secgroup/fws

Language-independent Synthesis of Firewall Policies

fws's Issues

Additional short description in README.md

The README.md starts with "Language-independent Synthesis of Firewall Policies"

Please add one or two sentences what the synthesis of firewall policies is useful for

Identical files but non empy diff

I bumped in to this strange case where FWS marks two (identical) files as equivalent, but generates a non empty diff. I have attached the policy and interfaces file to the issue.

interfaces.txt
mastersolution.txt

FireWall Synthesizer - Language-independent Synthesis of Firewall Policies
FWS> p1 = load_policy(iptables, "mastersolution", "interfaces")
FWS> p2 =  load_policy(iptables, "mastersolution", "interfaces")
FWS> equivalence(p1,p2)
Equivalent.
FWS> diff(p1,p2)
Solving: [##################################################] (   18/   18) 100.00%

+++ mastersolution
--- mastersolution
╭─────┬────────────────────────┬─────────────┬─────────────────────────┬──────────────────┬────────────┬─────────────────┬──────────┬───────╮
│ +/- │ Source IP              │ Source Port │ Destination IP          │ Destination Port │ Source MAC │ Destination MAC │ Protocol │ State │
╞═════╪════════════════════════╪═════════════╪═════════════════════════╪══════════════════╪════════════╪═════════════════╪══════════╪═══════╡
│ +   │ 0.0.0.0/31 \ {0.0.0.1} │ 63690-63784 │ 64.0.0.0/2 \ {64.0.0.1} │ 50621-50691      │ *          │ *               │ tcp      │ NEW   │
├─────┼────────────────────────┼─────────────┼─────────────────────────┼──────────────────┼────────────┼─────────────────┼──────────┼───────┤
│ -   │ 0.0.0.0/31 \ {0.0.0.1} │ 63690-63784 │ 64.0.0.0/2 \ {64.0.0.1} │ 50621-50691      │ *          │ *               │ icmp     │ NEW   │
│     │                        │             │                         │                  │            │                 │ tcp      │       │
╰─────┴────────────────────────┴─────────────┴─────────────────────────┴──────────────────┴────────────┴─────────────────┴──────────┴───────╯

Firewall configs copyright notice

Hey,

cool work, thanks for promoting the real world firewall configs 😁
I tried hard to collect them -- if possible -- with the most permissive license, please try to ShareAlike 😉

TODO: Please add license notes to fws/examples/real-world/ to allow all researches to use this data 😄

Thanks for mirroring! Keep on making firewall configs better 👍

Overview of supported IPtables functionality and syntax

At the moment it is a bit hit and miss to figure out what IPtables functions are supported. E.g. using the --source-ports directive or the iprange module appear to crash fws.