Log.optfrags: packet mirroring

1 files changed, 223 insertions, 54 deletions

diff --git a/test/output/filter/dump b/test/output/filter/dump
index 87ed7ae..e1466f3 100644
--- a/test/output/filter/dump
+++ b/test/output/filter/dump
@@ -173,7 +173,87 @@ Filter 15                   {"action":"pass","log":true}
   inet6/filter/OUTPUT       -j logpass-0
   inet6/filter/logpass-0    -m limit --limit 1/second -j LOG
 
-Filter 16                   {"log":"none"}
+Filter 16                   {"log":"dual"}
+(log)                       
+  inet/filter/FORWARD       -j logaccept-1
+  inet/filter/INPUT         -j logaccept-1
+  inet/filter/OUTPUT        -j logaccept-1
+  inet/filter/logaccept-1   -j LOG
+  inet/filter/logaccept-1   -j ACCEPT
+  inet6/filter/FORWARD      -j logaccept-1
+  inet6/filter/INPUT        -j logaccept-1
+  inet6/filter/OUTPUT       -j logaccept-1
+  inet6/filter/logaccept-1  -j LOG
+  inet6/filter/logaccept-1  -j TEE --gateway fc00::1
+  inet6/filter/logaccept-1  -j ACCEPT
+
+Filter 17                   {"action":"drop","log":"dual"}
+(log)                       
+  inet/filter/FORWARD       -j logdrop-3
+  inet/filter/INPUT         -j logdrop-3
+  inet/filter/OUTPUT        -j logdrop-3
+  inet/filter/logdrop-3     -j LOG
+  inet/filter/logdrop-3     -j DROP
+  inet6/filter/FORWARD      -j logdrop-3
+  inet6/filter/INPUT        -j logdrop-3
+  inet6/filter/OUTPUT       -j logdrop-3
+  inet6/filter/logdrop-3    -j LOG
+  inet6/filter/logdrop-3    -j TEE --gateway fc00::1
+  inet6/filter/logdrop-3    -j DROP
+
+Filter 18                   {"action":"pass","log":"dual"}
+(log)                       
+  inet/filter/FORWARD       -j logpass-1
+  inet/filter/INPUT         -j logpass-1
+  inet/filter/OUTPUT        -j logpass-1
+  inet/filter/logpass-1     -j LOG
+  inet6/filter/FORWARD      -j logpass-1
+  inet6/filter/INPUT        -j logpass-1
+  inet6/filter/OUTPUT       -j logpass-1
+  inet6/filter/logpass-1    -j LOG
+  inet6/filter/logpass-1    -j TEE --gateway fc00::1
+
+Filter 19                   {"log":"mirror"}
+(log)                       
+  inet/filter/FORWARD       -j logaccept-2
+  inet/filter/INPUT         -j logaccept-2
+  inet/filter/OUTPUT        -j logaccept-2
+  inet/filter/logaccept-2   -j TEE --gateway 10.0.0.1
+  inet/filter/logaccept-2   -j TEE --gateway 10.0.0.2
+  inet/filter/logaccept-2   -j ACCEPT
+  inet6/filter/FORWARD      -j logaccept-2
+  inet6/filter/INPUT        -j logaccept-2
+  inet6/filter/OUTPUT       -j logaccept-2
+  inet6/filter/logaccept-2  -j TEE --gateway fc00::2
+  inet6/filter/logaccept-2  -j ACCEPT
+
+Filter 20                   {"action":"drop","log":"mirror"}
+(log)                       
+  inet/filter/FORWARD       -j logdrop-4
+  inet/filter/INPUT         -j logdrop-4
+  inet/filter/OUTPUT        -j logdrop-4
+  inet/filter/logdrop-4     -j TEE --gateway 10.0.0.1
+  inet/filter/logdrop-4     -j TEE --gateway 10.0.0.2
+  inet/filter/logdrop-4     -j DROP
+  inet6/filter/FORWARD      -j logdrop-4
+  inet6/filter/INPUT        -j logdrop-4
+  inet6/filter/OUTPUT       -j logdrop-4
+  inet6/filter/logdrop-4    -j TEE --gateway fc00::2
+  inet6/filter/logdrop-4    -j DROP
+
+Filter 21                   {"action":"pass","log":"mirror"}
+(log)                       
+  inet/filter/FORWARD       -j logpass-2
+  inet/filter/INPUT         -j logpass-2
+  inet/filter/OUTPUT        -j logpass-2
+  inet/filter/logpass-2     -j TEE --gateway 10.0.0.1
+  inet/filter/logpass-2     -j TEE --gateway 10.0.0.2
+  inet6/filter/FORWARD      -j logpass-2
+  inet6/filter/INPUT        -j logpass-2
+  inet6/filter/OUTPUT       -j logpass-2
+  inet6/filter/logpass-2    -j TEE --gateway fc00::2
+
+Filter 22                   {"log":"none"}
 (log)                       
   inet/filter/FORWARD       -j ACCEPT
   inet/filter/INPUT         -j ACCEPT
@@ -182,7 +262,7 @@ Filter 16                   {"log":"none"}
   inet6/filter/INPUT        -j ACCEPT
   inet6/filter/OUTPUT       -j ACCEPT
 
