From a623cef95d50a3d29d071d6639d57a61c5bd9936 Mon Sep 17 00:00:00 2001 From: bol-van Date: Sun, 24 Nov 2024 16:48:14 +0300 Subject: [PATCH] nfqws: fixed lists --- nfq/hostlist.c | 79 ++++++++++++------ nfq/hostlist.h | 1 + nfq/ipset.c | 75 ++++++++++++------ nfq/ipset.h | 1 + nfq/nfqws.c | 211 +++++++++++++++++++++++++++++++++++++------------ nfq/pools.c | 34 +++++--- 6 files changed, 293 insertions(+), 108 deletions(-) diff --git a/nfq/hostlist.c b/nfq/hostlist.c index ade317a..9b75758 100644 --- a/nfq/hostlist.c +++ b/nfq/hostlist.c @@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct) *hostlist = NULL; return false; } - (*ct)++; + if (ct) (*ct)++; } // advance to the next line for (; pfilename); - if (!t) - { - // stat() error - DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename); - return true; - } - if (t==hfile->mod_time) return true; // up to date - StrPoolDestroy(&hfile->hostlist); - if (!AppendHostList(&hfile->hostlist, hfile->filename)) + if (hfile->filename) { + time_t t = file_mod_time(hfile->filename); + if (!t) + { + // stat() error + DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename); + return true; + } + if (t==hfile->mod_time) return true; // up to date StrPoolDestroy(&hfile->hostlist); - return false; + if (!AppendHostList(&hfile->hostlist, hfile->filename)) + { + StrPoolDestroy(&hfile->hostlist); + return false; + } + hfile->mod_time=t; } - hfile->mod_time=t; return true; } static bool LoadHostLists(struct hostlist_files_head *list) @@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con LIST_FOREACH(item, hostlists_exclude, next) { - DLOG("[%s] exclude ", item->hfile->filename); + DLOG("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchHostList(item->hfile->hostlist, host)) { if (excluded) *excluded = true; @@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con { LIST_FOREACH(item, hostlists, next) { - DLOG("[%s] include ", item->hfile->filename); + DLOG("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchHostList(item->hfile->hostlist, host)) return true; } @@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename) { struct hostlist_file *hfile; - if (!(hfile=hostlist_files_search(hostlists, filename))) - if (!(hfile=hostlist_files_add(hostlists, filename))) + + if (filename) + { + if (!(hfile=hostlist_files_search(hostlists, filename))) + if (!(hfile=hostlist_files_add(hostlists, filename))) + return NULL; + if (!hostlist_collection_search(hl_collection, filename)) + if (!hostlist_collection_add(hl_collection, hfile)) + return NULL; + } + else + { + if (!(hfile=hostlist_files_add(hostlists, NULL))) return NULL; - if (!hostlist_collection_search(hl_collection, filename)) if (!hostlist_collection_add(hl_collection, hfile)) return NULL; + } + return hfile; } struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename) { - if (!file_mod_time(filename)) + if (filename && !file_mod_time(filename)) { DLOG_ERR("cannot access hostlist file '%s'\n",filename); return NULL; @@ -265,15 +285,30 @@ void HostlistsDebug() struct hostlist_item *hl_item; LIST_FOREACH(hfile, ¶ms.hostlists, next) - DLOG("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)"); + { + if (hfile->filename) + DLOG("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)"); + else + DLOG("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)"); + } LIST_FOREACH(dpl, ¶ms.desync_profiles, next) { LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next) if (hl_item->hfile!=dpl->dp.hostlist_auto) - DLOG("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + { + if (hl_item->hfile->filename) + DLOG("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + else + DLOG("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)"); + } LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next) - DLOG("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + { + if (hl_item->hfile->filename) + DLOG("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + else + DLOG("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)"); + } if (dpl->dp.hostlist_auto) DLOG("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)"); } diff --git a/nfq/hostlist.h b/nfq/hostlist.h index f49db2d..deedc5c 100644 --- a/nfq/hostlist.h +++ b/nfq/hostlist.h @@ -4,6 +4,7 @@ #include "pools.h" #include "params.h" +bool AppendHostlistItem(strpool **hostlist, char *s); bool AppendHostList(strpool **hostlist, const char *filename); bool LoadAllHostLists(); bool NonEmptyHostlist(strpool **hostlist); diff --git a/nfq/ipset.c b/nfq/ipset.c index fec02ee..86970b0 100644 --- a/nfq/ipset.c +++ b/nfq/ipset.c @@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct) ipsetDestroy(ips); return