Iptables rule generation system and method based on configuration files

Abstract

This invention relates to the field of Linux packet filtering technology, and provides an iptables rule generation system and method based on configuration files. The web-based configuration system structurally models configuration tables, configuration chains, matching conditions, and processing actions to generate configuration files. The iptables rule generation system monitors changes to the configuration files and performs format verification, parsing, and validity checks. If the checks pass, it generates a set of iptables rule commands and executes them one by one. If execution fails, it stops subsequent execution and retracts already executed rules, improving rule configuration efficiency and deployment reliability.

Description

Technical Field

[0001] This invention relates to the next-generation information network industry, the Internet and cloud computing, big data services, as well as Internet data services, cloud computing software, and cloud-integrated application operation support platform software. In particular, it relates to the field of packet filtering and access control technology of Linux operating system, and specifically to a system and method for automatically generating and executing iptables rules based on configuration files. Background Technology

[0002] iptables is a tool in the Linux operating system used to configure packet filtering and forwarding control. It typically requires setting multiple iptables rules in different tables and chains to match packets based on source address, destination address, protocol type, port, and network interface direction, and to execute corresponding actions upon a match. In real-world network security and operations scenarios, iptables rules often cover multiple iptables rule configuration tables and involve multiple iptables rule configuration chains. There are strict constraints between iptables rule configuration tables and chains, and the parameters of different matching conditions and extended matching modules also require consistent formats. With changes in business and network environments, the frequency of iptables rule configuration file changes increases. Manually maintaining iptables rules via commands can easily lead to problems such as mismatches between iptables rule configuration tables and chains, invalid values ​​for iptables rule matching parameters, or inappropriate selection of iptables rule actions, resulting in iptables rule execution failures or policy ineffectiveness.

[0003] At the same time, iptables rule changes usually need to take effect quickly and remain controllable. If there is a lack of format validity and legality checks before iptables rules are generated, as well as a failure rollback mechanism during iptables rule execution, misconfigurations may enter the kernel network processing link and cause unpredictable operational risks.

[0004] Therefore, a technical solution is needed that can automatically generate and controllably execute iptables rules based on configuration files.

[0005] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The technical problem that this invention aims to solve is that the existing iptables rule maintenance methods rely on manual command writing and are difficult to form a structured iptables rule configuration model. This makes it difficult to achieve automatic verification, automatic generation and controllable execution after changes to the iptables rule configuration file, which in turn makes iptables rule configuration error-prone, deployment risky and affects the stability and maintainability of network security strategies.

[0007] To address the aforementioned technical problems, the present invention aims to provide a system and method for automatically generating and executing iptables rules based on configuration files, overcoming the shortcomings of existing technologies.

[0008] This invention achieves the above objectives through the following technical solution: an iptables rule generation system and method based on configuration files. This invention uses a web-based configuration system to perform structured modeling of iptables rules to form an iptables rule configuration model. The web-based configuration system then generates iptables rule configuration files from this model. These configuration files are organized according to a hierarchical structure of iptables rule configuration tables, iptables rule configuration chains, iptables rule matching conditions, and iptables rule processing actions, thus solidifying the semantics of iptables rules in a structured form. To ensure that changes to the iptables rule configuration files automatically trigger rule generation, this invention uses an iptables rule generation system to monitor the iptables rule configuration files. Upon detecting a change in the iptables rule configuration files, a configuration file change trigger signal is output, and the iptables rule generation process is initiated. The iptables rule generation process first validates the format of the iptables rule configuration file. If the validation passes, parsable configuration data is output and enters the parsing process. The parsing process extracts iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters to form the parsing result. To prevent incorrect configurations from entering rule generation, this invention performs a validity check on the parsing result. This validity check includes verifying the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information, as well as verifying the validity of the iptables rule matching condition parameters and iptables rule processing action parameters. If the validity check passes, a set of generateable rule data is output. Based on this set of generateable rule data, an iptables rule command set is generated. The iptables rule execution module executes these commands one by one in the generation order. If any iptables rule command fails to execute, the execution of subsequent iptables rule commands is stopped, and the iptables rule commands already executed in this rule generation process are revoked. This ensures that the rule deployment process remains controllable after changes to the iptables rule configuration file.

[0009] A method for generating iptables rules based on configuration files includes the following steps: Modeling steps: The iptables rules are structured and modeled through a web-based configuration system to obtain an iptables rule configuration model. The iptables rule configuration model includes at least an iptables rule configuration table, an iptables rule configuration chain corresponding to the iptables rule configuration table, iptables rule matching conditions set under the iptables rule configuration chain, and iptables rule processing actions. The iptables rule configuration model is then output. Documentation steps: Receive the iptables rule configuration model and generate an iptables rule configuration file. The iptables rule configuration file is organized according to the hierarchical structure of iptables rule configuration table, iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions, and then outputs the iptables rule configuration file. Monitoring steps: Monitor the iptables rule configuration file, and output a configuration file change trigger signal when a change in the iptables rule configuration file is detected; Verification steps: Receive the configuration file change trigger signal and read the iptables rule configuration file. Perform format validity verification on the iptables rule configuration file. If the format validity verification passes, output the parseable configuration data. If the format validity verification fails, terminate the current iptables rule generation process. Parsing steps: Receive the parsable configuration data and parse the parsable configuration data to extract iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters, form a parsing result, and output the parsing result; Validation steps: Receive the parsing result and perform a validity check on the parsing result. The validity check includes at least checking the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information, as well as checking the validity of the iptables rule matching condition parameters and the iptables rule processing action parameters. If the validity check passes, output the set of rules that can be generated; if the validity check fails, terminate the current iptables rule generation process. Generation steps: Receive the generateable rule dataset, merge it to generate an iptables rule command set, and output the iptables rule command set; Execution steps: Receive the set of iptables rule commands and execute the iptables rule commands one by one in the order they were generated. When any iptables rule command fails to execute, stop the execution of subsequent iptables rule commands and retract the iptables rule commands already executed in this iptables rule generation process.

