434660]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jun 7 00:04:37 2011
# grep -v ^# /etc/sysconfig/iptables-config |grep -v ^$
IPTABLES_MODULES="ip_conntrack_netbios_ns"
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"
----------------------------------------------

RHEL6
----------------------------------------------
# iptables-save
# Generated by iptables-save v1.4.7 on Tue Jun 7 00:03:26 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [573260:64263533]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.11.0/24 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jun 7 00:03:26 2011
# grep -v ^# /etc/sysconfig/iptables-config |grep -v ^$
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"
----------------------------------------------


-jf
Greg Swift
2011-06-06 22:16:59 UTC
Permalink
Post by Jan-Frode Myklebust
Post by seth vidal
Post by Jan-Frode Myklebust
Post by seth vidal
b/c it seems to be behaving on mine.
You're not seeing these timestamps or counters ?
I see the timestamps - I have no problem with that part of your patch.
I don't see the counters.
Strange.. anybody else on this list care to chime in? Is it really just
me? AFAIK we're running with quite standard RHEL5/6 iptables configs..
----------------------------------------------
# /sbin/iptables-save
# Generated by iptables-save v1.3.5 on Tue Jun  7 00:04:37 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7617151:2762434660]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jun  7 00:04:37 2011
# grep -v ^# /etc/sysconfig/iptables-config |grep -v ^$
IPTABLES_MODULES="ip_conntrack_netbios_ns"
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"
----------------------------------------------
RHEL6
----------------------------------------------
# iptables-save
# Generated by iptables-save v1.4.7 on Tue Jun  7 00:03:26 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [573260:64263533]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.11.0/24 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jun  7 00:03:26 2011
# grep -v ^# /etc/sysconfig/iptables-config |grep -v ^$
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"
----------------------------------------------
  -jf
I see the same output to 'iptables-save' as jf posted above.

If I add the -c to the command I see counters prefixed on each line.

[***@lordsi ~]# iptables-save
# Generated by iptables-save v1.3.5 on Mon Jun 6 22:14:33 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [266442075:53123504585]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport
51234 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport
51235 -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Jun 6 22:14:33 2011

[***@lordsi ~]# iptables-save -c
# Generated by iptables-save v1.3.5 on Mon Jun 6 22:14:31 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [266441955:53123478462]
:RH-Firewall-1-INPUT - [0:0]
[236254897:51756787195] -A INPUT -j RH-Firewall-1-INPUT
[0:0] -A FORWARD -j RH-Firewall-1-INPUT
[6527402:391644394] -A RH-Firewall-1-INPUT -p tcp -m state --state NEW
-m tcp --dport 51234 -j ACCEPT
[933:55832] -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp
--dport 51235 -j ACCEPT
[15447:4314379] -A RH-Firewall-1-INPUT -i lo -j ACCEPT
[85529624:4880963213] -A RH-Firewall-1-INPUT -p icmp -m icmp
--icmp-type any -j ACCEPT
[0:0] -A RH-Firewall-1-INPUT -p esp -j ACCEPT
[0:0] -A RH-Firewall-1-INPUT -p ah -j ACCEPT
[0:0] -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
[0:0] -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
[0:0] -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
[144084633:46465883253] -A RH-Firewall-1-INPUT -m state --state
RELATED,ESTABLISHED -j ACCEPT
[70:5128] -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp
--dport 22 -j ACCEPT
[96788:13920996] -A RH-Firewall-1-INPUT -j REJECT --reject-with
icmp-host-prohibited
COMMIT
# Completed on Mon Jun 6 22:14:31 2011

Loading...