Safety test method and system based on iptables

Abstract

The invention relates to the technical field of safety testing, and discloses a safety testing method and system based on iptables, and the method comprises the steps: obtaining an original rule set of the iptables, and carrying out the analysis of the original rule set to obtain an effective rule set of the iptables; generating a test case for the effective rule set, and testing the performance of the effective rule set by executing the test case to obtain a test result; and evaluating and optimizing the effective rule set of the iptables according to a test result. According to the method, the iptables are used for replacing an enterprise-level hardware firewall with high cost, the safety test cost is reduced, the use difficulty of the iptables is reduced through automatic test and evaluation, the rule set of the iptables is tested and optimized by simulating various attack scenes, the iptables can find more safety holes and error configurations, and the safety protection capacity of the iptables is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security testing, and in particular to a security testing method and system based on iptables. Background Art

[0002] In the era of Internet popularization and informatization, network security issues are attracting more and more attention. As the first line of defense for network security, the importance of firewalls is self-evident. Iptables is a firewall software widely used in Linux systems. It has the characteristics of high efficiency, flexibility, and scalability, and is widely used in network security protection for enterprises and individual users. However, with the continuous upgrading and changes in network attack methods, the configuration and rule set of iptables have become more and more complicated. Since the rule set of iptables is manual and scattered, and there may be a priority order between rules, some rules are covered, making it difficult to perform security tests on each rule, and therefore difficult to manage and maintain in a unified manner, it brings a great workload to administrators, is difficult to use, and has low security protection capabilities. Summary of the invention

[0003] In view of this, the present invention provides a security testing method and system based on iptables to solve the problem that iptables rules are difficult to use and have low security protection capabilities.

[0004] In a first aspect, the present invention provides a security testing method based on iptables, the method comprising:

[0005] Get the original rule set of iptables and analyze it to get the effective rule set of iptables;

[0006] Generate test cases for the effective rule set, and test the performance of the effective rule set by executing the test cases to obtain test results;

[0007] Evaluate and optimize the effective rule set of iptables based on the test results.

[0008] The iptables-based security testing method provided by the present invention utilizes iptables to replace high-cost enterprise-level hardware firewalls, thereby reducing the cost of security testing, reducing the difficulty of using iptables through automatic testing and evaluation, and testing and optimizing the iptables rule set by simulating various attack scenarios, so that iptables can discover more security vulnerabilities and misconfigurations, thereby improving the security protection capability of iptables.

[0009] In an optional implementation, the original rule set of iptables is obtained and analyzed to obtain a valid rule set of iptables, including:

[0010] Obtain the original iptables rule set and the current status information of the host under test by scanning the host under test;

[0011] According to the current status information of the host under test, the original rule set is analyzed and verified according to the preset configuration requirements to obtain the verification result of the original rule set;

[0012] If the verification result does not meet the preset configuration requirements, a verification report is generated, and the original rule set is reconfigured according to the verification report until the verification result of the original rule set meets the preset configuration requirements;

[0013] If the verification result meets the preset configuration requirements, the original rule set is used as the effective rule set of iptables.

[0014] The iptables-based security testing method provided by the present invention analyzes the original rule set of iptables and reconfigures it according to the analysis result, so that the effective rule set meets the preset configuration requirements, avoids basic security loopholes or misconfiguration, and improves the security protection capability of iptables.

[0015] In an optional implementation, the current status information of the host under test includes: the currently applied port or service, Internet Protocol address rules, and communication protocol, and the preset configuration requirements include:

[0016] The open ports or services are all the ports or services currently applied by the tested host, the Internet Protocol addresses are restricted according to the currently applied Internet Protocol address rules, the allowed protocols or ports are all the currently applied protocols or ports, and the configuration operations are performed according to the preset configuration specifications.

[0017] The iptables-based security testing method provided by the present invention determines whether unnecessary ports or services are opened or unnecessary protocols are allowed in the iptables rule set according to the actual application requirements of the tested host, and minimizes the open ports or allowed services on the premise of meeting the actual application requirements, reduces the risk of being attacked, and improves the accuracy and reliability of the iptables configuration.