[0010] Specifically, the core of this method lies in using the iptables rule configuration model as the intermediate carrier of structured rule semantics, the iptables rule configuration file as the sole configuration carrier for cross-system transmission, and the configuration file change trigger signal as the starting condition for the generation process. This ensures that subsequent format validity verification, configuration parsing, legality verification, rule generation, and rule-by-rule execution form a strict input-output closed loop. In the modeling step, the web-based configuration system organizes the iptables rule configuration table, iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions into a single data object for each rule entry. It then aggregates one or more rule entry data objects into the iptables rule configuration model output. The iptables rule configuration table defines the rule's belonging table, the iptables rule configuration chain defines the rule's effective chain, the iptables rule matching conditions define the matching range, and the iptables rule processing actions define the processing method after a match. These four elements together constitute the necessary set of fields for generating iptables rule commands. In the file generation step, the iptables rule configuration file is organized hierarchically, first the iptables rule configuration table, then the iptables rule configuration chain, and finally the iptables rule matching conditions and iptables rule processing actions. This ensures that the parsing step can read from the outer node to the inner node along a fixed path, thus guaranteeing a deterministic parsing result. In the monitoring step, the monitoring of the iptables rule configuration file should at least be able to identify changes in file content or file metadata, and output a configuration file change trigger signal when a change is confirmed. This configuration file change trigger signal serves as the starting input for the verification step, preventing repeated generation under unchanged conditions. In the verification step, the purpose of format validity verification is to ensure that the parsing step can correctly read the configuration file and prevent structurally corrupted configurations from entering the kernel network processing link. Format validity verification outputs parsable configuration data as input for the parsing step. If format validity verification fails, the current iptables rule generation process is terminated to block subsequent generation and execution. In the parsing step, iptables rule configuration table information and iptables rule configuration chain information are extracted from the parsable configuration data. For each rule entry, iptables rule matching condition parameters and iptables rule processing action parameters are extracted to form the parsing result and output it to the legitimate steps. The parsing result should maintain the consistency of the rule entry order so that the order of the iptables rule command set output by the generation step is controllable.In the legality step, the legality verification covers at least the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information, as well as the legality verification of the iptables rule matching condition parameters and iptables rule processing action parameters. If the verification passes, the generated rule dataset is used as input for the generation step. If the verification fails, the current iptables rule generation process is terminated to prevent invalid rules from entering the execution step. In the generation step, the generated rule dataset is mapped to an iptables rule command set. Each iptables rule command is composed of at least the target table information, target chain information, matching condition parameter segment, and processing action parameter segment, and is output to the execution step. In the execution step, the iptables rule commands are executed one by one in the order they were generated, and the execution results are checked. When any iptables rule command fails to execute, subsequent execution is stopped, and the iptables rule commands already executed in this process are withdrawn. The withdrawal mechanism aims to restore the iptables rule state before the failure, to avoid inconsistencies in policies caused by some rules taking effect. This method can therefore maintain controllable execution in automated deployments triggered by changes.

[0011] Furthermore, in the modeling step, the iptables rule configuration table includes a filter table, a nat table, a mangle table, and a raw table; The iptables rule configuration chains include PREROUTING chain, INPUT chain, FORWARD chain, OUTPUT chain, POSTROUTING chain, and custom chain; The extended matching conditions include one or more of the following: iprange, string, time, connlimit, and limit extension modules. Specifically, this limitation is used to clarify the coverage of iptables semantic objects by the web-based configuration system in the modeling step, enabling those skilled in the art to construct the configuration interface field set and configuration file hierarchy accordingly. The filter, nat, mangle, and raw tables, as enumerated sets of iptables rule configuration table information, are written into the iptables rule configuration model and fixed to the iptables rule configuration file, allowing the parsing step to directly identify the target table. The PREROUTING chain, INPUT chain, FORWARD chain, OUTPUT chain, POSTROUTING chain, and custom chains, as enumerated sets of iptables rule configuration chain information, are written into the iptables rule configuration model and fixed to the iptables rule configuration file, enabling the generation step to construct iptables rule commands pointing to the target chain. Extended matching conditions are modeled alongside basic matching conditions because extended matching module parameters also participate in the construction of the matching condition parameter segment. When constructing iptables rule commands, the generation step needs to determine whether to attach the corresponding extended matching module parameter segment based on the existence of the extended matching condition. This ensures that the generated iptables rule commands can express complex strategies such as time limits, string matching, connection limit, rate limit, and address range matching. When a custom chain is used as a value in the iptables rule configuration chain, the generation step should first output the custom chain creation command in the iptables rule command set, and then output the rule command that references the custom chain. This ensures that when the execution steps are executed sequentially, the chain exists first and is referenced later.

[0012] Further, the legal step is as follows: perform table chain mapping verification on the iptables rule configuration table information and iptables rule configuration chain information in the parsing result, and prevent parsing results that do not meet the preset table chain mapping rules from entering the generation step based on the table chain mapping verification result; In the modeling step, the iptables rule matching conditions include basic matching conditions and extended matching conditions. The basic matching conditions at least include source address, destination address, protocol type, ingress network interface card (NIC), egress network interface card (NIC), and destination port. Specifically, the input to the table chain mapping verification is the iptables rule configuration table information and iptables rule configuration chain information output from the parsing step. Its output is a judgment result of verification pass or failure. If verification fails, the parsing result is not allowed to enter the generation step, thus blocking configuration combinations with invalid semantics before rule generation. The basic matching conditions, as the minimum necessary set of matching conditions, are modeled and fixed in the iptables rule configuration file, enabling the parsing step to extract and form iptables rule matching condition parameters, which the generation step uses to form matching condition parameter segments. The source address and destination address are used to construct address matching parameters; the protocol type is used to limit the protocol and determine whether the destination port participates in the generation; the ingress NIC and egress NIC are used to construct interface direction matching parameters; and the destination port is used to construct port matching parameters, provided the protocol type allows it. When extended matching conditions and basic matching conditions coexist, the generation step should map the extended matching conditions to extended matching module parameter segments and combine them with the basic matching condition parameter segments. The legitimate step should perform format and range validation on the extended matching condition parameters to ensure that the extended matching module parameter segments constructed by the generation step are executable.

