Amin Azez | 8d3eccb | 2006-11-13 20:23:36 +0000 | [diff] [blame] | 1 | <?xml version="1.0" encoding="ISO-8859-1"?> |
| 2 | <!-- Converts from simple xml iptables format to iptables-save format |
| 3 | Copyright 2006 UfoMechanic |
| 4 | Author: azez@ufomechanic.net |
| 5 | This code is distributed and licensed under the terms of GNU GPL v2 |
| 6 | |
| 7 | This sample usage outputs roughly want goes in |
| 8 | iptables-save | iptables-xml -c | xsltproc iptables.xslt - |
| 9 | --> |
| 10 | <xsl:transform version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> |
| 11 | <xsl:output method = "text" /> |
| 12 | <xsl:strip-space elements="*" /> |
| 13 | |
| 14 | <!-- output conditions of a rule but not an action --> |
| 15 | <xsl:template match="iptables-rules/table/chain/rule/conditions/*"> |
| 16 | <!-- <match> is the psuedo module when a match module doesn't need to be loaded |
| 17 | and when -m does not need to be inserted --> |
| 18 | <xsl:if test="name() != 'match'"> |
| 19 | <xsl:text> -m </xsl:text><xsl:value-of select="name()"/> |
| 20 | </xsl:if> |
| 21 | <xsl:apply-templates select="node()"/> |
| 22 | </xsl:template> |
| 23 | |
| 24 | <!-- delete the actions or conditions containers, and process child nodes --> |
| 25 | <xsl:template match="iptables-rules/table/chain/rule/actions|table/chain/rule/conditions"> |
| 26 | <xsl:apply-templates select="*"/> |
| 27 | </xsl:template> |
| 28 | |
| 29 | <xsl:template match="iptables-rules/table/chain/rule/actions/goto"> |
| 30 | <xsl:text> -g </xsl:text> |
| 31 | <xsl:apply-templates select="*"/> |
| 32 | <xsl:text>
</xsl:text> |
| 33 | </xsl:template> |
| 34 | <xsl:template match="iptables-rules/table/chain/rule/actions/call"> |
| 35 | <xsl:text> -j </xsl:text> |
| 36 | <xsl:apply-templates select="*"/> |
| 37 | <xsl:text>
</xsl:text> |
| 38 | </xsl:template> |
| 39 | <!-- all other actions are module actions --> |
| 40 | <xsl:template match="iptables-rules/table/chain/rule/actions/*"> |
| 41 | <xsl:text> -j </xsl:text><xsl:value-of select="name()"/> |
| 42 | <xsl:apply-templates select="*"/> |
| 43 | <xsl:text>
</xsl:text> |
| 44 | </xsl:template> |
| 45 | |
| 46 | <!-- all child action nodes --> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 47 | <xsl:template match="iptables-rules/table/chain/rule/actions//*|iptables-rules/table/chain/rule/conditions//*" priority="0"> |
Amin Azez | 8d3eccb | 2006-11-13 20:23:36 +0000 | [diff] [blame] | 48 | <xsl:if test="@invert=1"><xsl:text> !</xsl:text></xsl:if> |
| 49 | <xsl:text> -</xsl:text> |
| 50 | <!-- if length of name is 1 character, then only do 1 - not 2 --> |
| 51 | <xsl:if test="string-length(name())>1"> |
| 52 | <xsl:text>-</xsl:text> |
| 53 | </xsl:if> |
| 54 | <xsl:value-of select="name()"/> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 55 | <xsl:text> </xsl:text> |
| 56 | <xsl:apply-templates select="node()"/> |
Amin Azez | 8d3eccb | 2006-11-13 20:23:36 +0000 | [diff] [blame] | 57 | </xsl:template> |
| 58 | |
| 59 | <xsl:template match="iptables-rules/table/chain/rule/actions/call/*|iptables-rules/table/chain/rule/actions/goto/*"> |
| 60 | <xsl:value-of select="name()"/> |
| 61 | <!-- I bet there are no child nodes, should we risk it? --> |
| 62 | <xsl:apply-templates select="node()"/> |
| 63 | </xsl:template> |
| 64 | |
| 65 | <!-- output the head of the rule, and any conditions --> |
| 66 | <xsl:template name="rule-head"> |
| 67 | <xsl:if test="string-length(@packet-count)+string-length(@byte-count)"> |