-Filter 17                   {"action":"drop","log":"none"}
+Filter 23                   {"action":"drop","log":"none"}
 (log)                       
   inet/filter/FORWARD       -j DROP
   inet/filter/INPUT         -j DROP
@@ -191,7 +271,7 @@ Filter 17                   {"action":"drop","log":"none"}
   inet6/filter/INPUT        -j DROP
   inet6/filter/OUTPUT       -j DROP
 
-Filter 18                   {"action":"pass","log":"none"}
+Filter 24                   {"action":"pass","log":"none"}
 (log)                       
   inet/filter/FORWARD       
   inet/filter/INPUT         
@@ -200,42 +280,42 @@ Filter 18                   {"action":"pass","log":"none"}
   inet6/filter/INPUT        
   inet6/filter/OUTPUT       
 
-Filter 19                   {"log":"ulog"}
+Filter 25                   {"log":"ulog"}
 (log)                       
-  inet/filter/FORWARD       -j logaccept-1
-  inet/filter/INPUT         -j logaccept-1
-  inet/filter/OUTPUT        -j logaccept-1
-  inet/filter/logaccept-1   -m limit --limit 12/minute -j ULOG
-  inet/filter/logaccept-1   -j ACCEPT
-  inet6/filter/FORWARD      -j logaccept-1
-  inet6/filter/INPUT        -j logaccept-1
-  inet6/filter/OUTPUT       -j logaccept-1
-  inet6/filter/logaccept-1  -j ACCEPT
-
-Filter 20                   {"action":"drop","log":"ulog"}
+  inet/filter/FORWARD       -j logaccept-3
+  inet/filter/INPUT         -j logaccept-3
+  inet/filter/OUTPUT        -j logaccept-3
+  inet/filter/logaccept-3   -m limit --limit 12/minute -j ULOG
+  inet/filter/logaccept-3   -j ACCEPT
+  inet6/filter/FORWARD      -j logaccept-3
+  inet6/filter/INPUT        -j logaccept-3
+  inet6/filter/OUTPUT       -j logaccept-3
+  inet6/filter/logaccept-3  -j ACCEPT
+
+Filter 26                   {"action":"drop","log":"ulog"}
 (log)                       
-  inet/filter/FORWARD       -j logdrop-3
-  inet/filter/INPUT         -j logdrop-3
-  inet/filter/OUTPUT        -j logdrop-3
-  inet/filter/logdrop-3     -m limit --limit 12/minute -j ULOG
-  inet/filter/logdrop-3     -j DROP
-  inet6/filter/FORWARD      -j logdrop-3
-  inet6/filter/INPUT        -j logdrop-3
-  inet6/filter/OUTPUT       -j logdrop-3
-  inet6/filter/logdrop-3    -j DROP
-
-Filter 21                   {"action":"pass","log":"ulog"}
+  inet/filter/FORWARD       -j logdrop-5
+  inet/filter/INPUT         -j logdrop-5
+  inet/filter/OUTPUT        -j logdrop-5
+  inet/filter/logdrop-5     -m limit --limit 12/minute -j ULOG
+  inet/filter/logdrop-5     -j DROP
+  inet6/filter/FORWARD      -j logdrop-5
+  inet6/filter/INPUT        -j logdrop-5
+  inet6/filter/OUTPUT       -j logdrop-5
+  inet6/filter/logdrop-5    -j DROP
+
+Filter 27                   {"action":"pass","log":"ulog"}
 (log)                       
-  inet/filter/FORWARD       -j logpass-1
-  inet/filter/INPUT         -j logpass-1
-  inet/filter/OUTPUT        -j logpass-1
-  inet/filter/logpass-1     -m limit --limit 12/minute -j ULOG
+  inet/filter/FORWARD       -j logpass-3
+  inet/filter/INPUT         -j logpass-3
+  inet/filter/OUTPUT        -j logpass-3
+  inet/filter/logpass-3     -m limit --limit 12/minute -j ULOG
 
