-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
217 lines (213 loc) · 12.1 KB
/
Copy pathindex.html
File metadata and controls
217 lines (213 loc) · 12.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>FirewallScope — visual analyzer for iptables, nftables and UFW</title>
<link rel="stylesheet" href="styles.css" />
</head>
<body>
<header class="topbar">
<div class="brand">
<span class="logo">⛨</span>
<h1>FirewallScope</h1>
<span class="tag">visual analyzer for <code>iptables</code> · <code>nftables</code> · <code>ufw</code></span>
</div>
<a class="repo-link" href="https://github.com/DannyRuizB/firewallscope" target="_blank" rel="noopener">GitHub</a>
</header>
<main class="layout">
<section class="input-pane">
<div class="pane-header">
<h2>Input</h2>
<div class="actions">
<div class="sample-wrap">
<button id="load-sample" class="sample-toggle" type="button" aria-haspopup="true" aria-expanded="false">Load sample ▾</button>
<div id="sample-menu" class="sample-menu" hidden>
<button type="button" data-sample="iptables">iptables-save (IPv4)</button>
<button type="button" data-sample="ip6tables">ip6tables-save (IPv6)</button>
<button type="button" data-sample="nftables">nft list ruleset</button>
<button type="button" data-sample="ufw">ufw status verbose</button>
<button type="button" data-sample="leaky">iptables (leaky — for linter)</button>
<button type="button" data-sample="shadowed">iptables (shadowed rules)</button>
<button type="button" data-sample="portforward">iptables (port-forward / DNAT)</button>
<button type="button" data-sample="exposed">iptables (exposed services)</button>
<button type="button" data-sample="router">iptables (sloppy router)</button>
<button type="button" data-sample="noicmpv6">ip6tables (ICMPv6 blocked)</button>
<button type="button" data-sample="nopmtud">iptables (ICMP blocked — no PMTUD)</button>
<button type="button" data-sample="nftv4only">nft (IPv4-only — v6 open)</button>
<button type="button" data-sample="dnatdead">iptables (dead port-forward)</button>
<button type="button" data-sample="ufwdecorative">ufw (default allow — decorative rules)</button>
<button type="button" data-sample="reflector">iptables (UDP reflector — DDoS amplifier)</button>
<button type="button" data-sample="dockeropen">iptables (Docker — published port bypasses INPUT)</button>
<button type="button" data-sample="notrackdns">iptables (NOTRACK vs stateful accept)</button>
<button type="button" data-sample="notrackoneway">iptables (NOTRACK — one-way only)</button>
<button type="button" data-sample="ftphelper">iptables (FTP conntrack helper)</button>
<button type="button" data-sample="acceptalldead">iptables (catch-all ACCEPT — dead rules)</button>
<button type="button" data-sample="recentoneway">iptables (-m recent — half a limiter)</button>
<button type="button" data-sample="dportnoproto">iptables (--dport with no -p — won't load)</button>
<button type="button" data-sample="rejectmismatch">iptables (REJECT --reject-with — wrong type, won't load)</button>
<button type="button" data-sample="portwrongproto">iptables (--dport on the wrong -p — won't load)</button>
<button type="button" data-sample="natstatedead">iptables (state match in nat — dead rules)</button>
<button type="button" data-sample="tcpflagsdead">iptables (--tcp-flags outside the mask — dead rules)</button>
<button type="button" data-sample="synonudp">iptables (--syn under -p udp — won't load)</button>
<button type="button" data-sample="icmpontcp">iptables (--icmp-type under -p tcp — won't load)</button>
<button type="button" data-sample="ufwdeadden">ufw (default deny — dead deny rules)</button>
</div>
</div>
<button id="upload" type="button">Upload</button>
<button id="compare-toggle" type="button" title="Diff this ruleset against a second one">Compare</button>
<select id="format-override" title="Auto-detected unless overridden">
<option value="auto">Auto-detect</option>
<option value="iptables">iptables-save</option>
<option value="ip6tables">ip6tables-save</option>
<option value="nftables">nft list ruleset</option>
<option value="ufw">ufw status verbose</option>
</select>
<button id="analyze" type="button" class="primary">Analyze</button>
</div>
</div>
<input id="file-input" type="file" accept=".txt,.conf,text/plain" hidden />
<div id="format-badge" class="format-badge" hidden></div>
<div class="textarea-wrap">
<div class="textarea-label" id="label-a" hidden>BEFORE (left)</div>
<textarea
id="ruleset-input"
spellcheck="false"
placeholder="Paste output of `iptables-save`, `ip6tables-save`, `nft list ruleset`, or `ufw status verbose` here. Or drop a file. Or click Load sample to try one."
></textarea>
<div id="drop-overlay" class="drop-overlay" hidden>Drop ruleset file here</div>
</div>
<div class="textarea-wrap textarea-wrap-b" id="compare-pane" hidden>
<div class="textarea-label">AFTER (right) — paste a second ruleset to diff against the one above</div>
<textarea
id="compare-input"
spellcheck="false"
placeholder="Paste the second ruleset of the same format here, then click Analyze."
