This patchset adds support for the "numeric_label" option. For instance, it

can be used to determine if the packet has been dropped, rejected or accepted.
The meaning of label is completely user-defined.

Signed-off-by: Eric Leblond <eric@inl.fr>

diff --git a/doc/mysql-ulogd2.sql b/doc/mysql-ulogd2.sql
index 05ea9b4648d3e153e3c1cc11ecf4f16894bb3443..ba50f48917a682e418fa928d32b811fd16e92e75 100644 (file)
--- a/doc/mysql-ulogd2.sql
+++ b/doc/mysql-ulogd2.sql
@@ -58,6 +58,7 @@ CREATE TABLE `ulog2` (
   `ip_csum` smallint(5) unsigned default NULL,
   `ip_id` smallint(5) unsigned default NULL,
   `ip_fragoff` smallint(5) unsigned default NULL,
+  `label` tinyint(3) unsigned default NULL,
   `timestamp` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
   UNIQUE KEY `key_id` (`_id`)
 ) ENGINE=INNODB COMMENT='Table for IP packets';
@@ -213,7 +214,8 @@ CREATE SQL SECURITY INVOKER VIEW `ulog` AS
        icmpv6_echoseq,
        icmpv6_csum,
        mac_saddr as mac_saddr_str,
-       mac_protocol as oob_protocol
+       mac_protocol as oob_protocol,
+       label as raw_label
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
                 LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;
@@ -493,7 +495,8 @@ CREATE FUNCTION INSERT_IP_PACKET_FULL(
                _ip_ihl tinyint(3) unsigned,
                _ip_csum smallint(5) unsigned,
                _ip_id smallint(5) unsigned,
-               _ip_fragoff smallint(5) unsigned
+               _ip_fragoff smallint(5) unsigned,
+               _label tinyint(4) unsigned
                ) RETURNS int(10) unsigned
 SQL SECURITY INVOKER
 NOT DETERMINISTIC
@@ -501,10 +504,10 @@ READS SQL DATA
 BEGIN
        INSERT INTO ulog2 (oob_time_sec, oob_time_usec, oob_hook, oob_prefix, oob_mark, oob_in, oob_out, oob_family,
                           ip_saddr, ip_daddr, ip_protocol, ip_tos, ip_ttl, ip_totlen, ip_ihl,
-                          ip_csum, ip_id, ip_fragoff ) VALUES 
+                          ip_csum, ip_id, ip_fragoff, label ) VALUES 
                (_oob_time_sec, _oob_time_usec, _oob_hook, _oob_prefix, _oob_mark, _oob_in, _oob_out, _oob_family,
                 _ip_saddr, _ip_daddr, _ip_protocol, _ip_tos, _ip_ttl, _ip_totlen, _ip_ihl,
-                _ip_csum, _ip_id, _ip_fragoff);
+                _ip_csum, _ip_id, _ip_fragoff, _label);
        RETURN LAST_INSERT_ID();
 END
 $$
@@ -660,7 +663,8 @@ CREATE FUNCTION INSERT_PACKET_FULL(
                icmpv6_echoseq smallint(5) unsigned,
                icmpv6_csum int(10) unsigned,
                mac_saddr varchar(32),
-               mac_protocol smallint(5)
+               mac_protocol smallint(5),
+               _label tinyint(4) unsigned
                ) RETURNS bigint unsigned
 READS SQL DATA
 BEGIN
@@ -668,7 +672,7 @@ BEGIN
                                           _oob_mark, _oob_in, _oob_out, _oob_family, 
                                           _ip_saddr, _ip_daddr, _ip_protocol, _ip_tos,
                                           _ip_ttl, _ip_totlen, _ip_ihl, _ip_csum, _ip_id,
-                                          _ip_fragoff);
+                                          _ip_fragoff, _label);
        IF _ip_protocol = 6 THEN
                CALL PACKET_ADD_TCP_FULL(@lastid, tcp_sport, tcp_dport, tcp_seq, tcp_ackseq,
                                         tcp_window, tcp_urg, tcp_urgp, tcp_ack, tcp_psh,

diff --git a/doc/pgsql-ulogd2.sql b/doc/pgsql-ulogd2.sql
index a5d686d004fb2f278df064858495d5f49ddac35b..cd2d9118bd2b256e117dd4fbecab6fc2ccdc7bfa 100644 (file)
--- a/doc/pgsql-ulogd2.sql
+++ b/doc/pgsql-ulogd2.sql
@@ -57,6 +57,7 @@ CREATE TABLE ulog2 (
   ip_csum integer default NULL,
   ip_id integer default NULL,
   ip_fragoff smallint default NULL,
+  label smallint default NULL,
   timestamp timestamp NOT NULL default 'now'
 ) WITH (OIDS=FALSE);
 