-Filter 22                   {"action":"pass","in":"_fw","log":"ulog"}
+Filter 28                   {"action":"pass","in":"_fw","log":"ulog"}
 (log)                       
   inet/filter/OUTPUT        -m limit --limit 12/minute -j ULOG
 
-Filter 23                   {"in":["_fw","A"]}
+Filter 29                   {"in":["_fw","A"]}
 (zone)                      
   inet/filter/FORWARD       -i eth0 -j ACCEPT
   inet/filter/INPUT         -i eth0 -j ACCEPT
@@ -244,12 +324,12 @@ Filter 23                   {"in":["_fw","A"]}
   inet6/filter/INPUT        -i eth0 -j ACCEPT
   inet6/filter/OUTPUT       -j ACCEPT
 
-Filter 24                   {"in":"B","out":"C"}
+Filter 30                   {"in":"B","out":"C"}
 (zone)                      
   inet/filter/FORWARD       -i eth1 -s 10.0.0.0/12 -o eth2 -d 10.1.0.0/12 -j ACCEPT
   inet/filter/FORWARD       -i eth1 -s 10.0.0.0/12 -o eth3 -d 10.1.0.0/12 -j ACCEPT
 
-Filter 25                   {"out":["_fw","B"]}
+Filter 31                   {"out":["_fw","B"]}
 (zone)                      
   inet/filter/FORWARD       -o eth1 -d 10.0.0.0/12 -j ACCEPT
   inet/filter/INPUT         -j ACCEPT
@@ -258,7 +338,7 @@ Filter 25                   {"out":["_fw","B"]}
   inet6/filter/INPUT        -j ACCEPT
   inet6/filter/OUTPUT       -o eth1 -d fc00::/7 -j ACCEPT
 
-Filter 26                   {"in":["A","B","C","D","E"],"out":["A","B","C","D","E"]}
+Filter 32                   {"in":["A","B","C","D","E"],"out":["A","B","C","D","E"]}
 (zone)                      
   inet/filter/FORWARD       -i eth0 -o eth1 -d 10.0.0.0/12 -j ACCEPT
   inet/filter/FORWARD       -i eth0 -o eth2 -d 10.1.0.0/12 -j ACCEPT
@@ -347,6 +427,12 @@ Limit D  {"inet":22,"inet6":58}
 Log _default  {"limit":1}
 (defaults)    
 
+Log dual      {"mirror":"fc00::1","mode":"log"}
+(log)         
+
+Log mirror    {"mirror":["10.0.0.1","10.0.0.2","fc00::2"]}
+(log)         
+
 Log none      {"mode":"none"}
 (log)         
 
@@ -397,7 +483,13 @@ Packet-log 1          {"out":"_fw"}
   inet/filter/INPUT   -m limit --limit 1/second -j LOG
   inet6/filter/INPUT  -m limit --limit 1/second -j LOG
 