[0018] In an optional implementation, generating a test case for a valid rule set includes:

[0019] For an open port in a valid rule set, generating a first test case for testing whether the open port is allowed to be connected;

[0020] For an Internet Protocol address that is not restricted in the effective rule set, generating a second test case to test whether the Internet Protocol address that is not restricted is allowed to be connected;

[0021] For the protocols or ports allowed in the effective rule set, a third test case is generated to test whether the allowed protocols or ports are allowed to be connected.

[0022] The iptables-based security testing method provided by the present invention generates test cases for effective rule sets, ensures that all tests of the effective rule sets by the test cases are effective tests, reduces testing time and cost, improves testing efficiency and test coverage, and ensures the performance of the effective rule sets of iptables.

[0023] In an optional implementation, executing the test case to test the valid rule set to obtain a test result includes:

[0024] Send network requests to the host under test to execute test cases. The host under test contains the original rule set of iptables.

[0025] Collect the iptables running logs obtained by the tested host based on the test case, and use the iptables running logs as the test results.

[0026] The iptables-based security testing method provided by the present invention collects the iptables running log of the tested host after sending a network request to the tested host, simulates the response of iptables under various attack scenarios, and uses the iptables running log as the test result, so as to accurately analyze the security performance of iptables.

[0027] In an optional implementation, the original rule set of iptables is evaluated and optimized according to the test results, including:

[0028] Get the configuration data and original rule set of iptables, and compare the test results with the configuration data and original rule set of iptables to generate a visual chart;

[0029] Optimize iptables configuration data and original rule sets based on visual charts.

[0030] The iptables-based security testing method provided by the present invention visually compares the test results with the configuration data and the original rule set of iptables, and optimizes and improves the configuration and rules of iptables, so that iptables can better defend against various attacks and improve the security and reliability of the network.

[0031] In a second aspect, the present invention provides a security testing system based on iptables, the system comprising:

[0032] The rule analysis module is used to obtain the original rule set of iptables and analyze it to obtain the effective rule set of iptables;

[0033] A rule testing module is used to generate test cases for a valid rule set, and to test the performance of the valid rule set by executing the test cases to obtain test results;

[0034] The result analysis module is used to evaluate and optimize the effective rule set of iptables based on the test results.

[0035] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0036] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0037] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 It is a flowchart of a security testing method based on iptables according to an embodiment of the present invention;

[0040] Figure 2 is a structural schematic diagram of a test environment in a security testing method based on iptables according to an embodiment of the present invention;

[0041] Figure 3 is a flow chart of another iptables-based security testing method according to an embodiment of the present invention;

[0042] Figure 4 is a structural block diagram of a security testing system based on iptables according to an embodiment of the present invention;

[0043] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0045] The embodiment of the present invention provides a security testing method based on iptables, which reduces the difficulty of using iptables and improves network security and management efficiency by utilizing iptables for automatic testing and evaluation.

[0046] Iptables is a packet filtering firewall under the Linux platform. It is open source and comes with the kernel. It can replace the more expensive enterprise-level hardware firewall and is used to operate the netfilter subsystem in the kernel space in the user space. The embodiment of the present invention can be integrated with existing network security protection measures to expand its functions and coverage. By automatically detecting and discovering security issues in iptables configuration and rule sets, it can effectively solve the security risks and difficulties in the use of iptables and improve the security and reliability of the network.

[0047] According to an embodiment of the present invention, an embodiment of a security testing method based on iptables is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0048] In this embodiment, a security testing method based on iptables is provided, which can be used for the above-mentioned computer system. Figure 1 : is a flow chart of a security testing method based on iptables according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0049] Step S101, obtaining the original rule set of iptables, and analyzing it to obtain the effective rule set of iptables.

[0050] Specifically, network security testing is usually implemented based on the test environment, such as Figure 2 As shown, the test environment mainly includes the host under test, the test deployment host and the network between the two hosts. The types of the host under test and the test deployment host can be virtual machines, physical machines, and cloud hosts, which are examples only, but not limited to this. The test deployment host can simulate the network environment and various attack scenarios. The iptables firewall is deployed on the host under test. When performing security testing, the test deployment host executes test cases by sending network requests to the tested data. The test cases are various simulated attack behaviors. Security testing is achieved by detecting the results after the host under test is attacked by the test case.

