[Dnsmasq-discuss] [PATCH v2 1/3] ipset: Integrate ipset.c into build system.
Jason A. Donenfeld
Jason at zx2c4.com
Sun Feb 17 22:16:39 GMT 2013
From: "Jason A. Donenfeld" <Jason at zx2c4.com>
---
Makefile | 2 +-
src/config.h | 14 +++-
src/dnsmasq.h | 5 ++
src/ipset.c | 220 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 239 insertions(+), 2 deletions(-)
create mode 100644 src/ipset.c
diff --git a/Makefile b/Makefile
index c9cdb90..7240fbf 100644
--- a/Makefile
+++ b/Makefile
@@ -65,7 +65,7 @@ version = -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
objs = cache.o rfc1035.o util.o option.o forward.o network.o \
dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
- dhcp-common.o outpacket.o radv.o slaac.o auth.o
+ dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o
hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
dns-protocol.h radv-protocol.h
diff --git a/src/config.h b/src/config.h
index cff278d..9c8e785 100644
--- a/src/config.h
+++ b/src/config.h
@@ -97,6 +97,10 @@ HAVE_CONNTRACK
a build-dependency on libnetfilter_conntrack, but the resulting binary will
still run happily on a kernel without conntrack support.
+HAVE_IPSET
+ define this to include the ability to selectively add resolved ip addresses
+ to given ipsets.
+
HAVE_AUTH
define this to include the facility to act as an authoritative DNS
server for one or more zones.
@@ -136,7 +140,7 @@ RESOLVFILE
/* #define HAVE_DBUS */
/* #define HAVE_IDN */
/* #define HAVE_CONNTRACK */
-
+/* #define HAVE_IPSET */
/* Default locations for important system files. */
@@ -323,6 +327,10 @@ HAVE_SOCKADDR_SA_LEN
#undef HAVE_AUTH
#endif
+#ifndef HAVE_LINUX_NETWORK
+#undef HAVE_IPSET
+#endif
+
/* Define a string indicating which options are in use.
DNSMASQP_COMPILE_OPTS is only defined in dnsmasq.c */
@@ -381,6 +389,10 @@ static char *compile_opts =
"no-"
#endif
"conntrack "
+#ifndef HAVE_IPSET
+"no-"
+#endif
+"ipset "
#ifndef HAVE_AUTH
"no-"
#endif
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index 21a309c..832e04a 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -1117,6 +1117,11 @@ void emit_dbus_signal(int action, struct dhcp_lease *lease, char *hostname);
# endif
#endif
+/* ipset.c */
+#ifdef HAVE_IPSET
+int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove);
+#endif
+
/* helper.c */
#if defined(HAVE_SCRIPT)
int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd);
diff --git a/src/ipset.c b/src/ipset.c
new file mode 100644
index 0000000..fcf6e25
--- /dev/null
+++ b/src/ipset.c
@@ -0,0 +1,220 @@
+/* ipset.c is Copyright (c) 2013 Jason A. Donenfeld <Jason at zx2c4.com>. All Rights Reserved.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 dated June, 1991, or
+ (at your option) version 3 dated 29 June, 2007.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "dnsmasq.h"
+#include <string.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/utsname.h>
+#include <arpa/inet.h>
+#include <linux/version.h>
+#include <linux/netlink.h>
+#include <linux/netfilter/nfnetlink.h>
+#ifndef NFNL_SUBSYS_IPSET
+#define NFNL_SUBSYS_IPSET 6
+#define IPSET_ATTR_DATA 7
+#define IPSET_ATTR_IP 1
+#define IPSET_ATTR_IPADDR_IPV4 1
+#define IPSET_ATTR_IPADDR_IPV6 2
+#define IPSET_ATTR_PROTOCOL 1
+#define IPSET_ATTR_SETNAME 2
+#define IPSET_CMD_ADD 9
+#define IPSET_CMD_DEL 10
+#define IPSET_MAXNAMELEN 32
+#define IPSET_PROTOCOL 6
+#else
+#include <linux/netfilter/ipset/ip_set.h>
+#endif
+#ifdef HAVE_IPSET
+
+#define NL_ALIGN(len) (((len)+3) & ~(3))
+static const struct sockaddr_nl snl = { .nl_family = AF_NETLINK };
+
+static inline void add_attr(struct nlmsghdr *nlh, uint16_t type, size_t len, const void *data)
+{
+ struct nlattr *attr = (void *)nlh + NL_ALIGN(nlh->nlmsg_len);
+ uint16_t payload_len = NL_ALIGN(sizeof(struct nlattr)) + len;
+ attr->nla_type = type;
+ attr->nla_len = payload_len;
+ memcpy((void *)attr + NL_ALIGN(sizeof(struct nlattr)), data, len);
+ nlh->nlmsg_len += NL_ALIGN(payload_len);
+}
+
+static int netlink_netfilter_sock()
+{
+ static int fd = -2;