-Packet-log 2          {"log":"ulog","out":"_fw"}
+Packet-log 2          {"log":"mirror","out":"_fw"}
+(log)                 
+  inet/filter/INPUT   -j TEE --gateway 10.0.0.1
+  inet/filter/INPUT   -j TEE --gateway 10.0.0.2
+  inet6/filter/INPUT  -j TEE --gateway fc00::2
+
+Packet-log 3          {"log":"ulog","out":"_fw"}
 (log)                 
   inet/filter/INPUT   -m limit --limit 12/minute -j ULOG
 
@@ -618,12 +710,18 @@ hash:net family inet
 :icmp-routing - [0:0]
 :logaccept-0 - [0:0]
 :logaccept-1 - [0:0]
+:logaccept-2 - [0:0]
+:logaccept-3 - [0:0]
 :logdrop-0 - [0:0]
 :logdrop-1 - [0:0]
 :logdrop-2 - [0:0]
 :logdrop-3 - [0:0]
+:logdrop-4 - [0:0]
+:logdrop-5 - [0:0]
 :logpass-0 - [0:0]
 :logpass-1 - [0:0]
+:logpass-2 - [0:0]
+:logpass-3 - [0:0]
 :logreject-0 - [0:0]
 :logtarpit-0 - [0:0]
 :tarpit - [0:0]
@@ -643,12 +741,18 @@ hash:net family inet
 -A FORWARD -j logaccept-0
 -A FORWARD -j logdrop-2
 -A FORWARD -j logpass-0
--A FORWARD -j ACCEPT
--A FORWARD -j DROP
--A FORWARD 
 -A FORWARD -j logaccept-1
 -A FORWARD -j logdrop-3
 -A FORWARD -j logpass-1
+-A FORWARD -j logaccept-2
+-A FORWARD -j logdrop-4
+-A FORWARD -j logpass-2
+-A FORWARD -j ACCEPT
+-A FORWARD -j DROP
+-A FORWARD 
+-A FORWARD -j logaccept-3
+-A FORWARD -j logdrop-5
+-A FORWARD -j logpass-3
 -A FORWARD -i eth0 -j ACCEPT
 -A FORWARD -i eth1 -s 10.0.0.0/12 -o eth2 -d 10.1.0.0/12 -j ACCEPT
 -A FORWARD -i eth1 -s 10.0.0.0/12 -o eth3 -d 10.1.0.0/12 -j ACCEPT
@@ -700,6 +804,8 @@ hash:net family inet
 -A FORWARD -m policy --dir in --pol ipsec -m policy --dir out --pol ipsec -j ACCEPT
 -A FORWARD -p icmp -j icmp-routing
 -A INPUT -m limit --limit 12/minute -j ULOG
+-A INPUT -j TEE --gateway 10.0.0.2
+-A INPUT -j TEE --gateway 10.0.0.1
 -A INPUT -m limit --limit 1/second -j LOG
 -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
 -A INPUT -i lo -j ACCEPT
@@ -718,12 +824,18 @@ hash:net family inet
 -A INPUT -j logaccept-0
 -A INPUT -j logdrop-2
 -A INPUT -j logpass-0
--A INPUT -j ACCEPT
--A INPUT -j DROP
--A INPUT 
 -A INPUT -j logaccept-1
 -A INPUT -j logdrop-3
 -A INPUT -j logpass-1
+-A INPUT -j logaccept-2
+-A INPUT -j logdrop-4
+-A INPUT -j logpass-2
+-A INPUT -j ACCEPT
+-A INPUT -j DROP
+-A INPUT 
+-A INPUT -j logaccept-3
+-A INPUT -j logdrop-5
+-A INPUT -j logpass-3
 -A INPUT -i eth0 -j ACCEPT
 -A INPUT -j ACCEPT
 -A INPUT -p icmp -j icmp-routing
@@ -744,12 +856,18 @@ hash:net family inet
 -A OUTPUT -j logaccept-0
 -A OUTPUT -j logdrop-2
 -A OUTPUT -j logpass-0