[0013] Further, in the verification step, when the iptables rule configuration file is an Extensible Markup Language (XML) format configuration file, the structural integrity, node closure consistency, and existence of required nodes of the XML format configuration file are verified to output the parsable configuration data. Specifically, this item clarifies the implementable content of the format validity verification, enabling those skilled in the art to implement the verification step and output parsable configuration data. The structural integrity verification at least covers the existence of the root node and the integrity of the hierarchical relationship, ensuring that the iptables rule configuration table node can contain iptables rule configuration chain nodes and further contain iptables rule matching condition nodes and iptables rule processing action nodes. The node closure consistency verification is used to ensure that the XML format configuration file can be successfully constructed into a node tree structure by the parsing module, thereby avoiding empty or truncated nodes during the parsing process. The required node existence verification is used to ensure that each rule entry has the necessary set of fields to generate iptables rule commands, including at least iptables rule configuration table fields, iptables rule configuration chain fields, and iptables rule processing action fields, and combines them with iptables rule matching condition fields to form a complete rule entry. Once the verification is successful, the output parsable configuration data can be a pre-constructed node tree structure or a normalized collection of key-value objects. The parsing module can use this parsable configuration data as input to complete the subsequent field extraction.

[0014] Furthermore, in the execution step, withdrawing the iptables rule commands already executed in this iptables rule generation process involves: generating iptables rule backup data before executing the set of iptables rule commands, and restoring the iptables rule state before the failure based on the iptables rule backup data when any iptables rule command execution failure is detected. Specifically, this step is used to translate the withdrawal mechanism from an abstract effect into an implementable process, avoiding ambiguity regarding the withdrawal method when execution fails. The iptables rule backup data is a recoverable representation of the iptables rule state before the execution step begins. It can be generated by calling the iptables rule export tool provided by the system, or by reading and serializing an existing rule set in the kernel. The execution step generates iptables rule backup data before executing the set of iptables rule commands one by one, ensuring that the withdrawal action has a definite recovery baseline. The execution step checks the return result or error output after each iptables rule command is executed. If any iptables rule command fails, subsequent execution is immediately stopped and a recovery action is triggered. The recovery action restores the iptables rule state to its state before the failure based on the iptables rule backup data, thereby achieving the purpose of undoing the rules executed in this process. To prevent inconsistent recovery results due to concurrent modifications, in one implementation, the execution step adds mutual exclusion control to iptables rule operations from backup generation to recovery completion, isolating the recovery action from other iptables rule modification operations.

[0015] An iptables rule generation system based on configuration files includes: The web-based configuration system, located on the rule configuration side, includes a modeling module and a file generation module. The modeling module receives iptables rule configuration input and outputs an iptables rule configuration model. The iptables rule configuration input includes at least an iptables rule configuration table, an iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions. The file generation module is connected to the modeling module and receives the iptables rule configuration model, generates an iptables rule configuration file, and outputs the iptables rule configuration file. The monitoring module is located on the rule generation side and connected to the web-based configuration system. It is used to receive the iptables rule configuration file and monitor whether the iptables rule configuration file has been changed. When the iptables rule configuration file is detected to have been changed, it outputs a configuration file change trigger signal. The verification module is set on the rule generation side and connected to the monitoring module. It is used to receive the configuration file change trigger signal and read the iptables rule configuration file, and perform format validity verification on the iptables rule configuration file. If the format validity verification passes, it outputs parsable configuration data. If the format validity verification fails, it terminates the current iptables rule generation process. The parsing module, located on the rule generation side and connected to the verification module, is used to receive the parsable configuration data and parse the parsable configuration data to output the parsing result. The parsing result includes iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters. The legality module, located on the rule generation side and connected to the parsing module, is used to receive the parsing result and perform legality verification on the parsing result. The legality verification output can generate a set of rule data. A generation module, located on the rule generation side and connected to the legal module, is used to receive the generateable rule dataset, merge it to generate an iptables rule command set, and output the iptables rule command set. The execution module, located on the rule generation side and connected to the generation module, is used to receive the set of iptables rule commands and execute the iptables rule commands one by one in the generation order. When any iptables rule command fails to execute, the execution of subsequent iptables rule commands is stopped and the iptables rule commands already executed in this process are withdrawn.

[0016] Specifically, the essential structural relationship of this system is as follows: the web-based configuration system outputs iptables rule configuration files; the monitoring module receives and monitors the configuration file change trigger signals output by the iptables rule configuration files; the verification module receives the configuration file change trigger signals and reads the parsable configuration data output by the iptables rule configuration files; the parsing module receives the parsable configuration data and outputs the parsing results; the validation module receives the parsing results and outputs a set of rule data to be generated; the generation module receives the set of rule data to be generated and outputs a set of iptables rule commands; and the execution module receives the set of iptables rule commands, executes them one by one, and retracts executed rules if they fail. The web-based configuration system includes a modeling module and a document generation module. The output of the modeling module is the iptables rule configuration model, which serves as the input of the document generation module. The output of the document generation module is the iptables rule configuration file, which serves as the input of the monitoring module, thereby realizing the data connection between the web-based configuration system and the rule generation side. Each module can be implemented by different processes on the same device, or by different threads within the same process. The connection between modules can be through file path sharing, inter-process message passing, or function calls. However, regardless of the implementation method, the above-mentioned fixed order of data output and data input relationships should be satisfied to ensure that the system operation process is reproducible and implementable.

