1/* ipset.c is Copyright (c) 2013 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 2 3 This program is free software; you can redistribute it and/or modify 4 it under the terms of the GNU General Public License as published by 5 the Free Software Foundation; version 2 dated June, 1991, or 6 (at your option) version 3 dated 29 June, 2007. 7 8 This program is distributed in the hope that it will be useful, 9 but WITHOUT ANY WARRANTY; without even the implied warranty of 10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 11 GNU General Public License for more details. 12 13 You should have received a copy of the GNU General Public License 14 along with this program. If not, see <http://www.gnu.org/licenses/>. 15*/ 16 17#include "dnsmasq.h" 18 19#if defined(HAVE_IPSET) && defined(HAVE_LINUX_NETWORK) 20 21#include <string.h> 22#include <errno.h> 23#include <sys/types.h> 24#include <sys/socket.h> 25#include <sys/utsname.h> 26#include <arpa/inet.h> 27#include <linux/version.h> 28#include <linux/netlink.h> 29 30/* We want to be able to compile against old header files 31 Kernel version is handled at run-time. */ 32 33#define NFNL_SUBSYS_IPSET 6 34 35#define IPSET_ATTR_DATA 7 36#define IPSET_ATTR_IP 1 37#define IPSET_ATTR_IPADDR_IPV4 1 38#define IPSET_ATTR_IPADDR_IPV6 2 39#define IPSET_ATTR_PROTOCOL 1 40#define IPSET_ATTR_SETNAME 2 41#define IPSET_CMD_ADD 9 42#define IPSET_CMD_DEL 10 43#define IPSET_MAXNAMELEN 32 44#define IPSET_PROTOCOL 6 45 46#ifndef NFNETLINK_V0 47#define NFNETLINK_V0 0 48#endif 49 50#ifndef NLA_F_NESTED 51#define NLA_F_NESTED (1 << 15) 52#endif 53 54#ifndef NLA_F_NET_BYTEORDER 55#define NLA_F_NET_BYTEORDER (1 << 14) 56#endif 57 58struct my_nlattr { 59 __u16 nla_len; 60 __u16 nla_type; 61}; 62 63struct my_nfgenmsg { 64 __u8 nfgen_family; /* AF_xxx */ 65 __u8 version; /* nfnetlink version */ 66 __be16 res_id; /* resource id */ 67}; 68 69 70/* data structure size in here is fixed */ 71#define BUFF_SZ 256 72 73#define NL_ALIGN(len) (((len)+3) & ~(3)) 74static const struct sockaddr_nl snl = { .nl_family = AF_NETLINK }; 75static int ipset_sock, old_kernel; 76static char *buffer; 77 78static inline void add_attr(struct nlmsghdr *nlh, uint16_t type, size_t len, const void *data) 79{ 80 struct my_nlattr *attr = (void *)nlh + NL_ALIGN(nlh->nlmsg_len); 81 uint16_t payload_len = NL_ALIGN(sizeof(struct my_nlattr)) + len; 82 attr->nla_type = type; 83 attr->nla_len = payload_len; 84 memcpy((void *)attr + NL_ALIGN(sizeof(struct my_nlattr)), data, len); 85 nlh->nlmsg_len += NL_ALIGN(payload_len); 86} 87 88void ipset_init(void) 89{ 90 struct utsname utsname; 91 int version; 92 char *split; 93 94 if (uname(&utsname) < 0) 95 die(_("failed to find kernel version: %s"), NULL, EC_MISC); 96 97 split = strtok(utsname.release, "."); 98 version = (split ? atoi(split) : 0); 99 split = strtok(NULL, "."); 100 version = version * 256 + (split ? atoi(split) : 0); 101 split = strtok(NULL, "."); 102 version = version * 256 + (split ? atoi(split) : 0); 103 old_kernel = (version < KERNEL_VERSION(2,6,32)); 104 105 if (old_kernel && (ipset_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) != -1) 106 return; 107 108 if (!old_kernel && 109 (buffer = safe_malloc(BUFF_SZ)) && 110 (ipset_sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER)) != -1 && 111 (bind(ipset_sock, (struct sockaddr *)&snl, sizeof(snl)) != -1)) 112 return; 113 114 die (_("failed to create