.iptables configuration
This tool is aimed towards the simplification of netfilter configuration,
while not taking the power of netfilter and it's various extensions from the end
user. Configuration is done in java-like language, specially designed to minimize
iptables script redundancy, thus not requiring to write what has been already
written, using hierarchical rules, matlab-like vectors and filters applicable to
any part of network protocol hierarchy. This feature is currently limited and
requires changes in the compiler.
It is easy to create rather large and
sophisticated netfilter setup, only thanks to iptables and their great generality,
but without the requirment to write many lines of unreadable iptables script.
If you want to get feel of the final code get it
[here]
.the compiler
The compiler consist of two parts. Interfacing part is used to define
meaning to various classes used in firewall config. It acts as a glue between
iptables and firewall code. Firewall config part is used to define firewall rules,
those being processed create iptables rules. Compiler can transform it's
internal representation of rules and optimize them for shortest possible rule
traversal time.
It is possible to change the interfacing part, so that compiler would
generate different code. In the packet space, the selection of some packets and
allowing them to pass or not (firewalling) is not much different from the selection
of some and making them go through the wire (packet creating). This tool allows to
do both using the same language and the same features this language provides.
.the language
One writes the rules as for iptables, possibly with c or c++ comments.
There are two main types of expressions, and-expressions and or-expressions
(vectors). Expressions consist of words, ip addresses, numbers and strings, where
words only act as a representations of classes from interfacing part. Hierarchy of
expressions allows to create advanced rules with less writing, which implies
maintaining them with less reading, that in turn means experimenting with them with
ease.
To make this possible but keep the language simple is done through some
kind of multiple-dispatch, where class is virtual with respect to all classes
already defined in context of this class (c++ is virtual with respect to one
parametr, the this pointer). This is currently not very well thought out.
.final words
This tool looks like a bsd packet filter program (pf) but just by an
incident, it was designed in an intuitive way to do things and it claims not to be original or perfect.
But it is hoped it will bring more to packet handling than pf because the compiler
technology is used.