| 68 | <xsl:call-template name="counters"><xsl:with-param name="node" select="."/></xsl:call-template> |
| 69 | <xsl:text> </xsl:text> |
| 70 | </xsl:if> |
| 71 | <xsl:text>-A </xsl:text><!-- a rule must be under a chain --> |
| 72 | <xsl:value-of select="../@name" /> |
| 73 | <xsl:apply-templates select="conditions"/> |
| 74 | </xsl:template> |
| 75 | |
| 76 | <!-- Output a single rule, perhaps as multiple rules if we have more than one action --> |
| 77 | <xsl:template match="iptables-rules/table/chain/rule"> |
| 78 | <xsl:choose> |
| 79 | <xsl:when test="count(actions/*)>0"> |
| 80 | <xsl:for-each select="actions/*"> |
| 81 | <!-- and a for-each to re-select the rule as the current node, to write the rule-head --> |
| 82 | <xsl:for-each select="../.."> |
| 83 | <xsl:call-template name="rule-head"/> |
| 84 | </xsl:for-each> |
| 85 | <!-- now write the this action --> |
| 86 | <xsl:apply-templates select="."/> |
| 87 | </xsl:for-each> |
| 88 | </xsl:when> |
| 89 | <xsl:otherwise> |
| 90 | <!-- no need to loop if there are no actions, just output conditions --> |
| 91 | <xsl:call-template name="rule-head"/> |
| 92 | <xsl:text>
</xsl:text> |
| 93 | </xsl:otherwise> |
| 94 | </xsl:choose> |
| 95 | </xsl:template> |
| 96 | |
| 97 | <xsl:template match="iptables-rules/table"> |
| 98 | <xsl:text># Generated by iptables.xslt
</xsl:text> |
| 99 | <xsl:text>*</xsl:text><xsl:value-of select="@name"/><xsl:text>
</xsl:text> |
| 100 | <!-- Loop through each chain and output the chain header --> |
| 101 | <xsl:for-each select="chain"> |
| 102 | <xsl:text>:</xsl:text> |
| 103 | <xsl:value-of select="@name"/> |
| 104 | <xsl:text> </xsl:text> |
| 105 | <xsl:choose> |
| 106 | <xsl:when test="not(string-length(@policy))"><xsl:text>-</xsl:text></xsl:when> |
| 107 | <xsl:otherwise><xsl:value-of select="@policy"/></xsl:otherwise> |
| 108 | </xsl:choose> |
| 109 | <xsl:text> </xsl:text> |
| 110 | <xsl:call-template name="counters"><xsl:with-param name="node" select="."/></xsl:call-template> |
| 111 | <xsl:text>
</xsl:text> |
| 112 | </xsl:for-each> |
| 113 | <!-- Loop through each chain and output the rules --> |
| 114 | <xsl:apply-templates select="node()"/> |
| 115 | <xsl:text>COMMIT
# Completed
</xsl:text> |
| 116 | </xsl:template> |
| 117 | |
| 118 | <xsl:template name="counters"> |
Dan Nicholson | be95d14 | 2007-08-06 10:01:45 +0000 | [diff] [blame] | 119 | <xsl:param name="node"/> |
Amin Azez | 8d3eccb | 2006-11-13 20:23:36 +0000 | [diff] [blame] | 120 | <xsl:text>[</xsl:text> |
| 121 | <xsl:if test="string-length($node/@packet-count)"><xsl:value-of select="$node/@packet-count"/></xsl:if> |
| 122 | <xsl:if test="string-length($node/@packet-count)=0">0</xsl:if> |
| 123 | <xsl:text>:</xsl:text> |
| 124 | <xsl:if test="string-length($node/@byte-count)"><xsl:value-of select="$node/@byte-count"/></xsl:if> |
| 125 | <xsl:if test="string-length($node/@byte-count)=0">0</xsl:if> |
| 126 | <xsl:text>]</xsl:text> |
| 127 | </xsl:template> |
| 128 | |
| 129 | <!-- the bit that automatically recurses for us, NOTE: we use * not node(), we don't want to copy every white space text --> |
| 130 | <xsl:template match="@*|node()"> |
| 131 | <xsl:copy> |
| 132 | <!-- with libxslt xsltproc we can't do @*|node() or the nodes may get processed before the attributes --> |
| 133 | <xsl:apply-templates select="@*"/> |
| 134 | <xsl:apply-templates select="node()"/> |
| 135 | </xsl:copy> |
| 136 | </xsl:template> |
| 137 | |
| 138 | </xsl:transform> |