[0051] In this embodiment, Figure 2 As shown, the test deployment host includes: a data layer, a processing layer and an application layer, wherein the data layer includes a rule set analysis module, a test case generation module, etc., which are used for storing and acquiring data, including test data, logs and statistical data, etc.; the processing layer includes a test execution module, which is used to process and analyze the data in the data layer, such as verifying and processing the iptables rule set; the application layer includes a test result evaluation module, which is used to generate visual charts from the processed data and present them to the user.

[0052] The test deployment host actively obtains the original rule set of iptables, and automatically verifies and processes the original rule set to make the relationship between the iptables rules clearer and avoid the existence of overwritten rules. Use third-party tools (such as network scanning and sniffing toolkits, Network Mapper, Nmap) to scan the rule loopholes of the cloud host iptables, and cooperate with custom Python scripts to execute iptables commands through the subprocess module to obtain its output, and then decode and split the output to obtain the iptables rule list as the original rule set, and find possible security vulnerabilities and misconfigurations. After eliminating possible security vulnerabilities and misconfigurations, a valid rule set is obtained.

[0053] Step S102: Generate a test case for the valid rule set, and test the performance of the valid rule set by executing the test case to obtain a test result.

[0054] Specifically, for the effective rule set, the test deployment host uses the test case generation module to generate test cases covering normal scenarios and abnormal scenarios. The test cases include various network traffic and attack behaviors, such as port scanning, denial of service attacks, etc. For the test case, the test deployment host sends a network request with the test case to the host under test, and collects the corresponding iptables running log after the host under test receives the network request as the test result.

[0055] Step S103, evaluating and optimizing the effective rule set of iptables according to the test results.

[0056] Specifically, for the collected iptables operation logs, the process name, transmission protocol type, source IP:port, destination IP:port and other information are extracted, and the performance and security of the effective rule set of iptables are analyzed and evaluated based on the extracted information, including but not limited to checking whether the traffic of a certain IP address is allowed, checking whether the traffic of a certain port is allowed, etc. After the evaluation, the iptables rules can be reconfigured according to the evaluation results to improve the security rules of the iptables firewall and enhance the protection capabilities of iptables.

[0057] The iptables-based security testing method provided in this embodiment uses iptables to replace high-cost enterprise-level hardware firewalls, thereby reducing the cost of security testing. The difficulty of using iptables is reduced through automatic testing and evaluation. The iptables rule set is tested and optimized by simulating various attack scenarios, so that iptables can discover more security vulnerabilities and misconfigurations, thereby improving the security protection capability of iptables.

[0058] In this embodiment, a security testing method based on iptables is provided, which can be used for the above-mentioned computer system. Figure 3 : is a flow chart of a security testing method based on iptables according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0059] Step S201, obtaining the original rule set of iptables, and analyzing it to obtain the effective rule set of iptables.

[0060] Specifically, the above step S201 includes:

[0061] Step S2011, obtaining the original rule set of iptables and the current status information of the host under test by scanning the host under test.

[0062] Specifically, the rule set analysis module in the test deployment host scans the host under test, reads the iptables rule file through the iptables-save>iptables.rules command, and obtains the original rule set of iptables after parsing the rule file. The current status information of the host under test includes, but is not limited to: the ports or services that must be opened when the host under test performs normal network communication or other normal operations, etc., which are only used as examples, but not limited to this.

[0063] Step S2012: Analyze and verify the original rule set according to the current state information of the host under test and the preset configuration requirements to obtain a verification result of the original rule set.

[0064] Specifically, according to the current status information of the host under test, determine the requirements for the normal operation of the host under test, such as ports or services that must be opened. Analyze and verify the original rule set according to the preset configuration requirements, and check whether the original rule set has the following problems:

[0065] (1) Open ports or services: Check whether unnecessary ports or services of the host under test are opened in the original rule set;

[0066] (2) Unrestricted source IP or destination IP: Check whether there are rules in the original rule set that do not restrict the source IP or destination IP. These rules may allow any external IP to access the tested host.