@@ -191,7 +192,8 @@ CREATE OR REPLACE VIEW ulog AS
         icmpv6_echoseq,
         icmpv6_csum,
         mac_saddr AS mac_saddr_str,
-        mac_protocol AS oob_protocol
+        mac_protocol AS oob_protocol,
+        label AS raw_label
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
                 LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;
@@ -360,13 +362,14 @@ CREATE OR REPLACE FUNCTION INSERT_IP_PACKET_FULL(
                 IN ip_ihl integer,
                 IN ip_csum integer,
                 IN ip_id integer,
-                IN ip_fragoff integer
+                IN ip_fragoff integer,
+                IN label integer
         )
 RETURNS bigint AS $$
         INSERT INTO ulog2 (oob_time_sec,oob_time_usec,oob_hook,oob_prefix,oob_mark,
                         oob_in,oob_out,oob_family,ip_saddr_str,ip_daddr_str,ip_protocol,
-                        ip_tos,ip_ttl,ip_totlen,ip_ihl,ip_csum,ip_id,ip_fragoff)
-                VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18);
+                        ip_tos,ip_ttl,ip_totlen,ip_ihl,ip_csum,ip_id,ip_fragoff,label)
+                VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19);
         SELECT currval('ulog2__id_seq');
 $$ LANGUAGE SQL SECURITY INVOKER;
 
@@ -492,13 +495,14 @@ CREATE OR REPLACE FUNCTION INSERT_PACKET_FULL(
                 IN icmpv6_echoseq integer,
                 IN icmpv6_csum integer,
                 IN mac_saddr varchar(32),
-                IN mac_protocol integer
+                IN mac_protocol integer,
+                IN label integer
         )
 RETURNS bigint AS $$
 DECLARE
         _id bigint;
 BEGIN
-        _id := INSERT_IP_PACKET_FULL($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18) ;
+        _id := INSERT_IP_PACKET_FULL($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$47);
         IF (ip_protocol = 6) THEN
                 PERFORM INSERT_TCP_FULL(_id,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30);
         ELSIF (ip_protocol = 17) THEN

diff --git a/input/packet/ulogd_inppkt_NFLOG.c b/input/packet/ulogd_inppkt_NFLOG.c
index 9887e862fc91af0b5ab87e502478d06040787dba..bb69bb6b8564550675e893ab8177c491725a56c8 100644 (file)
--- a/input/packet/ulogd_inppkt_NFLOG.c
+++ b/input/packet/ulogd_inppkt_NFLOG.c
@@ -34,7 +34,7 @@ struct nflog_input {
 /* configuration entries */
 
 static struct config_keyset libulog_kset = {
-       .num_ces = 7,
+       .num_ces = 8,
        .ces = {
                {
                        .key     = "bufsize",
@@ -78,6 +78,13 @@ static struct config_keyset libulog_kset = {
                        .options = CONFIG_OPT_NONE,
                        .u.value = 0,
                },
+               {
+                       .key     = "numeric_label",
+                       .type    = CONFIG_TYPE_INT,
+                       .options = CONFIG_OPT_NONE,
+                       .u.value = 0,
+               },
+
        }
 };
 
@@ -88,6 +95,7 @@ static struct config_keyset libulog_kset = {
 #define unbind_ce(x)   (x->ces[4])
 #define seq_ce(x)      (x->ces[5])
 #define seq_global_ce(x)       (x->ces[6])
+#define label_ce(x)    (x->ces[7])
 
 enum nflog_keys {
        NFLOG_KEY_RAW_MAC = 0,
@@ -108,6 +116,7 @@ enum nflog_keys {
        NFLOG_KEY_OOB_PROTOCOL,
        NFLOG_KEY_OOB_UID,
        NFLOG_KEY_OOB_GID,
+       NFLOG_KEY_RAW_LABEL,
 };
 
 static struct ulogd_key output_keys[] = {
@@ -252,6 +261,12 @@ static struct ulogd_key output_keys[] = {
                .flags = ULOGD_RETF_NONE,
                .name = "oob.gid",
        },
+       {
+               .type = ULOGD_RET_UINT8,
+               .flags = ULOGD_RETF_NONE,
+               .name = "raw.label",
+       },
+
 };
 
 static inline int 
@@ -275,6 +290,9 @@ interp_packet(struct ulogd_pluginstance *upi, struct nflog_data *ldata)
        ret[NFLOG_KEY_OOB_FAMILY].u.value.ui8 = af_ce(upi->config_kset).u.value;
        ret[NFLOG_KEY_OOB_FAMILY].flags |= ULOGD_RETF_VALID;
 