[0017] Furthermore, when the iptables rule configuration file is an Extensible Markup Language (XML) format configuration file, the verification module performs the format validity verification on the structural integrity, node closure consistency, and the existence of required nodes of the XML format configuration file, so as to output the parsable configuration data; When the legitimacy module performs the legitimacy check, it at least performs a table chain mapping check on the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information in the parsing result, and performs parameter legitimacy checks on the iptables rule matching condition parameters and the iptables rule processing action parameters, so as to output the set of generateable rule data. Specifically, this section clearly defines the roles of the verification module and the legitimacy module, enabling those skilled in the art to implement it modularly and avoid confusion caused by functional overlap. The verification module handles the parsingability of the configuration file, and its output parsable configuration data must be directly consumed by the parsing module. Therefore, in the scenario of Extensible Markup Language format configuration files, the verification module should at least complete the structure and mandatory node checks to avoid missing fields when the parsing module extracts fields. The validity module handles the semantic validity of rules. Its input is the parsing result from the parsing module, and its output is a set of rules that can be generated. The validity module ensures that the combination of the iptables rule configuration table and the iptables rule configuration chain satisfies iptables semantic constraints through table chain mapping verification, and ensures that matching condition parameters and processing action parameters meet the value range and format constraints through parameter validity verification. This allows the generation module to directly construct a set of iptables rule commands without performing complex error correction. The set of rules that can be generated can be a collection of validated rule entries; the generation module reads this set one by one to generate the corresponding iptables rule command.

[0018] Furthermore, the table chain mapping verification is performed according to preset table chain mapping rules. These preset rules include: the filter table corresponding to the INPUT, FORWARD, and OUTPUT chains; the nat table corresponding to the PREROUTING, OUTPUT, and POSTROUTING chains; the mangle table corresponding to the PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING chains; and the raw table corresponding to the PREROUTING and OUTPUT chains. Specifically, this section concretizes the judgment criteria for table chain mapping verification, making the verification behavior of the legitimate module implementable and reproducible. The preset table chain mapping rules are initialized and stored as mapping table data within the legitimate module. After reading the iptables rule configuration table information and iptables rule configuration chain information from the parsing results, the legitimate module determines whether the correspondence is valid based on this mapping table. If it is invalid, the rule entry is marked as verification failed and prevented from entering the set of rules that can be generated. If it is valid, subsequent parameter validity verification is allowed, and the module enters the set of rules that can be generated after passing the verification. The purpose of this mapping rule is to pre-fix the inherent constraints of iptables tables and chains, reduce the probability that the generation module will output unexecutable iptables rule commands, and prevent the execution module from failing and rolling back due to semantic inconsistencies.

[0019] Furthermore, the execution module includes a backup unit and a recovery unit. The backup unit generates iptables rule backup data before executing each iptables rule command. The recovery unit restores the iptables rule state before failure based on the iptables rule backup data when any iptables rule command execution failure is detected, thereby achieving the reversal. Specifically, this section further divides the execution module into a backup unit and a recovery unit to facilitate the separation of responsibility for backup generation and state restoration during implementation. The backup unit's inputs are the execution start command and the current iptables rule state. The backup unit's output is the iptables rule backup data, which is provided to the recovery unit and the execution control logic. The recovery unit's inputs are the execution failure event and the iptables rule backup data. The recovery unit's output is the recovery completion indication and restores the iptables rule state to its pre-execution state. During the execution process, the execution module feeds back the execution result of each iptables rule command to the failure detection logic. When the failure detection logic generates an execution failure event, it calls the recovery unit to perform recovery, thereby completing the reversal. By splitting the structure, those skilled in the art can independently implement backup generation and recovery execution, and trigger recovery when execution fails through a unified failure detection interface, ensuring that the rollback action is deterministic.

[0020] Furthermore, the iptables rule matching conditions received by the web-based configuration system include basic matching conditions and extended matching conditions. The basic matching conditions at least include source address, destination address, protocol type, ingress network interface card (NIC), egress network interface card (NIC), and destination port. The extended matching conditions include one or more of the following: iprange extension module, string extension module, time extension module, connlimit extension module, and limit extension module. Specifically, this section clarifies the field set and parameter structure of the web-based configuration system when receiving iptables rule matching conditions, enabling those skilled in the art to implement the input form, field validation, and configuration file generation logic of the web-based configuration system. As optional or mandatory basic fields for each rule entry, the web-based configuration system should provide input interfaces for source address, destination address, protocol type, ingress NIC, egress NIC, and destination port, forming corresponding parameters. When generating the iptables rule configuration file, these parameters should be included in the matching condition nodes associated with the iptables rule configuration chain. Extended matching conditions are used to express more complex matching semantics. When the web-based configuration system receives the `iprange` extension module, it should record the source address range parameters and the target address range parameters. When it receives the `string` extension module, it should record the string matching algorithm parameters and the string value parameters. When it receives the `time` extension module, it should record the start and end time parameters and date / week-related parameters. When it receives the `connlimit` extension module, it should record the connection threshold parameters and the mask parameters. When it receives the `limit` extension module, it should record the rate parameters and burst parameters. The iptables rule configuration file generated by the web-based configuration system should retain the type identifier and parameter fields of the extended matching conditions. This allows the parsing module to recognize the extended matching conditions and output the corresponding parameter set. The validity module can perform validity checks on the parameter set. The generation module can map the parameter set to the extended matching module parameter segments and combine them with the basic matching condition parameter segments. Finally, the execution module executes the corresponding iptables rule command, thus achieving closed-loop implementation of the extended matching conditions throughout the entire link.

[0021] The beneficial effects of this invention are: This invention establishes an iptables rule configuration model and generates iptables rule configuration files through a web-based configuration system, providing a unified, structured expression basis for iptables rules and reducing reliance on manual command assembly and experience-based judgment. By validating the format of the iptables rule configuration files and verifying the legality of the parsing results, incorrect configurations are intercepted before iptables rule generation, reducing the probability of iptables rule execution failure and improving the quality of iptables rule generation. The invention automatically initiates the iptables rule generation process through iptables rule configuration file change monitoring and configuration file change trigger signals, enabling automatic deployment of iptables rule changes. By executing iptables rules one by one and revoking executed iptables rule commands upon failure, the iptables rule deployment process possesses failure controllability and state recovery capabilities, thereby improving the stability and maintainability of network security policies in dynamic environments. Attached Figure Description

[0022] Figure 1 A schematic flowchart of the method steps of the present invention is shown.