[0067] (3) Allowed protocols or ports: Check whether unnecessary protocols or ports are allowed in the original rule set, such as Internet Control Message Protocol (ICMP) and Secure Shell (SSH), for example but not limited to these.

[0068] (4) Incorrect configuration: Check whether there are incorrect configurations in the original rule set, such as duplicate rules, unexecutable rules, rules with grammatical errors, etc., to ensure the validity of the rules.

[0069] Step S2013: If the verification result does not meet the preset configuration requirements, a verification report is generated, and the original rule set is reconfigured according to the verification report until the verification result of the original rule set meets the preset configuration requirements.

[0070] Step S2014: If the verification result meets the preset configuration requirements, the original rule set is used as the effective rule set of iptables.

[0071] Specifically, if the original rule set of iptables does not meet the preset configuration requirements, a verification report is generated. The verification report can be an error file that contains problems, security vulnerabilities, and incorrect configurations in the original rule set. The original rule set is reconfigured according to the verification report and verified again until the original rule set meets the preset configuration requirements. The original rule set that meets the preset configuration requirements is used as the valid rule set.

[0072] The iptables-based security testing method provided in this embodiment analyzes the original rule set of iptables and reconfigures it according to the analysis results, so that the effective rule set meets the preset configuration requirements, avoids basic security vulnerabilities or misconfigurations, and improves the security protection capability of iptables.

[0073] In some optional implementations, the current status information of the host under test includes: currently applied ports or services, Internet Protocol address rules, and communication protocols. According to the security test requirements and the iptables rule set, the current status information of the host under test can be customized to understand the operation requirements of the host under test. When determining the configuration and rules of iptables, the ports or services that can be opened in the preset configuration requirements are determined according to the current state of the host under test. This is only an example, but not limited to this.

[0074] The preset configuration requirements include: the open ports or services are the ports or services currently applied by the host under test, the Internet Protocol addresses are restricted according to the currently applied Internet Protocol address rules, the allowed protocols or ports are the currently applied protocols or ports, and the configuration operations are performed according to the preset configuration specifications.

[0075] Specifically, if the ports currently used by the host under test are: A, B, C, then in the preset configuration requirements, the ports opened in the iptables rule set can only be A, B, C. If the ports opened in the iptables rule set are A, B, C, D, it means that unnecessary ports are opened in the iptables rule set and the preset configuration requirements are not met. This is only an example, but not limited to this.

[0076] The iptables-based security testing method provided in this embodiment determines whether there are unnecessary ports or services opened or unnecessary protocols allowed in the iptables rule set according to the actual application requirements of the host under test. On the premise of meeting the actual application requirements, the open ports or allowed services are minimized to reduce the risk of attack and improve the accuracy and reliability of the iptables configuration.

[0077] Step S202: Generate a test case for the valid rule set, and test the performance of the valid rule set by executing the test case to obtain a test result.

[0078] Specifically, the above step S202 includes:

[0079] Step S2021: for an open port in the effective rule set, generate a first test case to test whether the open port is allowed to be connected.

[0080] Specifically, the test cases include some basic iptables test cases. For open ports, the test process of the first test case is: access the open port in the tested host from the outside to observe whether it can successfully connect to the open port.

[0081] Step S2022: For an Internet Protocol address that is not restricted in the effective rule set, generate a second test case to test whether the Internet Protocol address that is not restricted is allowed to be connected.

[0082] Specifically, for an unrestricted source IP or target IP, the test process of the second test case is: access the tested host from an external IP to observe whether the connection access can be successfully achieved.

[0083] Step S2023: For the protocols or ports allowed in the effective rule set, generate a third test case to test whether the allowed protocols or ports are allowed to be connected.

[0084] Specifically, for the protocols or ports that are allowed, the test process of the third test case is: use the allowed protocols and ports to access the host under test and observe whether a successful connection can be made.

[0085] Step S2024, sending a network request to the host under test to execute the test case, where the host under test contains the original rule set of iptables.

[0086] Specifically, the test deployment host uses the network tool hping to simulate the ICMP, TCP, and UDP protocols to send network requests to the host under test. The network requests contain test cases, and the host under test contains the original rule set of iptables. The test is completed by observing the response of the original rule set of iptables to the test cases.