false; } - (*ct)++; + if (ct) (*ct)++; } else if (parse_cidr6(cidr,&c6)) { @@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct) ipsetDestroy(ips); return false; } - (*ct)++; + if (ct) (*ct)++; } else DLOG_ERR("bad ip or subnet : %s\n",cidr); @@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct) } +bool AppendIpsetItem(ipset *ips, char *ip) +{ + return addpool(ips,&ip,ip+strlen(ip),NULL); +} + static bool AppendIpset(ipset *ips, const char *filename) { char *p, *e, s[256], *zbuf; @@ -119,21 +124,24 @@ static bool AppendIpset(ipset *ips, const char *filename) static bool LoadIpset(struct ipset_file *hfile) { - time_t t = file_mod_time(hfile->filename); - if (!t) - { - // stat() error - DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename); - return true; - } - if (t==hfile->mod_time) return true; // up to date - ipsetDestroy(&hfile->ipset); - if (!AppendIpset(&hfile->ipset, hfile->filename)) + if (hfile->filename) { + time_t t = file_mod_time(hfile->filename); + if (!t) + { + // stat() error + DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename); + return true; + } + if (t==hfile->mod_time) return true; // up to date ipsetDestroy(&hfile->ipset); - return false; + if (!AppendIpset(&hfile->ipset, hfile->filename)) + { + ipsetDestroy(&hfile->ipset); + return false; + } + hfile->mod_time=t; } - hfile->mod_time=t; return true; } static bool LoadIpsets(struct ipset_files_head *list) @@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip LIST_FOREACH(item, ips_exclude, next) { - DLOG("[%s] exclude ",item->hfile->filename); + DLOG("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchIpset(&item->hfile->ipset, ipv4, ipv6)) return false; } @@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip { LIST_FOREACH(item, ips, next) { - DLOG("[%s] include ",item->hfile->filename); + DLOG("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchIpset(&item->hfile->ipset, ipv4, ipv6)) return true; } @@ -234,17 +242,27 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename) { struct ipset_file *hfile; - if (!(hfile=ipset_files_search(ipsets, filename))) - if (!(hfile=ipset_files_add(ipsets, filename))) + if (filename) + { + if (!(hfile=ipset_files_search(ipsets, filename))) + if (!(hfile=ipset_files_add(ipsets, filename))) + return NULL; + if (!ipset_collection_search(ips_collection, filename)) + if (!ipset_collection_add(ips_collection, hfile)) + return NULL; + } + else + { + if (!(hfile=ipset_files_add(ipsets, NULL))) return NULL; - if (!ipset_collection_search(ips_collection, filename)) if (!ipset_collection_add(ips_collection, hfile)) return NULL; + } return hfile; } struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename) { - if (!file_mod_time(filename)) + if (filename && !file_mod_time(filename)) { DLOG_ERR("cannot access ipset file '%s'\n",filename); return NULL; @@ -277,13 +295,24 @@ void IpsetsDebug() struct ipset_item *ips_item; LIST_FOREACH(hfile, ¶ms.ipsets, next) - DLOG("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset)); + { + if (hfile->filename) + DLOG("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset)); + else + DLOG("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset)); + } LIST_FOREACH(dpl, ¶ms.desync_profiles, next) { LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next) - DLOG("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + if (ips_item->hfile->filename) + DLOG("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + else + DLOG("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset)); LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next) - DLOG("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + if (ips_item->hfile->filename) + DLOG("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + else + DLOG("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset)); } } diff --git a/nfq/ipset.h b/nfq/ipset.h index 9852ca6..f283c2f 100644 --- a/nfq/ipset.h +++ b/nfq/ipset.h @@ -9,3 +9,4 @@ bool LoadAllIpsets(); bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6); struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename); void IpsetsDebug(); +bool AppendIpsetItem(ipset *ips, char *ip); diff --git a/nfq/nfqws.c b/nfq/nfqws.c index a8b7c0c..916c42d 100644 --- a/nfq/nfqws.c +++ b/nfq/nfqws.c @@ -836,6 +836,47 @@ static bool parse_split_pos_list(char *opt, struct proto_pos *splits, int splits if (p) return false; // too much splits return true; } + +static bool parse_domain_list(char *opt, strpool **pp) +{ + char *e,*p,c; + + for (p=opt ; p ; ) + { + if ((e = strchr(p,','))) + { + c=*e; + *e=0; + } + + if (*p && !AppendHostlistItem(pp,p)) return false; + + if (e) *e++=c; + p = e; + } + return true; +} + +static bool parse_ip_list(char *opt, ipset *pp) +{ + char *e,*p,c; + + for (p=opt ; p ; ) + { + if ((e = strchr(p,','))) + { + c=*e; + *e=0; + } + + if (*p && !AppendIpsetItem(pp,p)) return false; + + if (e) *e++=c; + p = e; + } + return true; +} + static void split_compat(struct desync_profile *dp) { if (!dp->split_count) @@ -1026,10 +1067,14 @@ static void exithelp(void) " --filter-udp=[~]port1[-port2]|*\t\t; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list allowed.