[0023] Figure 2 The diagram illustrates the overall process of an embodiment of the present invention, demonstrating how the web-based configuration system generates iptables rule configuration files and how the iptables rule generation system completes monitoring triggering, verification parsing, rule generation, and rule execution based on the iptables rule configuration files.

[0024] Figure 3 The diagram illustrates the configuration generation process of an embodiment of the present invention, demonstrating the process by which the web-based configuration system configures the iptables rule configuration table, iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions, and generates the iptables rule configuration file.

[0025] Figure 4 The diagram illustrates the rule generation process of an embodiment of the present invention, demonstrating the process by which the iptables rule generation system performs format validity verification, configuration parsing, legality verification, rule generation, and rule execution and failure withdrawal of the iptables rule configuration file. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It is understood that the accompanying drawings are provided for reference and illustration only, and are not intended to limit the present invention. The connection relationships shown in the accompanying drawings are only for clear description and do not limit the connection method.

[0027] It should be noted that if an element is referred to as being "fixed to" or "set on" another element, it can be directly on the other element or there may be an intervening element. If an element is considered to be "connected to" another element, it can be directly connected to the other element or there may be an intervening element. If so, the terms "vertical," "horizontal," "upper," "lower," "left," "right," and similar expressions used in this application are for illustrative purposes only and do not represent the only possible implementation.

[0028] Figures 1-4 As shown in this embodiment, the web-based configuration system is used to output iptables rule configuration files, and the iptables rule generation system is used to receive and process iptables rule configuration files. The data processing modules inside the iptables rule generation system are arranged in a fixed order as follows: iptables rule configuration modeling module, iptables rule configuration file generation module, iptables rule configuration file change monitoring module, iptables rule configuration file format verification module, iptables rule configuration file parsing module, iptables rule configuration validity verification module, iptables rule generation module, and iptables rule execution module. The modules form a closed-loop link through data output and data input.

[0029] In this implementation, the system consists of a web-based configuration system and an iptables rule generation system working together. The web-based configuration system provides the rule configuration entry point and outputs configuration files, while the iptables rule generation system monitors, triggers, verifies, parses, generates rules, and controls the execution of these configuration files. First, operations personnel access the web-based configuration system through a browser and configure rules. The configuration is preferably organized by configuration tables, configuration chains, matching conditions, and processing actions. Configuration tables may include filter, nat, mangle, and raw tables. Configuration chains may include PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING, and custom chains. Matching conditions may include basic matching conditions such as source address, destination address, protocol type, ingress network interface, egress network interface, and destination port. Extended matching conditions such as iprange, string, time, connlimit, and limit can also be configured as needed. Processing actions indicate the processing method after matching. After configuration, the web-based configuration system generates a configuration file from the rule model and outputs it to the rule generation system as input. The rule generation system continuously monitors this configuration file, triggering subsequent processing flows when a change is detected. Upon triggering, the system reads the configuration file and first performs a format validity check. If the configuration file is in XML format, it checks the integrity of the XML structure, node closure, and the existence of necessary nodes. If the format check passes, parsable configuration data is generated and the parsing phase begins. Otherwise, an error is recorded and the process terminates to prevent erroneous files from causing subsequent generation anomalies. Subsequently, the system parses the parsable configuration data, extracting the configuration table, configuration chain, matching condition parameters, and processing action parameters in sequence, forming the parsing result, and outputting it to the validity check phase. In the validity check phase, the system at least performs a mapping check on the correspondence between the configuration table and the configuration chain to ensure that the rules fall within the table and chain combinations allowed by iptables semantics. At the same time, it checks the value range, format, and enumeration validity of the matching conditions and processing action parameters. If the check passes, it outputs a data set that can generate rules. Next, the rule generation module generates a set of iptables rule commands based on the dataset and outputs it to the execution module. The execution module executes the iptables rule commands one by one in the generation order. If a rule command executes successfully, it continues to the next one. If any rule command fails, a failure log is recorded and the executed rules in this process are revoked, returning the system to its controllable state before the change. The revocation method can be implemented by backing up existing rules and restoring them upon failure, or by reversing the operation based on already executed rules. The specific revocation strategy can be selected according to the system deployment requirements, but the goal is to prevent erroneous rules from continuing to take effect after a failure.Furthermore, the configuration file can be configured with an operation type field to identify operation types such as append, insert, delete, or update. When constructing iptables rule commands, the rule generation module reads the operation type field and selects the matching command construction method, thus supporting different change behaviors while maintaining semantic consistency of the rules. Through this approach, the system achieves a complete closed loop for rules, from structured modeling, configuration solidification, change triggering, verification and parsing, rule generation to execution and failure handling, making the iptables rule change process more efficient, reliable, and maintainable.

[0030] like Figure 2As shown, the overall process begins with the web-based configuration system creating a structured model of iptables rules and forming an iptables rule configuration model. Based on this model, the system generates and outputs iptables rule configuration files. The iptables rule generation system monitors these files. When a change occurs, the iptables rule configuration file change monitoring module outputs a change trigger signal and initiates the iptables rule generation process. The iptables rule configuration file format validation module receives the change trigger signal, reads the configuration file, and performs a format validity check. If the validation passes, it outputs parsable configuration data and proceeds to the next step. If the validation fails, the current iptables rule generation process is terminated to prevent incorrect configurations from entering rule generation and execution. Finally, the iptables rule configuration file parsing module receives the parsable configuration data and parses it to obtain the parsing results. These results include iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters. The iptables rule configuration validity verification module receives the parsing results and performs validity verification. This verification checks at least the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information, and also verifies the validity of the iptables rule matching condition parameters and iptables rule processing action parameters. The validity verification outputs a set of rule data to be generated. The iptables rule generation module receives the set of rule data and merges it to generate a set of iptables rule commands. The iptables rule execution module receives the set of iptables rule commands and executes them one by one in the order they were generated. If any iptables rule command fails to execute, the execution of subsequent iptables rule commands is stopped, and the iptables rule commands already executed in this rule generation process are revoked, returning the system to the controllable state before the failure.