[0087] Step S2025, collecting the iptables running log obtained by the tested host based on the test case, and the iptables running log is used as the test result.

[0088] Specifically, after the test case is executed, the iptables log is collected and recorded, for example: May 1000:00:10 silence kernel:[82093.478533] iptables: IN = wlp6s0 OUT = MAC = 00:26:c6:54:89:be:ec:0e:c4:3e:e3:e9:08:00 SRC = 192.168.0.1 DST = 192.168.0.2 LEN = 44 TOS = 0x00 PREC = 0x00 TTL = 64 ID = 23082 PROTO = UDP SPT = 57747 DPT = 8082 LEN = 24, which is only an example, but not limited to this.

[0089] After executing multiple test cases, iptables operation logs are obtained respectively. The iptables operation logs can be sorted according to the test cases to form test results in the form of tables, etc. This is only an example, but not limited to this.

[0090] The iptables-based security testing method provided in this embodiment generates test cases for effective rule sets, ensures that the tests of the effective rule sets by the test cases are all effective tests, reduces test time and cost, improves test efficiency and test coverage, and ensures the performance of the effective rule sets of iptables. After sending a network request to the tested host, the iptables running log of the tested host is collected, the response of iptables under various attack scenarios is simulated, and the iptables running log is used as the test result, so as to accurately analyze the security performance of iptables.

[0091] Step S203, evaluating and optimizing the effective rule set of iptables according to the test results.

[0092] Specifically, the above step S203 includes:

[0093] Step S2031, obtain the configuration data and original rule set of iptables, and compare the test result with the configuration data and original rule set of iptables to generate a visual chart.

[0094] Specifically, the collected iptables logs are used to extract information such as process name, transmission protocol type, source IP:port, and target IP:port, and then compared with the iptables configuration data and the original rule set. The iptables logs are read through the dmesg program, and the test results are judged to be consistent with the iptables rule configuration based on the matching conditions in the logs, such as IP address, port, protocol, chain name, and the "ACCEPT" status of the data packet. Visual charts are generated and displayed to users, and the corresponding test conclusions are marked.

[0095] Step S2032, optimizing the configuration data and original rule set of iptables according to the visualization chart.

[0096] Specifically, according to the visualization chart and the corresponding test conclusion, the configuration data of iptables and the deficiencies in the original rule set are determined. If there are rule loopholes, the rule loophole list of iptables is listed and optimized in a targeted manner. The rule loopholes here can be rule loopholes that do not meet the preset configuration requirements in step S2014, or can be places where the rule set of iptables can be improved, which is only used as an example, but not limited to this.

[0097] The iptables-based security testing method provided in this embodiment visually compares the test results with the iptables configuration data and the original rule set, and optimizes and improves the iptables configuration and rules, so that iptables can better defend against various attacks and improve the security and reliability of the network.

[0098] In the present embodiment, a security testing system based on iptables is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0099] This embodiment provides a security testing system based on iptables. Figure 4 As shown, including:

[0100] The rule analysis module 401 is used to obtain the original rule set of iptables and analyze it to obtain the effective rule set of iptables.

[0101] The rule testing module 402 is used to generate test cases for the effective rule set, and test the performance of the effective rule set by executing the test cases to obtain test results.

[0102] The result analysis module 403 is used to evaluate and optimize the effective rule set of iptables according to the test results.

[0103] In some optional implementations, the rule analysis module 401 includes:

[0104] The original rule set acquisition unit is used to acquire the original rule set of iptables and the current status information of the host under test by scanning the host under test.

[0105] The rule verification unit is used to analyze and verify the original rule set according to the current state information of the host under test and the preset configuration requirements to obtain the verification result of the original rule set.

[0106] The rule configuration updating unit is used to generate a verification report if the verification result does not meet the preset configuration requirements, and reconfigure the original rule set according to the verification report until the verification result of the original rule set meets the preset configuration requirements.

[0107] The effective rule determination unit is used to use the original rule set as the effective rule set of iptables if the verification result meets the preset configuration requirements.

