Simon Kelley | 4b34f5d | 2014-06-07 20:05:08 +0100 | [diff] [blame] | 1 | /* tables.c is Copyright (c) 2014 Sven Falempin All Rights Reserved. |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 2 | |
Simon Kelley | 6799a46 | 2014-06-07 21:23:34 +0100 | [diff] [blame] | 3 | Author's email: sfalempin@citypassenger.com |
| 4 | |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 5 | This program is free software; you can redistribute it and/or modify |
| 6 | it under the terms of the GNU General Public License as published by |
| 7 | the Free Software Foundation; version 2 dated June, 1991, or |
| 8 | (at your option) version 3 dated 29 June, 2007. |
| 9 | |
| 10 | This program is distributed in the hope that it will be useful, |
| 11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 13 | GNU General Public License for more details. |
| 14 | |
| 15 | You should have received a copy of the GNU General Public License |
| 16 | along with this program. If not, see <http://www.gnu.org/licenses/>. |
| 17 | */ |
| 18 | |
| 19 | #include "dnsmasq.h" |
| 20 | |
| 21 | #if defined(HAVE_IPSET) && defined(HAVE_BSD_NETWORK) |
| 22 | |
Simon Kelley | 8d8a54e | 2015-02-01 21:48:46 +0000 | [diff] [blame] | 23 | #include <string.h> |
Simon Kelley | 6ac3bc0 | 2014-10-03 08:48:11 +0100 | [diff] [blame] | 24 | |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 25 | #include <sys/types.h> |
| 26 | #include <sys/ioctl.h> |
| 27 | |
| 28 | #include <net/if.h> |
| 29 | #include <netinet/in.h> |
| 30 | #include <net/pfvar.h> |
| 31 | |
| 32 | #include <err.h> |
| 33 | #include <errno.h> |
| 34 | #include <fcntl.h> |
| 35 | |
| 36 | #define UNUSED(x) (void)(x) |
| 37 | |
| 38 | static char *pf_device = "/dev/pf"; |
| 39 | static int dev = -1; |
| 40 | |
| 41 | static char *pfr_strerror(int errnum) |
| 42 | { |
| 43 | switch (errnum) |
| 44 | { |
| 45 | case ESRCH: |
| 46 | return "Table does not exist"; |
| 47 | case ENOENT: |
| 48 | return "Anchor or Ruleset does not exist"; |
| 49 | default: |
| 50 | return strerror(errnum); |
| 51 | } |
| 52 | } |
| 53 | |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 54 | |
| 55 | void ipset_init(void) |
| 56 | { |
| 57 | dev = open( pf_device, O_RDWR); |
| 58 | if (dev == -1) |
| 59 | { |
| 60 | err(1, "%s", pf_device); |
| 61 | die (_("failed to access pf devices: %s"), NULL, EC_MISC); |
| 62 | } |
| 63 | } |
| 64 | |
| 65 | int add_to_ipset(const char *setname, const struct all_addr *ipaddr, |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 66 | int flags, int remove) |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 67 | { |
| 68 | struct pfr_addr addr; |
| 69 | struct pfioc_table io; |
| 70 | struct pfr_table table; |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 71 | |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 72 | if (dev == -1) |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 73 | { |
| 74 | my_syslog(LOG_ERR, _("warning: no opened pf devices %s"), pf_device); |
| 75 | return -1; |
| 76 | } |
| 77 | |
| 78 | bzero(&table, sizeof(struct pfr_table)); |
| 79 | table.pfrt_flags |= PFR_TFLAG_PERSIST; |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 80 | if (strlen(setname) >= PF_TABLE_NAME_SIZE) |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 81 | { |
| 82 | my_syslog(LOG_ERR, _("error: cannot use table name %s"), setname); |
| 83 | errno = ENAMETOOLONG; |
| 84 | return -1; |
| 85 | } |
| 86 | |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 87 | if (strlcpy(table.pfrt_name, setname, |
| 88 | sizeof(table.pfrt_name)) >= sizeof(table.pfrt_name)) |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 89 | { |
| 90 | my_syslog(LOG_ERR, _("error: cannot strlcpy table name %s"), setname); |
| 91 | return -1; |
| 92 | } |
| 93 | |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 94 | bzero(&io, sizeof io); |
| 95 | io.pfrio_flags = 0; |
| 96 | io.pfrio_buffer = &table; |
| 97 | io.pfrio_esize = sizeof(table); |
| 98 | io.pfrio_size = 1; |
| 99 | if (ioctl(dev, DIOCRADDTABLES, &io)) |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 100 | { |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 101 | my_syslog(LOG_WARNING, _("IPset: error:%s"), pfr_strerror(errno)); |
| 102 | |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 103 | return -1; |
| 104 | } |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 105 | |
Simon Kelley | 396750c | 2016-08-13 22:34:11 +0100 | [diff] [blame] | 106 | table.pfrt_flags &= ~PFR_TFLAG_PERSIST; |
| 107 | if (io.pfrio_nadd) |
| 108 | my_syslog(LOG_INFO, _("info: table created")); |
| 109 | |
| 110 | bzero(&addr, sizeof(addr)); |
| 111 | #ifdef HAVE_IPV6 |
| 112 | if (flags & F_IPV6) |
| 113 | { |
| 114 | addr.pfra_af = AF_INET6; |
| 115 | addr.pfra_net = 0x80; |
| 116 | memcpy(&(addr.pfra_ip6addr), &(ipaddr->addr), sizeof(struct in6_addr)); |
| 117 | } |
| 118 | else |
| 119 | #endif |
| 120 | { |
| 121 | addr.pfra_af = AF_INET; |
| 122 | addr.pfra_net = 0x20; |
| 123 | addr.pfra_ip4addr.s_addr = ipaddr->addr.addr4.s_addr; |
| 124 | } |
| 125 | |
Simon Kelley | c4a0937 | 2014-06-02 20:30:07 +0100 | [diff] [blame] | 126 | bzero(&io, sizeof(io)); |
| 127 | io.pfrio_flags = 0; |
| 128 | io.pfrio_table = table; |
| 129 | io.pfrio_buffer = &addr; |
| 130 | io.pfrio_esize = sizeof(addr); |
| 131 | io.pfrio_size = 1; |
| 132 | if (ioctl(dev, ( remove ? DIOCRDELADDRS : DIOCRADDADDRS ), &io)) |
| 133 | { |
| 134 | my_syslog(LOG_WARNING, _("warning: DIOCR%sADDRS: %s"), ( remove ? "DEL" : "ADD" ), pfr_strerror(errno)); |
| 135 | return -1; |
| 136 | } |
| 137 | |
| 138 | my_syslog(LOG_INFO, _("%d addresses %s"), |
| 139 | io.pfrio_nadd, ( remove ? "removed" : "added" )); |
| 140 | |
| 141 | return io.pfrio_nadd; |
| 142 | } |
| 143 | |
| 144 | |
| 145 | #endif |