></textarea>
</div>
<div id="parse-error" class="error" hidden></div>
<div id="parse-warnings" class="warnings" hidden></div>
</section>
<section class="output-pane">
<div id="diff-banner" class="diff-banner" hidden>
<span id="diff-summary"></span>
<button id="exit-diff" type="button" class="diff-exit">Exit diff</button>
</div>
<div class="pane-header tabs-header">
<div class="tabs">
<button id="tab-graph" class="tab active" type="button">Graph</button>
<button id="tab-table" class="tab" type="button">Table</button>
<button id="tab-lint" class="tab" type="button">Lint <span id="lint-tab-badge" class="tab-badge" hidden></span></button>
<button id="tab-trace" class="tab" type="button">Trace</button>
</div>
<div class="legend">
<span><i class="dot table-node"></i>table</span>
<span><i class="dot chain-node"></i>chain</span>
<span><i class="dot rule-accept"></i>ACCEPT</span>
<span><i class="dot rule-drop"></i>DROP</span>
<span><i class="dot rule-other"></i>other</span>
</div>
<div class="export-wrap" id="export-wrap">
<button id="export-toggle" class="header-btn" type="button" aria-haspopup="true" aria-expanded="false" title="Download graph">⤓</button>
<div id="export-menu" class="export-menu" hidden>
<button type="button" data-format="png">PNG</button>
<button type="button" data-format="svg">SVG</button>
</div>
</div>
</div>
<div id="graph-view" class="view-container">
<div id="graph"></div>
<div id="chain-tooltip" class="chain-tooltip" hidden></div>
<div id="graph-empty" class="empty-state">Paste a ruleset and click <b>Analyze</b> to see the graph.</div>
</div>
<div id="table-view" class="view-container" hidden>
<div id="table-content"></div>
<div id="table-empty" class="empty-state">Paste a ruleset and click <b>Analyze</b> to see the rules table.</div>
</div>
<div id="lint-view" class="view-container" hidden>
<div id="lint-content"></div>
<div id="lint-empty" class="empty-state">Paste a ruleset and click <b>Analyze</b> to run the linter.</div>
<div id="lint-clean" class="empty-state" hidden>No smells found. Your ruleset passes every linter check.</div>
</div>
<div id="trace-view" class="view-container" hidden>
<div id="trace-empty" class="empty-state">Paste a ruleset and click <b>Analyze</b> first, then describe a packet here to trace it.</div>
<div id="trace-ui" hidden>
<form id="trace-form" class="trace-form">
<div class="trace-row">
<label>Direction
<select id="trace-direction">
<option value="input">incoming (INPUT)</option>
<option value="output">outgoing (OUTPUT)</option>
<option value="forward">forwarded (FORWARD)</option>
</select>
</label>
<label>Protocol
<select id="trace-proto">
<option value="tcp">tcp</option>
<option value="udp">udp</option>
<option value="icmp">icmp</option>
<option value="icmpv6">icmpv6</option>
<option value="sctp">sctp</option>
</select>
</label>
<label>State
<select id="trace-state">
<option value="NEW">NEW</option>
<option value="ESTABLISHED">ESTABLISHED</option>
<option value="RELATED">RELATED</option>
<option value="">(unset)</option>
</select>
</label>
</div>
<div class="trace-row">
<label>Source IP <input id="trace-src" type="text" placeholder="10.0.0.5"></label>
<label>Source port <input id="trace-sport" type="number" min="1" max="65535" placeholder="(any)"></label>
</div>
<div class="trace-row">
<label>Destination IP <input id="trace-dst" type="text" placeholder="192.168.1.1 (host)"></label>
<label>Destination port <input id="trace-dport" type="number" min="1" max="65535" placeholder="22"></label>
</div>
<div class="trace-row">
<label>Incoming iface (-i) <input id="trace-iif" type="text" placeholder="eth0 / lo / (any)"></label>
<label>Outgoing iface (-o) <input id="trace-oif" type="text" placeholder="eth0 / lo / (any)"></label>
</div>
<div class="trace-row trace-actions">
<button id="trace-run" type="submit" class="primary">Run trace</button>
<button id="trace-clear" type="button">Clear</button>
</div>
</form>
<div id="trace-result" hidden>
<div id="trace-verdict" class="trace-verdict"></div>
<div id="trace-final"></div>
<div id="trace-warnings" class="trace-warnings" hidden></div>
<h4 class="trace-steps-title">Trace</h4>
<ol id="trace-steps" class="trace-steps"></ol>
</div>
</div>
</div>
</section>
</main>
<footer class="bottombar">
<span>v1.36.0</span>
<span>·</span>
<span>MIT</span>
<span>·</span>
<span>Built by <a href="https://github.com/DannyRuizB" target="_blank" rel="noopener">DannyRuizB</a></span>
</footer>
<script src="https://cdn.jsdelivr.net/npm/cytoscape@3.30.2/dist/cytoscape.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/dagre@0.8.5/dist/dagre.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/cytoscape-dagre@2.5.0/cytoscape-dagre.js"></script>
<script src="https://cdn.jsdelivr.net/npm/cytoscape-svg@0.4.0/cytoscape-svg.js"></script>
<script src="https://cdn.jsdelivr.net/npm/cytoscape-grid-guide@2.3.3/cytoscape-grid-guide.js"></script>
<script src="src/parsers/iptables.js"></script>
<script src="src/parsers/ip6tables.js"></script>
<script src="src/parsers/nftables.js"></script>
<script src="src/parsers/ufw.js"></script>
<script src="src/parser.js"></script>
<script src="src/diff.js"></script>
<script src="src/linter.js"></script>
<script src="src/trace.js"></script>
<script src="src/graph.js"></script>
<script src="src/app.js"></script>
</body>
</html>