[0108] In some optional implementations, the rule testing module 402 includes:

[0109] The first test case generating unit is used to generate a first test case for an open port in a valid rule set to test whether the open port is allowed to be connected.

[0110] The second test case generating unit is used to generate a second test case for testing whether the unrestricted Internet Protocol address is allowed to be connected, with respect to the unrestricted Internet Protocol address in the effective rule set.

[0111] The third test case generating unit is used to generate a third test case for testing whether the allowed protocol or port is allowed to be connected, with respect to the allowed protocol or port in the effective rule set.

[0112] The test case execution unit is used to send a network request to the host under test to execute the test case, and the host under test contains the original rule set of iptables.

[0113] The test result collection unit is used to collect the iptables running logs obtained by the tested host based on the test case, and the iptables running logs are used as the test results.

[0114] In some optional implementations, the result analysis module 403 includes:

[0115] The rule evaluation unit is used to obtain the configuration data and original rule set of iptables, and compare the test results with the configuration data and original rule set of iptables to generate a visual chart.

[0116] The rule optimization unit is used to optimize the iptables configuration data and original rule set based on visual charts.

[0117] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0118] The iptables-based security testing system in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0119] The embodiment of the present invention also provides a computer device having the above Figure 4 The iptables-based security testing system shown.

[0120] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0121] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0122] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0123] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0125] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0126] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0127] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0128] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A security testing method based on iptables, characterized in that: The method comprises: Get the original rule set of iptables and analyze it to get the effective rule set of iptables; Generate a test case for the effective rule set, and execute the test case to test the effective rule set to obtain a test result; The effective rule set of the iptables is evaluated and optimized according to the test results.

2. The method according to claim 1, characterized in that: Get the original rule set of iptables and analyze it to get the effective rule set of iptables, including: Obtain the original iptables rule set and the current status information of the host under test by scanning the host under test; According to the current state information of the host under test, the original rule set is analyzed and verified according to the preset configuration requirements to obtain a verification result of the original rule set; If the verification result does not meet the preset configuration requirements, a verification report is generated, and the original rule set is reconfigured according to the verification report until the verification result of the original rule set meets the preset configuration requirements; If the verification result meets the preset configuration requirements, the original rule set is used as the effective rule set of iptables.

3. The method according to claim 2, characterized in that The current status information of the host under test includes: the currently applied port or service, Internet Protocol address rules, and communication protocol. The preset configuration requirements include: The open ports or services are all the ports or services currently applied by the host under test, the Internet Protocol addresses are restricted according to the Internet Protocol address rules currently applied, the allowed protocols or ports are all the protocols or ports currently applied, and the configuration operations are performed according to the preset configuration specifications.

4. The method according to claim 3, characterized in that: The generating of test cases for the effective rule set comprises: For an open port in a valid rule set, generating a first test case for testing whether the open port is allowed to be connected; For an Internet Protocol address that is not restricted in the effective rule set, generating a second test case to test whether the Internet Protocol address that is not restricted is allowed to be connected; For the protocols or ports allowed in the effective rule set, a third test case is generated to test whether the allowed protocols or ports are allowed to be connected.

5. The method according to claim 1, characterized in that Executing the test case to test the effective rule set and obtaining a test result includes: Sending a network request to a host under test to execute the test case, wherein the host under test includes the original rule set of iptables; Collect the iptables running log obtained by the tested host based on the test case, and use the iptables running log as the test result.

6. The method according to claim 1, characterized in that The original rule set of the iptables is evaluated and optimized according to the test results, including: Obtaining configuration data and an original rule set of iptables, and comparing the test result with the configuration data and the original rule set of iptables to obtain a visual chart; According to the visualization chart, the configuration data and the original rule set of the iptables are optimized.

7. A security testing system based on iptables, characterized in that: The system comprises: The rule analysis module is used to obtain the original rule set of iptables and analyze it to obtain the effective rule set of iptables; A rule testing module, used to generate a test case for the effective rule set, and execute the test case to test the effective rule set to obtain a test result; The result analysis module is used to evaluate and optimize the effective rule set of the iptables according to the test results.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method according to any one of claims 1 to 6.

Images