--A OUTPUT -j ACCEPT
--A OUTPUT -j DROP
--A OUTPUT 
 -A OUTPUT -j logaccept-1
 -A OUTPUT -j logdrop-3
 -A OUTPUT -j logpass-1
+-A OUTPUT -j logaccept-2
+-A OUTPUT -j logdrop-4
+-A OUTPUT -j logpass-2
+-A OUTPUT -j ACCEPT
+-A OUTPUT -j DROP
+-A OUTPUT 
+-A OUTPUT -j logaccept-3
+-A OUTPUT -j logdrop-5
+-A OUTPUT -j logpass-3
 -A OUTPUT -m limit --limit 12/minute -j ULOG
 -A OUTPUT -j ACCEPT
 -A OUTPUT -o eth1 -d 10.0.0.0/12 -j ACCEPT
@@ -759,18 +877,31 @@ hash:net family inet
 -A icmp-routing -p icmp --icmp-type 12 -j ACCEPT
 -A logaccept-0 -m limit --limit 1/second -j LOG
 -A logaccept-0 -j ACCEPT
--A logaccept-1 -m limit --limit 12/minute -j ULOG
+-A logaccept-1 -j LOG
 -A logaccept-1 -j ACCEPT
+-A logaccept-2 -j TEE --gateway 10.0.0.1
+-A logaccept-2 -j TEE --gateway 10.0.0.2
+-A logaccept-2 -j ACCEPT
+-A logaccept-3 -m limit --limit 12/minute -j ULOG
+-A logaccept-3 -j ACCEPT
 -A logdrop-0 -m limit --limit 1/second -j LOG
 -A logdrop-0 -j DROP
 -A logdrop-1 -m limit --limit 1/second -j LOG
 -A logdrop-1 -j DROP
 -A logdrop-2 -m limit --limit 1/second -j LOG
 -A logdrop-2 -j DROP
--A logdrop-3 -m limit --limit 12/minute -j ULOG
+-A logdrop-3 -j LOG
 -A logdrop-3 -j DROP
+-A logdrop-4 -j TEE --gateway 10.0.0.1
+-A logdrop-4 -j TEE --gateway 10.0.0.2
+-A logdrop-4 -j DROP
+-A logdrop-5 -m limit --limit 12/minute -j ULOG
+-A logdrop-5 -j DROP
 -A logpass-0 -m limit --limit 1/second -j LOG
--A logpass-1 -m limit --limit 12/minute -j ULOG
+-A logpass-1 -j LOG
+-A logpass-2 -j TEE --gateway 10.0.0.1
+-A logpass-2 -j TEE --gateway 10.0.0.2
+-A logpass-3 -m limit --limit 12/minute -j ULOG
 -A logreject-0 -m limit --limit 1/second -j LOG
 -A logreject-0 -j REJECT
 -A logtarpit-0 -m limit --limit 1/second -j LOG
@@ -824,11 +955,17 @@ COMMIT
 :icmp-routing - [0:0]
 :logaccept-0 - [0:0]
 :logaccept-1 - [0:0]
+:logaccept-2 - [0:0]
+:logaccept-3 - [0:0]
 :logdrop-0 - [0:0]
 :logdrop-1 - [0:0]
 :logdrop-2 - [0:0]
 :logdrop-3 - [0:0]
+:logdrop-4 - [0:0]
+:logdrop-5 - [0:0]
 :logpass-0 - [0:0]
+:logpass-1 - [0:0]
+:logpass-2 - [0:0]
 :logreject-0 - [0:0]
 :logtarpit-0 - [0:0]
 :tarpit - [0:0]
@@ -848,11 +985,17 @@ COMMIT
 -A FORWARD -j logaccept-0
 -A FORWARD -j logdrop-2
 -A FORWARD -j logpass-0
+-A FORWARD -j logaccept-1
+-A FORWARD -j logdrop-3
+-A FORWARD -j logpass-1
+-A FORWARD -j logaccept-2
+-A FORWARD -j logdrop-4
+-A FORWARD -j logpass-2
 -A FORWARD -j ACCEPT
 -A FORWARD -j DROP
 -A FORWARD 
--A FORWARD -j logaccept-1
--A FORWARD -j logdrop-3
+-A FORWARD -j logaccept-3
+-A FORWARD -j logdrop-5
 -A FORWARD -i eth0 -j ACCEPT
 -A FORWARD -o eth1 -d fc00::/7 -j ACCEPT
 -A FORWARD -i eth0 -o eth1 -d fc00::/7 -j ACCEPT
@@ -879,6 +1022,7 @@ COMMIT
 -A FORWARD -m policy --dir in --pol ipsec -o eth5 -j ACCEPT
 -A FORWARD -m policy --dir in --pol ipsec -m policy --dir out --pol ipsec -j ACCEPT
 -A FORWARD -p icmpv6 -j icmp-routing
+-A INPUT -j TEE --gateway fc00::2
 -A INPUT -m limit --limit 1/second -j LOG
 -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
 -A INPUT -i lo -j ACCEPT
@@ -897,11 +1041,17 @@ COMMIT
 -A INPUT -j logaccept-0
 -A INPUT -j logdrop-2
 -A INPUT -j logpass-0
+-A INPUT -j logaccept-1
+-A INPUT -j logdrop-3
+-A INPUT -j logpass-1
+-A INPUT -j logaccept-2
+-A INPUT -j logdrop-4
+-A INPUT -j logpass-2
 -A INPUT -j ACCEPT
 -A INPUT -j DROP
 -A INPUT 
--A INPUT -j logaccept-1
--A INPUT -j logdrop-3
+-A INPUT -j logaccept-3
+-A INPUT -j logdrop-5
 -A INPUT -i eth0 -j ACCEPT
 -A INPUT -j ACCEPT
 -A INPUT -p icmpv6 -j ACCEPT
@@ -922,11 +1072,17 @@ COMMIT
 -A OUTPUT -j logaccept-0
 -A OUTPUT -j logdrop-2
 -A OUTPUT -j logpass-0
+-A OUTPUT -j logaccept-1
+-A OUTPUT -j logdrop-3
+-A OUTPUT -j logpass-1
+-A OUTPUT -j logaccept-2
+-A OUTPUT -j logdrop-4
+-A OUTPUT -j logpass-2
 -A OUTPUT -j ACCEPT
 -A OUTPUT -j DROP
 -A OUTPUT 
--A OUTPUT -j logaccept-1
--A OUTPUT -j logdrop-3
+-A OUTPUT -j logaccept-3
+-A OUTPUT -j logdrop-5
 -A OUTPUT -j ACCEPT
 -A OUTPUT -o eth1 -d fc00::/7 -j ACCEPT
 -A OUTPUT -p icmpv6 -j ACCEPT
@@ -936,15 +1092,28 @@ COMMIT
 -A icmp-routing -p icmpv6 --icmpv6-type 4 -j ACCEPT
 -A logaccept-0 -m limit --limit 1/second -j LOG
 -A logaccept-0 -j ACCEPT
+-A logaccept-1 -j LOG
+-A logaccept-1 -j TEE --gateway fc00::1
 -A logaccept-1 -j ACCEPT
+-A logaccept-2 -j TEE --gateway fc00::2
+-A logaccept-2 -j ACCEPT
+-A logaccept-3 -j ACCEPT
 -A logdrop-0 -m limit --limit 1/second -j LOG
 -A logdrop-0 -j DROP
 -A logdrop-1 -m limit --limit 1/second -j LOG
 -A logdrop-1 -j DROP
 -A logdrop-2 -m limit --limit 1/second -j LOG
 -A logdrop-2 -j DROP
+-A logdrop-3 -j LOG
+-A logdrop-3 -j TEE --gateway fc00::1
 -A logdrop-3 -j DROP
+-A logdrop-4 -j TEE --gateway fc00::2
+-A logdrop-4 -j DROP
+-A logdrop-5 -j DROP
 -A logpass-0 -m limit --limit 1/second -j LOG
+-A logpass-1 -j LOG
+-A logpass-1 -j TEE --gateway fc00::1
+-A logpass-2 -j TEE --gateway fc00::2
 -A logreject-0 -m limit --limit 1/second -j LOG
 -A logreject-0 -j REJECT
 -A logtarpit-0 -m limit --limit 1/second -j LOG