From: "Jason A. Donenfeld" <ja...@zx2c4.com> --- Makefile | 2 +- src/config.h | 14 +++- src/dnsmasq.h | 5 ++ src/ipset.c | 220 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 239 insertions(+), 2 deletions(-) create mode 100644 src/ipset.c
diff --git a/Makefile b/Makefile index c9cdb90..7240fbf 100644 --- a/Makefile +++ b/Makefile @@ -65,7 +65,7 @@ version = -DVERSION='\"`$(top)/bld/get-version $(top)`\"' objs = cache.o rfc1035.o util.o option.o forward.o network.o \ dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \ helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \ - dhcp-common.o outpacket.o radv.o slaac.o auth.o + dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \ dns-protocol.h radv-protocol.h diff --git a/src/config.h b/src/config.h index cff278d..9c8e785 100644 --- a/src/config.h +++ b/src/config.h @@ -97,6 +97,10 @@ HAVE_CONNTRACK a build-dependency on libnetfilter_conntrack, but the resulting binary will still run happily on a kernel without conntrack support. +HAVE_IPSET + define this to include the ability to selectively add resolved ip addresses + to given ipsets. + HAVE_AUTH define this to include the facility to act as an authoritative DNS server for one or more zones. @@ -136,7 +140,7 @@ RESOLVFILE /* #define HAVE_DBUS */ /* #define HAVE_IDN */ /* #define HAVE_CONNTRACK */ - +/* #define HAVE_IPSET */ /* Default locations for important system files. */ @@ -323,6 +327,10 @@ HAVE_SOCKADDR_SA_LEN #undef HAVE_AUTH #endif +#ifndef HAVE_LINUX_NETWORK +#undef HAVE_IPSET +#endif + /* Define a string indicating which options are in use. DNSMASQP_COMPILE_OPTS is only defined in dnsmasq.c */ @@ -381,6 +389,10 @@ static char *compile_opts = "no-" #endif "conntrack " +#ifndef HAVE_IPSET +"no-" +#endif +"ipset " #ifndef HAVE_AUTH "no-" #endif diff --git a/src/dnsmasq.h b/src/dnsmasq.h index 21a309c..832e04a 100644 --- a/src/dnsmasq.h +++ b/src/dnsmasq.h @@ -1117,6 +1117,11 @@ void emit_dbus_signal(int action, struct dhcp_lease *lease, char *hostname); # endif #endif +/* ipset.c */ +#ifdef HAVE_IPSET +int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove); +#endif + /* helper.c */ #if defined(HAVE_SCRIPT) int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd); diff --git a/src/ipset.c b/src/ipset.c new file mode 100644 index 0000000..fcf6e25 --- /dev/null +++ b/src/ipset.c @@ -0,0 +1,220 @@ +/* ipset.c is Copyright (c) 2013 Jason A. Donenfeld <ja...@zx2c4.com>. All Rights Reserved. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 dated June, 1991, or + (at your option) version 3 dated 29 June, 2007. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "dnsmasq.h" +#include <string.h> +#include <errno.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/utsname.h> +#include <arpa/inet.h> +#include <linux/version.h> +#include <linux/netlink.h> +#include <linux/netfilter/nfnetlink.h> +#ifndef NFNL_SUBSYS_IPSET +#define NFNL_SUBSYS_IPSET 6 +#define IPSET_ATTR_DATA 7 +#define IPSET_ATTR_IP 1 +#define IPSET_ATTR_IPADDR_IPV4 1 +#define IPSET_ATTR_IPADDR_IPV6 2 +#define IPSET_ATTR_PROTOCOL 1 +#define IPSET_ATTR_SETNAME 2 +#define IPSET_CMD_ADD 9 +#define IPSET_CMD_DEL 10 +#define IPSET_MAXNAMELEN 32 +#define IPSET_PROTOCOL 6 +#else +#include <linux/netfilter/ipset/ip_set.h> +#endif +#ifdef HAVE_IPSET + +#define NL_ALIGN(len) (((len)+3) & ~(3)) +static const struct sockaddr_nl snl = { .nl_family = AF_NETLINK }; + +static inline void add_attr(struct nlmsghdr *nlh, uint16_t type, size_t len, const void *data) +{ + struct nlattr *attr = (void *)nlh + NL_ALIGN(nlh->nlmsg_len); + uint16_t payload_len = NL_ALIGN(sizeof(struct nlattr)) + len; + attr->nla_type = type; + attr->nla_len = payload_len; + memcpy((void *)attr + NL_ALIGN(sizeof(struct nlattr)), data, len); + nlh->nlmsg_len += NL_ALIGN(payload_len); +} + +static int netlink_netfilter_sock() +{ + static int fd = -2; + if (fd == -2) { + fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER); + if (fd < 0) + return -1; + if (bind(fd, (struct sockaddr *)&snl, sizeof(snl)) < 0) { + fd = -1; + return -1; + } + } + return fd; +} + +static int new_add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove) +{ + struct nlmsghdr *nlh; + struct nfgenmsg *nfg; + struct nlattr *nested[2]; + char buffer[256]; + uint8_t proto; + int sock; + + if (strlen(setname) >= IPSET_MAXNAMELEN) { + errno = ENAMETOOLONG; + return -1; + } + if (af != AF_INET +#ifdef HAVE_IPV6 + && af != AF_INET6 +#endif + ) { + errno = EAFNOSUPPORT; + return -1; + } + + sock = netlink_netfilter_sock(); + if (sock < 0) + return -1; + + memset(buffer, 0, sizeof(buffer)); + + nlh = (struct nlmsghdr *)buffer; + nlh->nlmsg_len = NL_ALIGN(sizeof(struct nlmsghdr)); + nlh->nlmsg_type = (remove ? IPSET_CMD_DEL : IPSET_CMD_ADD) | (NFNL_SUBSYS_IPSET << 8); + nlh->nlmsg_flags = NLM_F_REQUEST; + + nfg = (struct nfgenmsg *)(buffer + nlh->nlmsg_len); + nlh->nlmsg_len += NL_ALIGN(sizeof(struct nfgenmsg)); + nfg->nfgen_family = af; + nfg->version = NFNETLINK_V0; + nfg->res_id = htons(0); + + proto = IPSET_PROTOCOL; + add_attr(nlh, IPSET_ATTR_PROTOCOL, sizeof(proto), &proto); + add_attr(nlh, IPSET_ATTR_SETNAME, strlen(setname) + 1, setname); + nested[0] = (struct nlattr *)(buffer + NL_ALIGN(nlh->nlmsg_len)); + nlh->nlmsg_len += NL_ALIGN(sizeof(struct nlattr)); + nested[0]->nla_type = NLA_F_NESTED | IPSET_ATTR_DATA; + nested[1] = (struct nlattr *)(buffer + NL_ALIGN(nlh->nlmsg_len)); + nlh->nlmsg_len += NL_ALIGN(sizeof(struct nlattr)); + nested[1]->nla_type = NLA_F_NESTED | IPSET_ATTR_IP; + add_attr(nlh, (af == AF_INET ? IPSET_ATTR_IPADDR_IPV4 : IPSET_ATTR_IPADDR_IPV6) + | NLA_F_NET_BYTEORDER, +#ifdef HAVE_IPV6 + (af == AF_INET ? sizeof(ipaddr->addr.addr4) : sizeof(ipaddr->addr.addr6)), +#else + sizeof(ipaddr->addr.addr4), +#endif + &ipaddr->addr); + nested[1]->nla_len = (void *)buffer + NL_ALIGN(nlh->nlmsg_len) - (void *)nested[1]; + nested[0]->nla_len = (void *)buffer + NL_ALIGN(nlh->nlmsg_len) - (void *)nested[0]; + + + if (sendto(sock, buffer, nlh->nlmsg_len, 0, (struct sockaddr *)&snl, sizeof(snl)) < 0) + return -1; + + return 0; +} + +static int old_add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove) +{ + int sock, rc; + socklen_t size; + struct ip_set_req_adt_get { + unsigned op; + unsigned version; + union { + char name[IPSET_MAXNAMELEN]; + uint16_t index; + } set; + char typename[IPSET_MAXNAMELEN]; + } req_adt_get; + struct ip_set_req_adt { + unsigned op; + uint16_t index; + uint32_t ip; + } req_adt; + + rc = 0; + + if (strlen(setname) >= sizeof(req_adt_get.set.name)) { + errno = ENAMETOOLONG; + return -1; + } + if (af != AF_INET) { + errno = EAFNOSUPPORT; + return -1; + } + + sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); + if (sock < 0) + return -1; + + req_adt_get.op = 0x10; + req_adt_get.version = 3; + strcpy(req_adt_get.set.name, setname); + size = sizeof(req_adt_get); + if (getsockopt(sock, SOL_IP, 83, &req_adt_get, &size) < 0) { + rc = -1; + goto close; + } + req_adt.op = remove ? 0x102 : 0x101; + req_adt.index = req_adt_get.set.index; + req_adt.ip = ntohl(ipaddr->addr.addr4.s_addr); + if (setsockopt(sock, SOL_IP, 83, &req_adt, sizeof(req_adt)) < 0) { + rc = -1; + goto close; + } +close: + close(sock); + return rc; +} + +static inline int is_old_kernel() +{ + struct utsname utsname; + int r, i; + char *s, *t; + + if (uname(&utsname) < 0) + return -1; + r = 0; + s = utsname.release; + for (i = 0; i < 3; i++) { + t = strtok(s, "."); + r = r * 256 + (t ? atoi(t) : 0); + s = NULL; + } + return r < KERNEL_VERSION(2,6,32); + +} + +int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove) +{ + static int old_ipset = -2; + if (old_ipset == -2) + old_ipset = is_old_kernel(); + if (old_ipset == -1) + return -1; + return old_ipset ? old_add_to_ipset(setname, ipaddr, af, remove) : new_add_to_ipset(setname, ipaddr, af, remove); +} +#endif -- 1.8.1.2 _______________________________________________ Dnsmasq-discuss mailing list Dnsmasq-discuss@lists.thekelleys.org.uk http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss