Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 1 | .TH IPTABLES-XML 8 "Jul 16, 2007" "" "" |
| 2 | .\" |
| 3 | .\" Man page written by Sam Liddicott <azez@ufomechanic.net> |
| 4 | .\" It is based on the iptables-save man page. |
| 5 | .\" |
| 6 | .\" This program is free software; you can redistribute it and/or modify |
| 7 | .\" it under the terms of the GNU General Public License as published by |
| 8 | .\" the Free Software Foundation; either version 2 of the License, or |
| 9 | .\" (at your option) any later version. |
| 10 | .\" |
| 11 | .\" This program is distributed in the hope that it will be useful, |
| 12 | .\" but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 14 | .\" GNU General Public License for more details. |
| 15 | .\" |
| 16 | .\" You should have received a copy of the GNU General Public License |
| 17 | .\" along with this program; if not, write to the Free Software |
| 18 | .\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
| 19 | .\" |
| 20 | .\" |
| 21 | .SH NAME |
Jan Engelhardt | 352ccfb | 2009-08-20 17:15:22 +0200 | [diff] [blame] | 22 | iptables-xml \(em Convert iptables-save format to XML |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 23 | .SH SYNOPSIS |
Jan Engelhardt | 352ccfb | 2009-08-20 17:15:22 +0200 | [diff] [blame] | 24 | \fBiptables\-xml\fP [\fB\-c\fP] [\fB\-v\fP] |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 25 | .SH DESCRIPTION |
| 26 | .PP |
| 27 | .B iptables-xml |
| 28 | is used to convert the output of iptables-save into an easily manipulatable |
| 29 | XML format to STDOUT. Use I/O-redirection provided by your shell to write to |
| 30 | a file. |
| 31 | .TP |
| 32 | \fB\-c\fR, \fB\-\-combine\fR |
| 33 | combine consecutive rules with the same matches but different targets. iptables |
| 34 | does not currently support more than one target per match, so this simulates |
| 35 | that by collecting the targets from consecutive iptables rules into one action |
| 36 | tag, but only when the rule matches are identical. Terminating actions like |
| 37 | RETURN, DROP, ACCEPT and QUEUE are not combined with subsequent targets. |
| 38 | .TP |
| 39 | \fB\-v\fR, \fB\-\-verbose\fR |
| 40 | Output xml comments containing the iptables line from which the XML is derived |
| 41 | |
| 42 | .PP |
| 43 | iptables-xml does a mechanistic conversion to a very expressive xml |
Jan Engelhardt | 352ccfb | 2009-08-20 17:15:22 +0200 | [diff] [blame] | 44 | format; the only semantic considerations are for \-g and \-j targets in |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 45 | order to discriminate between <call> <goto> and <nane-of-target> as it |
| 46 | helps xml processing scripts if they can tell the difference between a |
| 47 | target like SNAT and another chain. |
| 48 | |
| 49 | Some sample output is: |
| 50 | |
| 51 | <iptables-rules> |
Filippo Zangheri | 7149688 | 2008-03-06 02:19:26 +0100 | [diff] [blame] | 52 | <table name="mangle"> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 53 | <chain name="PREROUTING" policy="ACCEPT" packet-count="63436" |
Filippo Zangheri | 7149688 | 2008-03-06 02:19:26 +0100 | [diff] [blame] | 54 | byte-count="7137573"> |
| 55 | <rule> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 56 | <conditions> |
Filippo Zangheri | 7149688 | 2008-03-06 02:19:26 +0100 | [diff] [blame] | 57 | <match> |
| 58 | <p>tcp</p> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 59 | </match> |
Filippo Zangheri | 7149688 | 2008-03-06 02:19:26 +0100 | [diff] [blame] | 60 | <tcp> |
| 61 | <sport>8443</sport> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 62 | </tcp> |
| 63 | </conditions> |
| 64 | <actions> |
Filippo Zangheri | 7149688 | 2008-03-06 02:19:26 +0100 | [diff] [blame] | 65 | <call> |
| 66 | <check_ip/> |
Sam Liddicott | 8e52815 | 2007-07-17 17:02:04 +0000 | [diff] [blame] | 67 | </call> |
| 68 | <ACCEPT/> |
| 69 | </actions> |
| 70 | </rule> |
| 71 | </chain> |
| 72 | </table> |
| 73 | </iptables-rules> |
| 74 | |
| 75 | .PP |
| 76 | Conversion from XML to iptables-save format may be done using the |
| 77 | iptables.xslt script and xsltproc, or a custom program using |
| 78 | libxsltproc or similar; in this fashion: |
| 79 | |
| 80 | xsltproc iptables.xslt my-iptables.xml | iptables-restore |
| 81 | |
| 82 | .SH BUGS |
| 83 | None known as of iptables-1.3.7 release |
| 84 | .SH AUTHOR |
| 85 | Sam Liddicott <azez@ufomechanic.net> |
| 86 | .SH SEE ALSO |
Jan Engelhardt | 352ccfb | 2009-08-20 17:15:22 +0200 | [diff] [blame] | 87 | \fBiptables\-save\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8) |