[0031] like Figure 3As shown, when forming the iptables rule configuration model, the web-based configuration system first selects an iptables rule configuration table and forms the iptables rule configuration table input. Then, based on the iptables rule configuration table input, it selects an iptables rule configuration chain and forms the iptables rule configuration chain input. Next, based on the iptables rule configuration chain input, it configures the iptables rule matching conditions and iptables rule processing actions, forming the corresponding parameter input. The web-based configuration system aggregates the above inputs into the iptables rule configuration model and generates the iptables rule configuration file. The iptables rule matching conditions can include basic matching conditions and extended matching conditions. Basic matching conditions include at least the source address, destination address, protocol type, ingress network interface card (NIC), egress network interface card (NIC), and destination port. Extended matching conditions can include one or more of the following extension modules: iprange, string, time, connlimit, and limit. When generating the iptables rule configuration file, the web-based configuration system maintains consistency between the field meanings and the node hierarchy, ensuring that the iptables rule configuration file can be fully parsed by the iptables rule generation system in subsequent processing stages and used to generate the iptables rule command set.

[0032] like Figure 4As shown, the iptables rule generation system enters the iptables rule generation process after the configuration file change trigger signal arrives. First, the iptables rule configuration file format verification module performs a format validity check on the iptables rule configuration file. In one implementation, when the iptables rule configuration file is in Extensible Markup Language (XML) format, the module checks the structural integrity, node closure consistency, and the existence of required nodes, and outputs resolvable configuration data. Next, the iptables rule configuration file parsing module parses the resolvable configuration data and outputs the parsing result. Then, the iptables rule configuration validity verification module verifies the validity of the parsing result and outputs a set of generateable rule data. Afterward, the iptables rule generation module generates a set of iptables rule commands based on the generateable rule data set and outputs it to the iptables rule execution module. The iptables rule execution module executes each iptables rule command one by one and checks the execution result. If execution fails, a reversal operation is triggered to retract the iptables rule commands already executed in this iptables rule generation process. In a preferred implementation, the iptables rule execution module generates iptables rule backup data before executing the set of iptables rule commands, and restores the iptables rule state before the failure based on the iptables rule backup data when any iptables rule command fails to execute, thereby avoiding inconsistencies in iptables rule policies caused by some iptables rule commands taking effect. Figures 2 to 4 The illustrated closed-loop implementation in this method achieves automatic triggering, automatic verification, automatic generation, and controllable execution after changes to the iptables rule configuration file, reducing the deployment risk of iptables rules and improving the efficiency of iptables rule maintenance. The workflow in this case uses the iptables rule configuration file output by the web-based configuration system as the sole semantic carrier of the rules, and the iptables rule generation system forms a self-consistent data processing chain around the iptables rule configuration file. The web-based configuration system receives the iptables rule configuration table, iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions input by operations and maintenance personnel, and organizes these inputs into an iptables rule configuration model. The iptables rule configuration model semantically corresponds to the constituent elements of an iptables rule, where the iptables rule configuration table determines the table to which the rule belongs, the iptables rule configuration chain determines the rule's effective chain, the iptables rule matching conditions determine the range of packets to be matched, and the iptables rule processing actions determine the processing result of a match. After obtaining the iptables rule configuration model, the web-based configuration system generates and outputs an iptables rule configuration file. This file is hierarchically organized according to the iptables rule configuration table nodes, which contain iptables rule configuration chain nodes. Each iptables rule configuration chain node also contains iptables rule matching condition nodes and iptables rule processing action nodes, thus solidifying the rule semantics in a structured form. The output iptables rule configuration file becomes the processing input for the iptables rule generation system. Subsequent steps use the output of the previous step as the input for the next, forming a closed-loop chain.

[0033] The iptables rule generation system first uses a monitoring module to monitor the iptables rule configuration file. The monitoring mechanism determines whether the iptables rule configuration file has been modified based on changes in file content or file timestamps. When the monitoring module detects a change in the iptables rule configuration file, it outputs a configuration file change trigger signal. This signal triggers subsequent processing steps and suppresses duplicate generation under unchanged conditions. To avoid concurrent triggering leading to multiple generation and executions at the same time, in one implementation, the iptables rule generation system adds mutual exclusion control to the current processing step after receiving the configuration file change trigger signal, ensuring that only one processing instance is allowed to enter the verification module at any given time.

[0034] Upon receiving a configuration file change trigger signal, the verification module reads the iptables rule configuration file and performs a format validity check. The mechanism of this format validity check is to ensure that the iptables rule configuration file can be correctly parsed by the subsequent parsing module and maintains structural integrity. Taking an Extensible Markup Language (EXPLAIN) format configuration file as an example, the verification module checks at least structural integrity, node closure consistency, and the existence of required nodes. Required nodes include at least a node representing the iptables rule configuration table, a node representing the iptables rule configuration chain, a node representing the iptables rule processing action, and iptables rule matching condition nodes associated with the iptables rule processing action. If the verification passes, the verification module outputs parsable configuration data and sends it to the parsing module. If the verification fails, the verification module outputs an error message and terminates the current iptables rule generation process, thereby preventing format errors from entering parsing and rule generation, and avoiding uncontrollable impacts on the operating system's network processing links.

[0035] The parsing module receives parsable configuration data and outputs the parsing results. The parsing mechanism involves restoring the node hierarchy of the iptables rule configuration file into computable and processable data objects for validity verification and rule generation. The parsing module sequentially extracts iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters, and aggregates the extracted results into the parsing output. To ensure the deterministic nature of subsequent rule generation, the parsing module maintains consistency between field meanings and node hierarchy, and ensures that the order of rule entries matches the order of appearance in the iptables rule configuration file, ensuring that the subsequently generated set of iptables rule commands has a definite execution order under the same configuration. In one implementation, each iptables rule configuration chain corresponds to one or more rule entries. The parsing module represents each rule entry as a rule entry object, which includes at least iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters. Multiple rule entry objects are stored sequentially in the parsing result.

