141edb306SCy Schubert 241edb306SCy Schubert /* 341edb306SCy Schubert * Copyright (C) 2012 by Darren Reed. 441edb306SCy Schubert * 541edb306SCy Schubert * See the IPFILTER.LICENCE file for details on licencing. 641edb306SCy Schubert * $Id$ 741edb306SCy Schubert */ 841edb306SCy Schubert 941edb306SCy Schubert typedef struct ipmon_msg_s { 1041edb306SCy Schubert int imm_msglen; 1141edb306SCy Schubert char *imm_msg; 1241edb306SCy Schubert int imm_dsize; 1341edb306SCy Schubert void *imm_data; 1441edb306SCy Schubert time_t imm_when; 1541edb306SCy Schubert int imm_loglevel; 1641edb306SCy Schubert } ipmon_msg_t; 1741edb306SCy Schubert 1841edb306SCy Schubert typedef void (*ims_destroy_func_t)(void *); 1941edb306SCy Schubert typedef void *(*ims_dup_func_t)(void *); 2041edb306SCy Schubert typedef int (*ims_match_func_t)(void *, void *); 2141edb306SCy Schubert typedef void *(*ims_parse_func_t)(char **); 2241edb306SCy Schubert typedef void (*ims_print_func_t)(void *); 2341edb306SCy Schubert typedef int (*ims_store_func_t)(void *, ipmon_msg_t *); 2441edb306SCy Schubert 2541edb306SCy Schubert typedef struct ipmon_saver_s { 2641edb306SCy Schubert char *ims_name; 2741edb306SCy Schubert ims_destroy_func_t ims_destroy; 2841edb306SCy Schubert ims_dup_func_t ims_dup; 2941edb306SCy Schubert ims_match_func_t ims_match; 3041edb306SCy Schubert ims_parse_func_t ims_parse; 3141edb306SCy Schubert ims_print_func_t ims_print; 3241edb306SCy Schubert ims_store_func_t ims_store; 3341edb306SCy Schubert } ipmon_saver_t; 3441edb306SCy Schubert 3541edb306SCy Schubert typedef struct ipmon_saver_int_s { 3641edb306SCy Schubert struct ipmon_saver_int_s *imsi_next; 3741edb306SCy Schubert ipmon_saver_t *imsi_stor; 3841edb306SCy Schubert void *imsi_handle; 3941edb306SCy Schubert } ipmon_saver_int_t; 4041edb306SCy Schubert 4141edb306SCy Schubert typedef struct ipmon_doing_s { 4241edb306SCy Schubert struct ipmon_doing_s *ipmd_next; 4341edb306SCy Schubert void *ipmd_token; 4441edb306SCy Schubert ipmon_saver_t *ipmd_saver; 4541edb306SCy Schubert /* 4641edb306SCy Schubert * ipmd_store is "cached" in this structure to avoid a double 4741edb306SCy Schubert * deref when doing saves.... 4841edb306SCy Schubert */ 4941edb306SCy Schubert int (*ipmd_store)(void *, ipmon_msg_t *); 5041edb306SCy Schubert } ipmon_doing_t; 5141edb306SCy Schubert 5241edb306SCy Schubert 5341edb306SCy Schubert typedef struct ipmon_action { 5441edb306SCy Schubert struct ipmon_action *ac_next; 5541edb306SCy Schubert int ac_mflag; /* collection of things to compare */ 5641edb306SCy Schubert int ac_dflag; /* flags to compliment the doing fields */ 5741edb306SCy Schubert int ac_logpri; 5841edb306SCy Schubert int ac_direction; 5941edb306SCy Schubert char ac_group[FR_GROUPLEN]; 6041edb306SCy Schubert char ac_nattag[16]; 6141edb306SCy Schubert u_32_t ac_logtag; 6241edb306SCy Schubert int ac_type; /* nat/state/ipf */ 6341edb306SCy Schubert int ac_proto; 6441edb306SCy Schubert int ac_rule; 6541edb306SCy Schubert int ac_packet; 6641edb306SCy Schubert int ac_second; 6741edb306SCy Schubert int ac_result; 6841edb306SCy Schubert u_32_t ac_sip; 6941edb306SCy Schubert u_32_t ac_smsk; 7041edb306SCy Schubert u_32_t ac_dip; 7141edb306SCy Schubert u_32_t ac_dmsk; 7241edb306SCy Schubert u_short ac_sport; 7341edb306SCy Schubert u_short ac_dport; 7441edb306SCy Schubert char *ac_iface; 7541edb306SCy Schubert /* 7641edb306SCy Schubert * used with ac_packet/ac_second 7741edb306SCy Schubert */ 7841edb306SCy Schubert struct timeval ac_last; 7941edb306SCy Schubert int ac_pktcnt; 8041edb306SCy Schubert /* 8141edb306SCy Schubert * What to do with matches 8241edb306SCy Schubert */ 8341edb306SCy Schubert ipmon_doing_t *ac_doing; 8441edb306SCy Schubert } ipmon_action_t; 8541edb306SCy Schubert 8641edb306SCy Schubert #define ac_lastsec ac_last.tv_sec 8741edb306SCy Schubert #define ac_lastusec ac_last.tv_usec 8841edb306SCy Schubert 8941edb306SCy Schubert /* 9041edb306SCy Schubert * Flags indicating what fields to do matching upon (ac_mflag). 9141edb306SCy Schubert */ 9241edb306SCy Schubert #define IPMAC_DIRECTION 0x0001 9341edb306SCy Schubert #define IPMAC_DSTIP 0x0002 9441edb306SCy Schubert #define IPMAC_DSTPORT 0x0004 9541edb306SCy Schubert #define IPMAC_EVERY 0x0008 9641edb306SCy Schubert #define IPMAC_GROUP 0x0010 9741edb306SCy Schubert #define IPMAC_INTERFACE 0x0020 9841edb306SCy Schubert #define IPMAC_LOGTAG 0x0040 9941edb306SCy Schubert #define IPMAC_NATTAG 0x0080 10041edb306SCy Schubert #define IPMAC_PROTOCOL 0x0100 10141edb306SCy Schubert #define IPMAC_RESULT 0x0200 10241edb306SCy Schubert #define IPMAC_RULE 0x0400 10341edb306SCy Schubert #define IPMAC_SRCIP 0x0800 10441edb306SCy Schubert #define IPMAC_SRCPORT 0x1000 10541edb306SCy Schubert #define IPMAC_TYPE 0x2000 10641edb306SCy Schubert #define IPMAC_WITH 0x4000 10741edb306SCy Schubert 10841edb306SCy Schubert #define IPMR_BLOCK 1 10941edb306SCy Schubert #define IPMR_PASS 2 11041edb306SCy Schubert #define IPMR_NOMATCH 3 11141edb306SCy Schubert #define IPMR_LOG 4 11241edb306SCy Schubert 11341edb306SCy Schubert #define IPMON_SYSLOG 0x001 11441edb306SCy Schubert #define IPMON_RESOLVE 0x002 11541edb306SCy Schubert #define IPMON_HEXBODY 0x004 11641edb306SCy Schubert #define IPMON_HEXHDR 0x010 11741edb306SCy Schubert #define IPMON_TAIL 0x020 11841edb306SCy Schubert #define IPMON_VERBOSE 0x040 11941edb306SCy Schubert #define IPMON_NAT 0x080 12041edb306SCy Schubert #define IPMON_STATE 0x100 12141edb306SCy Schubert #define IPMON_FILTER 0x200 12241edb306SCy Schubert #define IPMON_PORTNUM 0x400 12341edb306SCy Schubert #define IPMON_LOGALL (IPMON_NAT|IPMON_STATE|IPMON_FILTER) 12441edb306SCy Schubert #define IPMON_LOGBODY 0x800 12541edb306SCy Schubert 12641edb306SCy Schubert #define HOSTNAME_V4(a,b) hostname((a), 4, (u_32_t *)&(b)) 12741edb306SCy Schubert 12841edb306SCy Schubert #ifndef LOGFAC 12941edb306SCy Schubert #define LOGFAC LOG_LOCAL0 13041edb306SCy Schubert #endif 13141edb306SCy Schubert 13241edb306SCy Schubert extern void dump_config(void); 13341edb306SCy Schubert extern int load_config(char *); 13441edb306SCy Schubert extern void unload_config(void); 13541edb306SCy Schubert extern void dumphex(FILE *, int, char *, int); 13641edb306SCy Schubert extern int check_action(char *, char *, int, int); 13741edb306SCy Schubert extern char *getword(int); 13841edb306SCy Schubert extern void *add_doing(ipmon_saver_t *); 13941edb306SCy Schubert 140