Pixparser takes a Cisco PIX firewall configuration, parses the rules and output this in an easy to read format.
Tool source:
#!C:/Perl/Bin/perl -w
# Author: Wiseman (wiseman@spray.se)
# Filename: pixparser.pl
# Current Version: 0.7 beta
# Created: 28th of March 2003
# Last Changed: 7th of October 2003
# -------------------------------------------------------------------------
# Description:
# ------------------------------------------------------------------------
# This is a rather crude and quick hacked Perl-script to extract the
# access-lists from a Cisco PIX and make them more read-able
# This is beta and probably will stay that way for some time!
# -------------------------------------------------------------------------
# Known issues:
# ------------------------------------------------------------------------
# 1. A line like "access-list inbound_inet permit icmp any any echo-reply"
# will pass but the echo-reply won't be parsed as echo-reply but "All ports"
# Will fix this later bro!
# --------------------------------------------------------------------------
# Change History
# ------------------------------------------------------------------------
# 0.7 beta: (7th of October 2003)
# Found some bugs regarding RegEX-expressions. Forgot to anchor the
# pattern to the beginning with the ^sign.
#
# 0.6 beta (March 2003):
# First working version, still buggy
use strict;
###################################################################
### Declare local variables start
###################################################################
my $temp;
my $temp2;
my $temp3;
my $filler = " ";
my $numberofargs = @ARGV;
my $filename = $ARGV[1];
my @interfaces;
my @access_groups;
my @access_lists;
my @sorted_list;
my $subset;
my $details;
my $junk;
my $if_type;
my $if_name;
my $if_securitylevel;
my $ag_name;
my $ag_direction;
my $ag_bound_to_if_name;
my $al_name;
my $al_ip_udp_tcp;
my $al_deny_or_permit;
my $al_source;
my $al_dest;
my $al_source_dest;
my $al_temp;
my $al_port;
my $al_port_part1;
my $al_port_part2;
###################################################################
### Declare local variables end
###################################################################
###################################################################
### Input parser and Syntax start
###################################################################
print "\n==| pixparser.pl v. 0.7 beta (7th of October 2003) by Wiseman \(wiseman\@spray.se\) |==\n";
if ($numberofargs < 2) {
print "\nSyntax:\n";
print "-------\n";
print "pixparser.pl <Input filename> <Output filename>\n";
print "\n";
print "Mandatory arguments:\n";
print "-------------------\n";
print " <Input filename> : Name of inputfile. This file should contain the Cisco Pix configuration\n";
print " <Output filename> : Name of outputfile\n";
die ("\n");
} # End if
###################################################################
### Input parser and Syntax end
###################################################################
### Open input-file and put the contents in one HUGE array
open (PARSEFILE,$ARGV[0]) || die ("==| Error! Could not open file $ARGV[0]");
print "\nLoading PIX Configuration-file from $ARGV[0]...";
my @Parse_array = <PARSEFILE>;
my $Parsefile_size = @Parse_array;
print "Done\n";
close (PARSEFILE);
###################################################################
### Setup start
###################################################################
#
# When Setup is finished the Interfaces, Access-groups and Access-lists
# will end up in a array of its own. Bug-fix here! Forgot the ^ at first!
# Parse Interfaces (if)
foreach $temp (@Parse_array) {
if ($temp =~ (m/^nameif/i)) {
push (@interfaces, $temp);
} # End if
} # End foreach
# Parse Access groups
foreach $temp (@Parse_array) {
if ($temp =~ (m/^access-group/i)) {
push (@access_groups, $temp);
} # End if
} # End foreach
# Parse Access lists
foreach $temp (@Parse_array) {
if ($temp =~ (m/^access-list/i)) {
push (@access_lists, $temp);
} # End if
} # End foreach
###################################################################
### Setup end
###################################################################
# Check if this access-group is indeed linked to the Interface
# This is if AG
if ($if_name eq $ag_bound_to_if_name ) {
# Populate $details with a more easy to read info
# $details = "====| Access group name:$ag_name, Bound to Interface:$ag_bound_to_if_name, Direction of rules is $ag_direction-bound |====\n\n";
$details = "====| Access Group name:$ag_name, Direction of rules is $ag_direction-bound |====\n\n";
# Push the hit, ie the access list and its details onto the list
###################################################################
### Parsing end
###################################################################
###################################################################
### Save to file start
###################################################################
#my $filename = $ARGV[1];
open(OUTFILE,">$filename");
print "Saving output to $filename...";
print OUTFILE "====| pixparser.pl v. 0.6 beta by Wiseman \(wiseman\@spray.se\) |====";
foreach $temp (@sorted_list) {
print OUTFILE $temp;
} # end foreach
print "done\n";
close (OUTFILE);
###################################################################
### Save to file end
###################################################################