[0036] The validity module receives the parsing results and performs validity checks. Upon successful validity checks, it outputs a set of rules that can be generated. The mechanism of validity checks lies in placing the semantic constraints of iptables rules before rule generation, preventing invalid rules from entering the iptables rule execution module at the source. Validity checks include at least table chain mapping checks and parameter validity checks. Table chain mapping checks verify whether the correspondence between iptables rule configuration table information and iptables rule configuration chain information satisfies the preset table chain mapping rules. The preset table chain mapping rules include at least the following: filter table corresponding to INPUT, FORWARD, and OUTPUT chains; nat table corresponding to PREROUTING, OUTPUT, and POSTROUTING chains; mangle table corresponding to PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING chains; and raw table corresponding to PREROUTING and OUTPUT chains. Parameter validity verification is used to validate the value range and format of iptables rule matching condition parameters and iptables rule processing action parameters. The iptables rule matching condition parameters include at least source address parameters, destination address parameters, protocol type parameters, ingress network interface (NIC) parameters, egress network interface (NIC) parameters, and destination port parameters. Parameter validity verification includes at least the following: address format verification of source and destination address parameters; numerical range verification of destination port parameters; enumeration validity verification of protocol type parameters; and interface name format verification of ingress and egress NIC parameters. For extended matching conditions, parameter validity verification further verifies the format and range of parameters from the iprange, string, time, connlimit, and limit extension modules. For example, the iprange extension module verifies the source and destination address range expressions; the string extension module verifies the string matching algorithm parameters and string value parameters; the time extension module verifies the start and end time parameters and date / week parameters; the connlimit extension module verifies the connection threshold parameters and mask parameters; and the limit extension module verifies the rate parameters and burst parameters. When the validity check fails, the validity module outputs an error message and terminates the current iptables rule generation process. When the validity check passes, the validity module aggregates the rule entries that passed the check in the parsing result into a rule dataset that can be generated and outputs it to the generation module.

[0037] The generation module receives a dataset of generateable rules and merges it to generate a set of iptables rule commands. The generation mechanism maps each rule entry object to an executable iptables rule command and organizes all iptables rule commands into a set in a defined order. During the mapping of a single rule entry object, the generation module determines the target table basis for the command based on the iptables rule configuration table information, the target chain basis for the command based on the iptables rule configuration chain information, generates corresponding matching condition parameter segments based on the iptables rule matching condition parameters, and generates corresponding processing action parameter segments based on the iptables rule processing action parameters. When a rule entry object contains extended matching conditions, the generation module maps the extended matching conditions to corresponding extended matching module parameter segments and combines them with the basic matching condition parameter segments, maintaining a consistent combination order to ensure predictable execution results. If the iptables rule configuration chain information of the rule entry object is a custom chain, the generation module first generates the iptables rule commands required for creating the custom chain when outputting the set of iptables rule commands, and then generates the iptables rule commands that add rule entries to the custom chain, thus ensuring that the custom chain exists first and is referenced later during the execution phase. After the generation module completes the mapping, it outputs a set of iptables rule commands to the execution module.

[0038] The execution module receives a set of iptables rule commands and executes them one by one in the order they were generated. The execution mechanism relies on precisely determining the execution result of each iptables rule command through a sequential execution approach, thereby ensuring controllable failures and recoverable state. To guarantee the feasibility of reversal, in a preferred implementation, the execution module generates iptables rule backup data before executing each command. This backup data represents the state of the iptables rules before execution. After executing each iptables rule command, the execution module checks the execution result. When a failure is detected, the module stops executing subsequent iptables rule commands and triggers reversal processing. This reversal process restores the iptables rule state before the failure based on the backup data, thus reversing the iptables rule commands already executed in the current rule generation process and preventing inconsistencies caused by partial effectiveness. In another optional implementation, the reversal process can also construct a corresponding reverse reversal command based on the set of iptables rule commands already executed and execute the reverse reversal command to achieve reversal. However, regardless of the reversal method used, the reversal process aims to restore the iptables rule state before the failure. After the reversal process is completed, the execution module outputs the failure result and records the failure log. The failure log includes at least the failed iptables rule command and the return information of the execution failure, so that the operation and maintenance personnel can locate and correct the corresponding rule entries in the iptables rule configuration file based on the failure log.

[0039] Through the above process, this case connects the web-based configuration system and the iptables rule generation system using iptables rule configuration files. This transforms iptables rules from structured modeling into verifiable and parsable configuration semantics. Furthermore, a validity check prevents invalid rules from entering the generation and execution process. Finally, a rule-by-rule execution and withdrawal mechanism ensures controllability during deployment. This allows technical personnel to implement a complete system based on the input fields of the web-based configuration system, the hierarchical organization of the iptables rule configuration files, and the verification, parsing, generation, and execution chain of the iptables rule generation system. The system also ensures stable automatic generation and controllable execution of iptables rules even after configuration file changes.

[0040] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for generating iptables rules based on a configuration file, characterized in that, Includes the following steps: Modeling steps: The iptables rules are structured and modeled through a web-based configuration system to obtain an iptables rule configuration model. The iptables rule configuration model includes at least an iptables rule configuration table, an iptables rule configuration chain corresponding to the iptables rule configuration table, iptables rule matching conditions set under the iptables rule configuration chain, and iptables rule processing actions. The iptables rule configuration model is then output. Documentation steps: Receive the iptables rule configuration model and generate an iptables rule configuration file. The iptables rule configuration file is organized according to the hierarchical structure of iptables rule configuration table, iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions, and then outputs the iptables rule configuration file. Monitoring steps: Monitor the iptables rule configuration file, and output a configuration file change trigger signal when a change in the iptables rule configuration file is detected; Verification steps: Receive the configuration file change trigger signal and read the iptables rule configuration file. Perform format validity verification on the iptables rule configuration file. If the format validity verification passes, output the parseable configuration data. If the format validity verification fails, terminate the current iptables rule generation process. Parsing steps: Receive the parsable configuration data and parse the parsable configuration data to extract iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters, form a parsing result, and output the parsing result; Validation steps: Receive the parsing result and perform a validity check on the parsing result. The validity check includes at least checking the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information, as well as checking the validity of the iptables rule matching condition parameters and the iptables rule processing action parameters. If the validity check passes, output the set of rules that can be generated; if the validity check fails, terminate the current iptables rule generation process. Generation steps: Receive the generateable rule dataset, merge it to generate an iptables rule command set, and output the iptables rule command set; Execution steps: Receive the set of iptables rule commands and execute the iptables rule commands one by one in the order they were generated. When any iptables rule command fails to execute, stop the execution of subsequent iptables rule commands and retract the iptables rule commands already executed in this iptables rule generation process.