+       ret[NFLOG_KEY_RAW_LABEL].u.value.ui8 = label_ce(upi->config_kset).u.value;
+       ret[NFLOG_KEY_RAW_LABEL].flags |= ULOGD_RETF_VALID;
+
        if (ph) {
                /* FIXME */
                ret[NFLOG_KEY_OOB_HOOK].u.value.ui8 = ph->hook;

diff --git a/input/packet/ulogd_inppkt_ULOG.c b/input/packet/ulogd_inppkt_ULOG.c
index 51122810fd73fa7cedb9b278a2635a18eb5ceb43..253bbe050713cc9d5af95a498adef44b34e54bd9 100644 (file)
--- a/input/packet/ulogd_inppkt_ULOG.c
+++ b/input/packet/ulogd_inppkt_ULOG.c
@@ -34,7 +34,7 @@ struct ulog_input {
 /* configuration entries */
 
 static struct config_keyset libulog_kset = {
-       .num_ces = 3,
+       .num_ces = 4,
        .ces = {
        {
                .key     = "bufsize",
@@ -54,6 +54,13 @@ static struct config_keyset libulog_kset = {
                .options = CONFIG_OPT_NONE,
                .u.value = ULOGD_RMEM_DEFAULT,
        },
+       {
+               .key     = "numeric_label",
+               .type    = CONFIG_TYPE_INT,
+               .options = CONFIG_OPT_NONE,
+               .u.value = 0,
+       },
+
        }
 };
 enum ulog_keys {
@@ -71,6 +78,7 @@ enum ulog_keys {
        ULOG_KEY_RAW_MAC_LEN,
        ULOG_KEY_OOB_FAMILY,
        ULOG_KEY_OOB_PROTOCOL,
+       ULOG_KEY_RAW_LABEL,
 };
 
 static struct ulogd_key output_keys[] = {
@@ -167,6 +175,11 @@ static struct ulogd_key output_keys[] = {
                .flags = ULOGD_RETF_NONE,
                .name = "oob.protocol",
        },
+       {
+               .type = ULOGD_RET_UINT8,
+               .flags = ULOGD_RETF_NONE,
+               .name = "raw.label",
+       },
 
 };
 
@@ -181,6 +194,9 @@ static int interp_packet(struct ulogd_pluginstance *ip, ulog_packet_msg_t *pkt)
                ret[ULOG_KEY_RAW_MAC_LEN].flags |= ULOGD_RETF_VALID;
        }
 
+       ret[ULOG_KEY_RAW_LABEL].u.value.ui8 = ip->config_kset->ces[3].u.value;
+       ret[ULOG_KEY_RAW_LABEL].flags |= ULOGD_RETF_VALID;
+
        /* include pointer to raw ipv4 packet */
        ret[ULOG_KEY_RAW_PCKT].u.value.ptr = pkt->payload;
        ret[ULOG_KEY_RAW_PCKT].flags |= ULOGD_RETF_VALID;

diff --git a/ulogd.conf.in b/ulogd.conf.in
index 3def8d1c2e8e2b4f77112c3886ab5a9af4b58d25..433965099b523fd44e3cc531ae341d7a5af99a64 100644 (file)
--- a/ulogd.conf.in
+++ b/ulogd.conf.in
@@ -97,6 +97,7 @@ group=0
 [log2]
 group=1 # Group has to be different from the one use in log1
 addressfamily=10 # 10 is value of AF_INET6
+numeric_label=1 # you can label the log info based on the packet verdict
 
 # ebtables logging through NFLOG
 [log3]
@@ -106,6 +107,7 @@ addressfamily=7 # 7 is value of AF_BRIDGE
 [ulog1]
 # netlink multicast group (the same as the iptables --ulog-nlgroup param)
 nlgroup=1
+#numeric_label=0 # optional argument
 
 [emu1]
 file="/var/log/ulogd_syslogemu.log"