Old kernels use HAVE_OLD_IPSET while newer kernels use HAVE_IPSET.
---
Makefile | 5 +-
src/config.h | 6 +++
src/dnsmasq.h | 5 ++
src/ipset.c | 143 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 157 insertions(+), 2 deletions(-)
create mode 100644 src/ipset.c
diff --git a/Makefile b/Makefile
index c9cdb90..e0f6b90 100644
--- a/Makefile
+++ b/Makefile
@@ -59,13 +59,14 @@ ct_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper
HAVE_CONNTRACK $(PKG_CONFI
ct_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK
$(PKG_CONFIG) --libs libnetfilter_conntrack`
lua_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT
$(PKG_CONFIG) --cflags lua5.1`
lua_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT
$(PKG_CONFIG) --libs lua5.1`
+ipset_libs = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_IPSET $(PKG_CONFIG)
--libs libmnl`
sunos_libs = `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl
-lposix4; fi`
version = -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
objs = cache.o rfc1035.o util.o option.o forward.o network.o \
dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
- dhcp-common.o outpacket.o radv.o slaac.o auth.o
+ dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o
hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
dns-protocol.h radv-protocol.h
@@ -74,7 +75,7 @@ all : $(BUILDDIR)
@cd $(BUILDDIR) && $(MAKE) \
top="$(top)" \
build_cflags="$(version) $(dbus_cflags) $(idn_cflags) $(ct_cflags)
$(lua_cflags)" \
- build_libs="$(dbus_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(sunos_libs)" \
+ build_libs="$(dbus_libs) $(idn_libs) $(ct_libs) $(lua_libs) $(ipset_libs)
$(sunos_libs)" \
-f $(top)/Makefile dnsmasq
clean :
diff --git a/src/config.h b/src/config.h
index cff278d..3959b6c 100644
--- a/src/config.h
+++ b/src/config.h
@@ -97,6 +97,12 @@ HAVE_CONNTRACK
a build-dependency on libnetfilter_conntrack, but the resulting binary will
still run happily on a kernel without conntrack support.
+HAVE_IPSET
+HAVE_OLD_IPSET
+ define this to include the ability to selectively add resolved ip addresses
+ to given ipsets. HAVE_IPSET for Linux >= 2.6.32, and HAVE_OLD_IPSET for
+ Linux >= 2.6.16 or >= 2.4.36.
+
HAVE_AUTH
define this to include the facility to act as an authoritative DNS
server for one or more zones.
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index 21a309c..f1dffe8 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -1117,6 +1117,11 @@ void emit_dbus_signal(int action, struct dhcp_lease
*lease, char *hostname);
# endif
#endif
+/* ipset.c */
+#if defined(HAVE_IPSET) || defined(HAVE_OLD_IPSET)
+int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af,
int remove);
+#endif
+
/* helper.c */
#if defined(HAVE_SCRIPT)
int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd);
diff --git a/src/ipset.c b/src/ipset.c
new file mode 100644
index 0000000..b241ed4
--- /dev/null
+++ b/src/ipset.c
@@ -0,0 +1,143 @@
+/* ipset.c is Copyright (c) 2013 Jason A. Donenfeld <ja...@zx2c4.com>. All
Rights Reserved.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 dated June, 1991, or
+ (at your option) version 3 dated 29 June, 2007.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "dnsmasq.h"
+
+#if defined(HAVE_IPSET) || defined(HAVE_OLD_IPSET)
+#include <string.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#if defined(HAVE_IPSET)
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/ipset/ip_set.h>
+#endif
+#endif
+
+/* ipaddr should be either in_addr or in6_addr in network byte order.