2. The profile-based iptables rule generation method of claim 1, wherein, In the modeling step, the iptables rule configuration table includes a filter table, a nat table, a mangle table, and a raw table; The iptables rule configuration chains include PREROUTING chain, INPUT chain, FORWARD chain, OUTPUT chain, POSTROUTING chain, and custom chain; In the modeling step, the iptables rule matching conditions include basic matching conditions and extended matching conditions. The basic matching conditions include at least the source address, destination address, protocol type, ingress network card, egress network card, and destination port. The extended matching conditions include one or more of the following: iprange extension module, string extension module, time extension module, connlimit extension module, and limit extension module.

3. The profile-based iptables rule generation method of claim 2, wherein, The legal steps are as follows: perform table chain mapping verification on the iptables rule configuration table information and iptables rule configuration chain information in the parsing result, and prevent parsing results that do not meet the preset table chain mapping rules from entering the generation step based on the table chain mapping verification result; In the verification step, when the iptables rule configuration file is an Extensible Markup Language (XML) format configuration file, the structural integrity, node closure consistency, and existence of required nodes of the XML format configuration file are verified in order to output the parsable configuration data.

4. The profile-based iptables rule generation method of claim 3, wherein, In the execution steps, withdrawing the iptables rule commands already executed in this iptables rule generation process is as follows: before executing the set of iptables rule commands, generate iptables rule backup data, and when any iptables rule command is detected to have failed to execute, restore the iptables rule state before the failure based on the iptables rule backup data.

5. A profile-based iptables rule generation system, characterized by, include: The web-based configuration system, located on the rule configuration side, includes a modeling module and a file generation module. The modeling module receives iptables rule configuration input and outputs an iptables rule configuration model. The iptables rule configuration input includes at least an iptables rule configuration table, an iptables rule configuration chain, iptables rule matching conditions, and iptables rule processing actions. The file generation module is connected to the modeling module and receives the iptables rule configuration model, generates an iptables rule configuration file, and outputs the iptables rule configuration file. The monitoring module is located on the rule generation side and connected to the web-based configuration system. It is used to receive the iptables rule configuration file and monitor whether the iptables rule configuration file has been changed. When the iptables rule configuration file is detected to have been changed, it outputs a configuration file change trigger signal. The verification module is set on the rule generation side and connected to the monitoring module. It is used to receive the configuration file change trigger signal and read the iptables rule configuration file, and perform format validity verification on the iptables rule configuration file. If the format validity verification passes, it outputs parsable configuration data. If the format validity verification fails, it terminates the current iptables rule generation process. The parsing module, located on the rule generation side and connected to the verification module, is used to receive the parsable configuration data and parse the parsable configuration data to output the parsing result. The parsing result includes iptables rule configuration table information, iptables rule configuration chain information, iptables rule matching condition parameters, and iptables rule processing action parameters. The legality module, located on the rule generation side and connected to the parsing module, is used to receive the parsing result and perform legality verification on the parsing result. The legality verification output can generate a set of rule data. A generation module, located on the rule generation side and connected to the legal module, is used to receive the generateable rule dataset, merge it to generate an iptables rule command set, and output the iptables rule command set. The execution module, located on the rule generation side and connected to the generation module, is used to receive the set of iptables rule commands and execute the iptables rule commands one by one in the generation order. When any iptables rule command fails to execute, the execution of subsequent iptables rule commands is stopped and the iptables rule commands already executed in this process are withdrawn.

6. The profile-based iptables rule generation system of claim 5, wherein, When the iptables rule configuration file is an Extensible Markup Language (XML) format configuration file, the verification module performs the format validity verification on the structural integrity, node closure consistency, and the existence of required nodes of the XML format configuration file, so as to output the parsable configuration data. When the legal module performs the legality verification, it at least performs table chain mapping verification on the correspondence between the iptables rule configuration table information and the iptables rule configuration chain information in the parsing result, and performs parameter legality verification on the iptables rule matching condition parameters and the iptables rule processing action parameters, so as to output the set of rules that can be generated.

7. The profile-based iptables rule generation system of claim 6, wherein, The table chain mapping verification is performed according to preset table chain mapping rules. The preset table chain mapping rules include: filter table corresponding to INPUT chain, FORWARD chain and OUTPUT chain; nat table corresponding to PREROUTING chain, OUTPUT chain and POSTROUTING chain; mangle table corresponding to PREROUTING chain, INPUT chain, FORWARD chain, OUTPUT chain and POSTROUTING chain; and raw table corresponding to PREROUTING chain and OUTPUT chain.

8. The profile-based iptables rule generation system of claim 7, wherein, The execution module includes a backup unit and a recovery unit. The backup unit is used to generate iptables rule backup data before executing the iptables rule commands one by one. The recovery unit is used to restore the iptables rule state before the failure based on the iptables rule backup data when any iptables rule command is detected to achieve the withdrawal. The iptables rule matching conditions received by the web-based configuration system include basic matching conditions and extended matching conditions. The basic matching conditions include at least the source address, destination address, protocol type, ingress network card, egress network card, and destination port. The extended matching conditions include one or more of the following: iprange extension module, string extension module, time extension module, connlimit extension module, and limit extension module.

Images