mattly/bork — pull request #10 by mattly (2014-05-11 01:46:49+00:00)
Title: iptables assertion type

It's *really* naive for now, but I'm not sure how to improve it in a simple manner. Possibly:
``` bash
ok iptables \
"INPUT -i lo -j ACCEPT" \
"INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT" \
"INPUT -p tcp --dport 80 -j ACCEPT" \
"INPUT -p tcp --dport 443 -j ACCEPT" \
"INPUT -p tcp --dport 22 -j ACCEPT" \
"INPUT -j DROP"
```
where it'd check each rule in order, and verify that it occurred after the previous one. This would allow for unspecified rules to still exist (f.e., fail2ban) and yet still validate the rules we want.

What I'm doing now is basically:
``` bash
ok iptables "INPUT -i lo -j ACCEPT"
ok iptables "INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
ok iptables "INPUT -p tcp --dport 80 -j ACCEPT"
ok iptables "INPUT -p tcp --dport 443 -j ACCEPT"
ok iptables "INPUT -p tcp --dport 22 -j ACCEPT"
ok iptables "INPUT -j DROP"
```
but there's no way to assert, for example that the final DROP happens at the end of the chain. If I were to somehow add a concept of state to the assertion types (I want/need caching anyway), then the iptables type could assert that any new rules in a chain come after previous rules in that same chain. But I don't have any state for the type assertion functions yet.