IPset control socket: %s"), NULL, EC_MISC); 115} 116 117static int new_add_to_ipset(const char *setname, const struct all_addr *ipaddr, int af, int remove) 118{ 119 struct nlmsghdr *nlh; 120 struct my_nfgenmsg *nfg; 121 struct my_nlattr *nested[2]; 122 uint8_t proto; 123 int addrsz = INADDRSZ; 124 125#ifdef HAVE_IPV6 126 if (af == AF_INET6) 127 addrsz = IN6ADDRSZ; 128#endif 129 130 if (strlen(setname) >= IPSET_MAXNAMELEN) 131 { 132 errno = ENAMETOOLONG; 133 return -1; 134 } 135 136 memset(buffer, 0, BUFF_SZ); 137 138 nlh = (struct nlmsghdr *)buffer; 139 nlh->nlmsg_len = NL_ALIGN(sizeof(struct nlmsghdr)); 140 nlh->nlmsg_type = (remove ? IPSET_CMD_DEL : IPSET_CMD_ADD) | (NFNL_SUBSYS_IPSET << 8); 141 nlh->nlmsg_flags = NLM_F_REQUEST; 142 143 nfg = (struct my_nfgenmsg *)(buffer + nlh->nlmsg_len); 144 nlh->nlmsg_len += NL_ALIGN(sizeof(struct my_nfgenmsg)); 145 nfg->nfgen_family = af; 146 nfg->version = NFNETLINK_V0; 147 nfg->res_id = htons(0); 148 149 proto = IPSET_PROTOCOL; 150 add_attr(nlh, IPSET_ATTR_PROTOCOL, sizeof(proto), &proto); 151 add_attr(nlh, IPSET_ATTR_SETNAME, strlen(setname) + 1, setname); 152 nested[0] = (struct my_nlattr *)(buffer + NL_ALIGN(nlh->nlmsg_len)); 153 nlh->nlmsg_len += NL_ALIGN(sizeof(struct my_nlattr)); 154 nested[0]->nla_type = NLA_F_NESTED | IPSET_ATTR_DATA; 155 nested[1] = (struct my_nlattr *)(buffer + NL_ALIGN(nlh->nlmsg_len)); 156 nlh->nlmsg_len += NL_ALIGN(sizeof(struct my_nlattr)); 157 nested[1]->nla_type = NLA_F_NESTED | IPSET_ATTR_IP; 158 add_attr(nlh, 159 (af == AF_INET ? IPSET_ATTR_IPADDR_IPV4 : IPSET_ATTR_IPADDR_IPV6) | NLA_F_NET_BYTEORDER, 160 addrsz, &ipaddr->addr); 161 nested[1]->nla_len = (void *)buffer + NL_ALIGN(nlh->nlmsg_len) - (void *)nested[1]; 162 nested[0]->nla_len = (void *)buffer + NL_ALIGN(nlh->nlmsg_len) - (void *)nested[0]; 163 164 while (retry_send(sendto(ipset_sock, buffer, nlh->nlmsg_len, 0, 165 (struct sockaddr *)&snl, sizeof(snl)))); 166 167 return errno == 0 ? 0 : -1; 168} 169 170 171static int old_add_to_ipset(const char *setname, const struct all_addr *ipaddr, int remove) 172{ 173 socklen_t size; 174 struct ip_set_req_adt_get { 175 unsigned op; 176 unsigned version; 177 union { 178 char name[IPSET_MAXNAMELEN]; 179 uint16_t index; 180 } set; 181 char typename[IPSET_MAXNAMELEN]; 182 } req_adt_get; 183 struct ip_set_req_adt { 184 unsigned op; 185 uint16_t index; 186 uint32_t ip; 187 } req_adt; 188 189 if (strlen(setname) >= sizeof(req_adt_get.set.name)) 190 { 191 errno = ENAMETOOLONG; 192 return -1; 193 } 194 195 req_adt_get.op = 0x10; 196 req_adt_get.version = 3; 197 strcpy(req_adt_get.set.name, setname); 198 size = sizeof(req_adt_get); 199 if (getsockopt(ipset_sock, SOL_IP, 83, &req_adt_get, &size) < 0) 200 return -1; 201 req_adt.op = remove ? 0x102 : 0x101; 202 req_adt.index = req_adt_get.set.index; 203 req_adt.ip = ntohl(ipaddr->addr.addr4.s_addr); 204 if (setsockopt(ipset_sock, SOL_IP, 83, &req_adt, sizeof(req_adt)) < 0) 205 return -1; 206 207 return 0; 208} 209 210 211 212int add_to_ipset(const char *setname, const struct all_addr *ipaddr, int flags, int remove) 213{ 214 int af = AF_INET; 215 216#ifdef HAVE_IPV6 217 if (flags & F_IPV6) 218 { 219 af = AF_INET6; 220 /* old method only supports IPv4 */ 221 if (old_kernel) 222 return -1; 223 } 224#endif 225 226 return old_kernel ? old_add_to_ipset(setname, ipaddr, remove) : new_add_to_ipset(setname, ipaddr, af, remove); 227} 228 229#endif 230