|
31 | 31 | #include "extract.h"
|
32 | 32 | #include "af.h"
|
33 | 33 |
|
34 |
| -#include "pflog.h" |
| 34 | +/* |
| 35 | + * pflog headers, at least as they exist now. |
| 36 | + */ |
| 37 | +#define PFLOG_IFNAMSIZ 16 |
| 38 | +#define PFLOG_RULESET_NAME_SIZE 16 |
| 39 | + |
| 40 | +struct pf_addr { |
| 41 | + union { |
| 42 | + nd_ipv4 v4; |
| 43 | + nd_ipv6 v6; |
| 44 | + } pfa; /* 128-bit address */ |
| 45 | +#define v4 pfa.v4 |
| 46 | +#define v6 pfa.v6 |
| 47 | +}; |
| 48 | + |
| 49 | +struct pfloghdr { |
| 50 | + nd_uint8_t length; |
| 51 | + nd_uint8_t af; |
| 52 | + nd_uint8_t action; |
| 53 | + nd_uint8_t reason; |
| 54 | + char ifname[PFLOG_IFNAMSIZ]; |
| 55 | + char ruleset[PFLOG_RULESET_NAME_SIZE]; |
| 56 | + nd_uint32_t rulenr; |
| 57 | + nd_uint32_t subrulenr; |
| 58 | + nd_uint32_t uid; |
| 59 | + nd_int32_t pid; |
| 60 | + nd_uint32_t rule_uid; |
| 61 | + nd_int32_t rule_pid; |
| 62 | + nd_uint8_t dir; |
| 63 | +/* Minimum header length (without padding): 61 */ |
| 64 | +#define MIN_PFLOG_HDRLEN 61 |
| 65 | +#if defined(__OpenBSD__) |
| 66 | + nd_uint8_t rewritten; |
| 67 | + nd_uint8_t naf; |
| 68 | + nd_uint8_t pad[1]; |
| 69 | +#else |
| 70 | + nd_uint8_t pad[3]; |
| 71 | +#endif |
| 72 | +#if defined(__FreeBSD__) |
| 73 | + nd_uint32_t ridentifier; |
| 74 | + nd_uint8_t reserve; |
| 75 | + nd_uint8_t pad2[3]; |
| 76 | +#elif defined(__OpenBSD__) |
| 77 | + struct pf_addr saddr; |
| 78 | + struct pf_addr daddr; |
| 79 | + nd_uint16_t sport; |
| 80 | + nd_uint16_t dport; |
| 81 | +#endif |
| 82 | +}; |
| 83 | + |
| 84 | +/* |
| 85 | + * Reason values. |
| 86 | + */ |
| 87 | +#define PFRES_MATCH 0 |
| 88 | +#define PFRES_BADOFF 1 |
| 89 | +#define PFRES_FRAG 2 |
| 90 | +#define PFRES_SHORT 3 |
| 91 | +#define PFRES_NORM 4 |
| 92 | +#define PFRES_MEMORY 5 |
| 93 | +#define PFRES_TS 6 |
| 94 | +#define PFRES_CONGEST 7 |
| 95 | +#define PFRES_IPOPTIONS 8 |
| 96 | +#define PFRES_PROTCKSUM 9 |
| 97 | +#define PFRES_BADSTATE 10 |
| 98 | +#define PFRES_STATEINS 11 |
| 99 | +#define PFRES_MAXSTATES 12 |
| 100 | +#define PFRES_SRCLIMIT 13 |
| 101 | +#define PFRES_SYNPROXY 14 |
| 102 | +#if defined(__FreeBSD__) |
| 103 | +#define PFRES_MAPFAILED 15 |
| 104 | +#elif defined(__NetBSD__) |
| 105 | +#define PFRES_STATELOCKED 15 |
| 106 | +#elif defined(__OpenBSD__) |
| 107 | +#define PFRES_TRANSLATE 15 |
| 108 | +#define PFRES_NOROUTE 16 |
| 109 | +#elif defined(__APPLE__) |
| 110 | +#define PFRES_DUMMYNET 15 |
| 111 | +#endif |
35 | 112 |
|
36 | 113 | static const struct tok pf_reasons[] = {
|
37 | 114 | { PFRES_MATCH, "0(match)" },
|
@@ -62,6 +139,35 @@ static const struct tok pf_reasons[] = {
|
62 | 139 | { 0, NULL }
|
63 | 140 | };
|
64 | 141 |
|
| 142 | +/* |
| 143 | + * Action values. |
| 144 | + */ |
| 145 | +#define PF_PASS 0 |
| 146 | +#define PF_DROP 1 |
| 147 | +#define PF_SCRUB 2 |
| 148 | +#define PF_NOSCRUB 3 |
| 149 | +#define PF_NAT 4 |
| 150 | +#define PF_NONAT 5 |
| 151 | +#define PF_BINAT 6 |
| 152 | +#define PF_NOBINAT 7 |
| 153 | +#define PF_RDR 8 |
| 154 | +#define PF_NORDR 9 |
| 155 | +#define PF_SYNPROXY_DROP 10 |
| 156 | +#if defined(__FreeBSD__) |
| 157 | +#define PF_DEFER 11 |
| 158 | +#elif defined(__OpenBSD__) |
| 159 | +#define PF_DEFER 11 |
| 160 | +#define PF_MATCH 12 |
| 161 | +#define PF_DIVERT 13 |
| 162 | +#define PF_RT 14 |
| 163 | +#define PF_AFRT 15 |
| 164 | +#elif defined(__APPLE__) |
| 165 | +#define PF_DUMMYNET 11 |
| 166 | +#define PF_NODUMMYNET 12 |
| 167 | +#define PF_NAT64 13 |
| 168 | +#define PF_NONAT64 14 |
| 169 | +#endif |
| 170 | + |
65 | 171 | static const struct tok pf_actions[] = {
|
66 | 172 | { PF_PASS, "pass" },
|
67 | 173 | { PF_DROP, "block" },
|
@@ -90,6 +196,16 @@ static const struct tok pf_actions[] = {
|
90 | 196 | { 0, NULL }
|
91 | 197 | };
|
92 | 198 |
|
| 199 | +/* |
| 200 | + * Direction values. |
| 201 | + */ |
| 202 | +#define PF_INOUT 0 |
| 203 | +#define PF_IN 1 |
| 204 | +#define PF_OUT 2 |
| 205 | +#if defined(__OpenBSD__) |
| 206 | +#define PF_FWD 3 |
| 207 | +#endif |
| 208 | + |
93 | 209 | static const struct tok pf_directions[] = {
|
94 | 210 | { PF_INOUT, "in/out" },
|
95 | 211 | { PF_IN, "in" },
|
|
0 commit comments