+ if (fd == -2) {
+ fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
+ if (fd < 0)
+ return -1;
+ if (bind(fd, (struct sockaddr *)&snl, sizeof(snl)) < 0) {
+ fd = -1;
+ return -1;
+ }
+ }
+ return fd;
+}
+
+static int new_add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove)
+{
+ struct nlmsghdr *nlh;
+ struct nfgenmsg *nfg;
+ struct nlattr *nested[2];
+ char buffer[256];
+ uint8_t proto;
+ int sock;
+
+ if (strlen(setname) >= IPSET_MAXNAMELEN) {
+ errno = ENAMETOOLONG;
+ return -1;
+ }
+ if (af != AF_INET
+#ifdef HAVE_IPV6
+ && af != AF_INET6
+#endif
+ ) {
+ errno = EAFNOSUPPORT;
+ return -1;
+ }
+
+ sock = netlink_netfilter_sock();
+ if (sock < 0)
+ return -1;
+
+ memset(buffer, 0, sizeof(buffer));
+
+ nlh = (struct nlmsghdr *)buffer;
+ nlh->nlmsg_len = NL_ALIGN(sizeof(struct nlmsghdr));
+ nlh->nlmsg_type = (remove ? IPSET_CMD_DEL : IPSET_CMD_ADD) | (NFNL_SUBSYS_IPSET << 8);
+ nlh->nlmsg_flags = NLM_F_REQUEST;
+
+ nfg = (struct nfgenmsg *)(buffer + nlh->nlmsg_len);
+ nlh->nlmsg_len += NL_ALIGN(sizeof(struct nfgenmsg));
+ nfg->nfgen_family = af;
+ nfg->version = NFNETLINK_V0;
+ nfg->res_id = htons(0);
+
+ proto = IPSET_PROTOCOL;
+ add_attr(nlh, IPSET_ATTR_PROTOCOL, sizeof(proto), &proto);
+ add_attr(nlh, IPSET_ATTR_SETNAME, strlen(setname) + 1, setname);
+ nested[0] = (struct nlattr *)(buffer + NL_ALIGN(nlh->nlmsg_len));
+ nlh->nlmsg_len += NL_ALIGN(sizeof(struct nlattr));
+ nested[0]->nla_type = NLA_F_NESTED | IPSET_ATTR_DATA;
+ nested[1] = (struct nlattr *)(buffer + NL_ALIGN(nlh->nlmsg_len));
+ nlh->nlmsg_len += NL_ALIGN(sizeof(struct nlattr));
+ nested[1]->nla_type = NLA_F_NESTED | IPSET_ATTR_IP;
+ add_attr(nlh, (af == AF_INET ? IPSET_ATTR_IPADDR_IPV4 : IPSET_ATTR_IPADDR_IPV6)
+ | NLA_F_NET_BYTEORDER,
+#ifdef HAVE_IPV6
+ (af == AF_INET ? sizeof(ipaddr->addr.addr4) : sizeof(ipaddr->addr.addr6)),
+#else
+ sizeof(ipaddr->addr.addr4),
+#endif
+ &ipaddr->addr);
+ nested[1]->nla_len = (void *)buffer + NL_ALIGN(nlh->nlmsg_len) - (void *)nested[1];
+ nested[0]->nla_len = (void *)buffer + NL_ALIGN(nlh->nlmsg_len) - (void *)nested[0];
+
+
+ if (sendto(sock, buffer, nlh->nlmsg_len, 0, (struct sockaddr *)&snl, sizeof(snl)) < 0)
+ return -1;
+
+ return 0;
+}
+
+static int old_add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove)
+{
+ int sock, rc;
+ socklen_t size;
+ struct ip_set_req_adt_get {
+ unsigned op;
+ unsigned version;
+ union {
+ char name[IPSET_MAXNAMELEN];
+ uint16_t index;
+ } set;
+ char typename[IPSET_MAXNAMELEN];
+ } req_adt_get;
+ struct ip_set_req_adt {
+ unsigned op;
+ uint16_t index;
+ uint32_t ip;
+ } req_adt;
+
+ rc = 0;
+
+ if (strlen(setname) >= sizeof(req_adt_get.set.name)) {
+ errno = ENAMETOOLONG;
+ return -1;
+ }
+ if (af != AF_INET) {
+ errno = EAFNOSUPPORT;
+ return -1;
+ }
+
+ sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
+ if (sock < 0)
+ return -1;
+
+ req_adt_get.op = 0x10;
+ req_adt_get.version = 3;
+ strcpy(req_adt_get.set.name, setname);
+ size = sizeof(req_adt_get);
+ if (getsockopt(sock, SOL_IP, 83, &req_adt_get, &size) < 0) {
+ rc = -1;
+ goto close;
+ }
+ req_adt.op = remove ? 0x102 : 0x101;
+ req_adt.index = req_adt_get.set.index;
+ req_adt.ip = ntohl(ipaddr->addr.addr4.s_addr);
+ if (setsockopt(sock, SOL_IP, 83, &req_adt, sizeof(req_adt)) < 0) {
+ rc = -1;
+ goto close;
+ }
+close:
+ close(sock);
+ return rc;
+}
+
+static inline int is_old_kernel()
+{
+ struct utsname utsname;
+ int r, i;
+ char *s, *t;
+
+ if (uname(&utsname) < 0)
+ return -1;
+ r = 0;
+ s = utsname.release;
+ for (i = 0; i < 3; i++) {
+ t = strtok(s, ".");
+ r = r * 256 + (t ? atoi(t) : 0);
+ s = NULL;
+ }
+ return r < KERNEL_VERSION(2,6,32);
+
+}
+
+int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove)
+{
+ static int old_ipset = -2;
+ if (old_ipset == -2)
+ old_ipset = is_old_kernel();
+ if (old_ipset == -1)
+ return -1;
+ return old_ipset ? old_add_to_ipset(setname, ipaddr, af, remove) : new_add_to_ipset(setname, ipaddr, af, remove);
+}
+#endif
--
1.8.1.2
More information about the Dnsmasq-discuss
mailing list