+ * In other words, verbatium of what is in the DNS record. If remove
+ * is non-zero, the requested ipaddr is removed instead of added. */
+#if defined(HAVE_IPSET)
+int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af,
int remove)
+{
+ struct nlmsghdr *nlh;
+ struct nfgenmsg *nfg;
+ struct mnl_socket *mnl;
+ struct nlattr *nested[2];
+ char buffer[256];
+ int rc;
+
+ rc = 0;
+
+ if (strlen(setname) >= IPSET_MAXNAMELEN) {
+ errno = ENAMETOOLONG;
+ return -1;
+ }
+ if (af != AF_INET && af != AF_INET6) {
+ errno = EAFNOSUPPORT;
+ return -1;
+ }
+
+ nlh = mnl_nlmsg_put_header(buffer);
+ nlh->nlmsg_type = (remove ? IPSET_CMD_DEL : IPSET_CMD_ADD) |
(NFNL_SUBSYS_IPSET << 8);
+ nlh->nlmsg_flags = NLM_F_REQUEST;
+
+ nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg));
+ nfg->nfgen_family = af;
+ nfg->version = NFNETLINK_V0;
+ nfg->res_id = htons(0);
+
+ mnl_attr_put_u8(nlh, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
+ mnl_attr_put(nlh, IPSET_ATTR_SETNAME, strlen(setname) + 1, setname);
+ nested[0] = mnl_attr_nest_start(nlh, IPSET_ATTR_DATA);
+ nested[1] = mnl_attr_nest_start(nlh, IPSET_ATTR_IP);
+ mnl_attr_put(nlh, (af == AF_INET ? IPSET_ATTR_IPADDR_IPV4 :
IPSET_ATTR_IPADDR_IPV6)
+ | NLA_F_NET_BYTEORDER, (af == AF_INET ?
sizeof(ipaddr->addr.addr4) : sizeof(ipaddr->addr.addr4)), &ipaddr->addr);
+ mnl_attr_nest_end(nlh, nested[1]);
+ mnl_attr_nest_end(nlh, nested[0]);
+
+ mnl = mnl_socket_open(NETLINK_NETFILTER);
+ if (!mnl || (long)mnl < 0)
+ return -1;
+ if (mnl_socket_bind(mnl, 0, MNL_SOCKET_AUTOPID) < 0) {
+ rc = -1;
+ goto close;
+ }
+ if (mnl_socket_sendto(mnl, nlh, nlh->nlmsg_len) < 0) {
+ rc = -1;
+ goto close;
+ }
+close:
+ mnl_socket_close(mnl);
+ return rc;
+}
+#elif defined(HAVE_OLD_IPSET)
+int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af,
int remove)
+{
+ int sock, rc;
+ socklen_t size;
+ struct ip_set_req_adt_get {
+ unsigned op;
+ unsigned version;
+ union {
+ char name[32];
+ uint16_t index;
+ } set;
+ char typename[32];
+ } req_adt_get;
+ struct ip_set_req_adt {
+ unsigned op;
+ uint16_t index;
+ uint32_t ip;
+ } req_adt;
+
+ rc = 0;
+
+ if (strlen(setname) >= sizeof(req_adt_get.set.name)) {
+ errno = ENAMETOOLONG;
+ return -1;
+ }
+ if (af != AF_INET) {
+ errno = EAFNOSUPPORT;
+ return -1;
+ }
+
+ sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
+ if (sock < 0)
+ return -1;
+
+ req_adt_get.op = 0x10;
+ req_adt_get.version = 3;
+ strcpy(req_adt_get.set.name, setname);
+ size = sizeof(req_adt_get);
+ if (getsockopt(sock, SOL_IP, 83, &req_adt_get, &size) < 0) {
+ rc = -1;
+ goto close;
+ }
+ req_adt.op = remove ? 0x102 : 0x101;
+ req_adt.index = req_adt_get.set.index;
+ req_adt.ip = ntohl(ipaddr->addr.addr4.s_addr);
+ if (setsockopt(sock, SOL_IP, 83, &req_adt, sizeof(req_adt)) < 0) {
+ rc = -1;
+ goto close;
+ }
+close:
+ close(sock);
+ return rc;
+}
+#endif
--
1.8.1.2
_______________________________________________
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
