OS-7667 IPFilter needs to keep and report state for cloud firewall logging
Portions contributed by: Mike Gerdts <mike.gerdts@joyent.com>

@@ -4,10 +4,11 @@
  *
  * See the IPFILTER.LICENCE file for details on licencing.
  *
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include "ipf.h"
 #include <sys/ioctl.h>
 #include <syslog.h>

@@ -14,10 +15,11 @@
 #ifdef IPFILTER_BPF
 # include "pcap-bpf.h"
 # define _NET_BPF_H_
 # include <pcap.h>
 #endif
+#include <uuid/uuid.h>
 #include "netinet/ip_pool.h"
 #include "netinet/ip_htable.h"
 #include "netinet/ipl.h"
 #include "ipf_l.h"
 

@@ -96,10 +98,11 @@
         struct  {
                 union   i6addr  a;
                 union   i6addr  m;
         } ipp;
         union   i6addr  ip6;
+        uuid_t  uuid;
 };
 
 %type   <port>  portnum
 %type   <num>   facility priority icmpcode seclevel secname icmptype
 %type   <num>   opt compare range opttype flagset optlist ipv6hdrlist ipv6hdr

@@ -115,10 +118,11 @@
 %token  <str>   YY_STR
 %token          YY_COMMENT
 %token          YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT
 %token          YY_RANGE_OUT YY_RANGE_IN
 %token  <ip6>   YY_IPV6
+%token  <uuid>  YY_UUID
 
 %token  IPFY_PASS IPFY_BLOCK IPFY_COUNT IPFY_CALL
 %token  IPFY_RETICMP IPFY_RETRST IPFY_RETICMPASDST
 %token  IPFY_IN IPFY_OUT
 %token  IPFY_QUICK IPFY_ON IPFY_OUTVIA IPFY_INVIA

@@ -125,10 +129,11 @@
 %token  IPFY_DUPTO IPFY_TO IPFY_FROUTE IPFY_REPLY_TO IPFY_ROUTETO
 %token  IPFY_TOS IPFY_TTL IPFY_PROTO
 %token  IPFY_HEAD IPFY_GROUP
 %token  IPFY_AUTH IPFY_PREAUTH
 %token  IPFY_LOG IPFY_BODY IPFY_FIRST IPFY_LEVEL IPFY_ORBLOCK
+%token  IPFY_UUID IPFY_CFWLOG
 %token  IPFY_LOGTAG IPFY_MATCHTAG IPFY_SETTAG IPFY_SKIP
 %token  IPFY_FROM IPFY_ALL IPFY_ANY IPFY_BPFV4 IPFY_BPFV6 IPFY_POOL IPFY_HASH
 %token  IPFY_PPS
 %token  IPFY_ESP IPFY_AH
 %token  IPFY_WITH IPFY_AND IPFY_NOT IPFY_NO IPFY_OPT

@@ -516,10 +521,12 @@
         ;
 
 taginspec:
         logtag
         |nattag
+        |uuidtag
+        |cfwtag
         ;
 
 nattag: IPFY_NAT '=' YY_STR             { DOALL(strncpy(fr->fr_nattag.ipt_tag,\
                                                 $3, IPFTAG_LEN););
                                           free($3); }

@@ -528,10 +535,16 @@
         ;
 
 logtag: IPFY_LOG '=' YY_NUMBER          { DOALL(fr->fr_logtag = $3;) }
         ;
 
+cfwtag: IPFY_CFWLOG                     { DOALL(fr->fr_flags |= FR_CFWLOG;) }
+        ;
+
+uuidtag: IPFY_UUID '=' YY_UUID          { DOALL(uuid_copy(fr->fr_uuid, $3);) }
+        ;
+
 settagout:
         | IPFY_SETTAG '(' tagoutlist ')'
         ;
 
 tagoutlist:

@@ -540,10 +553,12 @@
         ;
 
 tagoutspec:
         logtag
         | nattag
+        | uuidtag
+        | cfwtag
         ;
 
 matchtagin:
         | IPFY_MATCHTAG '(' tagoutlist ')'
         ;

@@ -1564,10 +1579,11 @@
         { "bpf-v4",                     IPFY_BPFV4 },
 #ifdef USE_INET6
         { "bpf-v6",                     IPFY_BPFV6 },
 #endif
         { "call",                       IPFY_CALL },
+        { "cfwlog",                     IPFY_CFWLOG },
         { "code",                       IPFY_ICMPCODE },
         { "count",                      IPFY_COUNT },
         { "dup-to",                     IPFY_DUPTO },
         { "eq",                         YY_CMP_EQ },
         { "esp",                        IPFY_ESP },

@@ -1639,10 +1655,11 @@
         { "tcp-udp",                    IPFY_TCPUDP },
         { "tos",                        IPFY_TOS },
         { "to",                         IPFY_TO },
         { "ttl",                        IPFY_TTL },
         { "udp",                        IPFY_UDP },
+        { "uuid",                       IPFY_UUID },
         { "v6hdrs",                     IPF6_V6HDRS },
         { "with",                       IPFY_WITH },
         { NULL,                         0 }
 };