\n" " --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.\n" " --ipset=\t\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n" + " --ipset-ip=\t\t\t\t; comma separated fixed ip list\n" " --ipset-exclude=\t\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n" + " --ipset-exclude-ip=\t\t\t; comma separated fixed ip list\n" "\nHOSTLIST FILTER:\n" " --hostlist=\t\t\t\t; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" + " --hostlist-domains=\t\t; comma separated fixed domain list\n" " --hostlist-exclude=\t\t\t; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" + " --hostlist-exclude-domains=\t; comma separated fixed domain list\n" " --hostlist-auto=\t\t\t; detect DPI blocks and build hostlist automatically\n" " --hostlist-auto-fail-threshold=\t\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n" " --hostlist-auto-fail-time=\t\t; all failed attemps must be within these seconds (default : %d)\n" @@ -1151,6 +1196,8 @@ int main(int argc, char **argv) int option_index = 0; bool daemon = false, bSkip = false; char pidfile[256]; + struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL; + struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL; #ifdef __CYGWIN__ char windivert_filter[8192], wf_pf_tcp_src[256], wf_pf_tcp_dst[256], wf_pf_udp_src[256], wf_pf_udp_dst[256], wf_save_file[256]; bool wf_ipv4=true, wf_ipv6=true; @@ -1278,33 +1325,37 @@ int main(int argc, char **argv) {"dpi-desync-cutoff",required_argument,0,0},// optidx=44 {"dpi-desync-start",required_argument,0,0},// optidx=45 {"hostlist",required_argument,0,0}, // optidx=46 - {"hostlist-exclude",required_argument,0,0}, // optidx=47 - {"hostlist-auto",required_argument,0,0}, // optidx=48 - {"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=49 - {"hostlist-auto-fail-time",required_argument,0,0}, // optidx=50 - {"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=51 - {"hostlist-auto-debug",required_argument,0,0}, // optidx=52 - {"new",no_argument,0,0}, // optidx=53 - {"skip",no_argument,0,0}, // optidx=54 - {"filter-l3",required_argument,0,0}, // optidx=55 - {"filter-tcp",required_argument,0,0}, // optidx=56 - {"filter-udp",required_argument,0,0}, // optidx=57 - {"filter-l7",required_argument,0,0}, // optidx=58 - {"ipset",required_argument,0,0}, // optidx=59 - {"ipset-exclude",required_argument,0,0},// optidx=60 + {"hostlist-domains",required_argument,0,0},// optidx=47 + {"hostlist-exclude",required_argument,0,0}, // optidx=48 + {"hostlist-exclude-domains",required_argument,0,0},// optidx=49 + {"hostlist-auto",required_argument,0,0}, // optidx=50 + {"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=51 + {"hostlist-auto-fail-time",required_argument,0,0}, // optidx=52 + {"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=53 + {"hostlist-auto-debug",required_argument,0,0}, // optidx=54 + {"new",no_argument,0,0}, // optidx=55 + {"skip",no_argument,0,0}, // optidx=56 + {"filter-l3",required_argument,0,0}, // optidx=57 + {"filter-tcp",required_argument,0,0}, // optidx=58 + {"filter-udp",required_argument,0,0}, // optidx=59 + {"filter-l7",required_argument,0,0}, // optidx=60 + {"ipset",required_argument,0,0}, // optidx=61 + {"ipset-ip",required_argument,0,0}, // optidx=62 + {"ipset-exclude",required_argument,0,0},// optidx=63 + {"ipset-exclude-ip",required_argument,0,0}, // optidx=64 #ifdef __linux__ - {"bind-fix4",no_argument,0,0}, // optidx=61 - {"bind-fix6",no_argument,0,0}, // optidx=62 + {"bind-fix4",no_argument,0,0}, // optidx=65 + {"bind-fix6",no_argument,0,0}, // optidx=66 #elif defined(__CYGWIN__) - {"wf-iface",required_argument,0,0}, // optidx=61 - {"wf-l3",required_argument,0,0}, // optidx=62 - {"wf-tcp",required_argument,0,0}, // optidx=63 - {"wf-udp",required_argument,0,0}, // optidx=64 - {"wf-raw",required_argument,0,0}, // optidx=65 - {"wf-save",required_argument,0,0}, // optidx=66 - {"ssid-filter",required_argument,0,0}, // optidx=67 - {"nlm-filter",required_argument,0,0}, // optidx=68 - {"nlm-list",optional_argument,0,0}, // optidx=69 + {"wf-iface",required_argument,0,0}, // optidx=65 + {"wf-l3",required_argument,0,0}, // optidx=66 + {"wf-tcp",required_argument,0,0}, // optidx=67 + {"wf-udp",required_argument,0,0}, // optidx=68 + {"wf-raw",required_argument,0,0}, // optidx=69 + {"wf-save",required_argument,0,0}, // optidx=70 + {"ssid-filter",required_argument,0,0}, // optidx=71 + {"nlm-filter",required_argument,0,0}, // optidx=72 + {"nlm-list",optional_argument,0,0}, // optidx=73 #endif {NULL,0,NULL,0} }; @@ -1745,20 +1796,49 @@ int main(int argc, char **argv) } break; case 46: /* hostlist */ + if (bSkip) break; if (!RegisterHostlist(dp, false, optarg)) { DLOG_ERR("failed to register hostlist '%s'\n", optarg); exit_clean(1); } break; - case 47: /* hostlist-exclude */ + case 47: /* hostlist-domains */ + if (bSkip) break; + if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL))) + { + DLOG_ERR("failed to register anonymous hostlist\n"); + exit_clean(1); + } + if (!parse_domain_list(optarg, &anon_hl->hostlist)) + { + DLOG_ERR("failed to add domains to anonymous hostlist\n"); + exit_clean(1); + } + break; + case 48: /* hostlist-exclude */ + if (bSkip) break; if (!RegisterHostlist(dp, true, optarg)) { DLOG_ERR("failed to register hostlist '%s'\n", optarg); exit_clean(1); } break; - case 48: /* hostlist-auto */ + case 49: /* hostlist-exclude-domains */ + if (bSkip) break; + if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL))) + { + DLOG_ERR("failed to register anonymous hostlist\n"); + exit_clean(1); + } + if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist)) + { + DLOG_ERR("failed to add domains to anonymous hostlist\n"); + exit_clean(1); + } + break; + case 50: /* hostlist-auto */ + if (bSkip) break; if (dp->hostlist_auto) { DLOG_ERR("only one auto hostlist per profile is supported\n"); @@ -1785,7 +1865,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 49: /* hostlist-auto-fail-threshold */ + case 51: /* hostlist-auto-fail-threshold */ dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg); if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20) { @@ -1793,7 +1873,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 50: /* hostlist-auto-fail-time */ + case 52: /* hostlist-auto-fail-time */ dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg); if (dp->hostlist_auto_fail_time<1) { @@ -1801,7 +1881,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 51: /* hostlist-auto-retrans-threshold */ + case 53: /* hostlist-auto-retrans-threshold */ dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg); if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10) { @@ -1809,7 +1889,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 52: /* hostlist-auto-debug */ + case 54: /* hostlist-auto-debug */ { FILE *F = fopen(optarg,"a+t"); if (!F) @@ -1823,7 +1903,7 @@ int main(int argc, char **argv) } break; - case 53: /* new */ + case 55: /* new */ if (bSkip) { dp_clear(dp); @@ -1841,19 +1921,21 @@ int main(int argc, char **argv) dp = &dpl->dp; dp->n = ++desync_profile_count; } + anon_hl = anon_hl_exclude = NULL; + anon_ips = anon_ips_exclude = NULL; break; - case 54: /* skip */ + case 56: /* skip */ bSkip = true; break; - case 55: /* filter-l3 */ + case 57: /* filter-l3 */ if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6)) { DLOG_ERR("bad value for --filter-l3\n"); exit_clean(1); } break; - case 56: /* filter-tcp */ + case 58: /* filter-tcp */ if (!parse_pf_list(optarg,&dp->pf_tcp)) { DLOG_ERR("Invalid port filter : %s\n",optarg); @@ -1863,7 +1945,7 @@ int main(int argc, char **argv) if (!port_filters_deny_if_empty(&dp->pf_udp)) exit_clean(1); break; - case 57: /* filter-udp */ + case 59: /* filter-udp */ if (!parse_pf_list(optarg,&dp->pf_udp)) { DLOG_ERR("Invalid port filter : %s\n",optarg); @@ -1873,53 +1955,80 @@ int main(int argc, char **argv) if (!port_filters_deny_if_empty(&dp->pf_tcp)) exit_clean(1); break; - case 58: /* filter-l7 */ + case 60: /* filter-l7 */ if (!parse_l7_list(optarg,&dp->filter_l7)) { DLOG_ERR("Invalid l7 filter : %s\n",optarg); exit_clean(1); } break; - case 59: /* ipset */ + case 61: /* ipset */ + if (bSkip) break; if (!RegisterIpset(dp, false, optarg)) { DLOG_ERR("failed to register ipset '%s'\n", optarg); exit_clean(1); } break; - case 60: /* ipset-exclude */ + case 62: /* ipset-ip */ + if (bSkip) break; + if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL))) + { + DLOG_ERR("failed to register anonymous ipset\n"); + exit_clean(1); + } + if (!parse_ip_list(optarg, &anon_ips->ipset)) + { + DLOG_ERR("failed to add subnets to anonymous ipset\n"); + exit_clean(1); + } + break; + case 63: /* ipset-exclude */ + if (bSkip) break; if (!RegisterIpset(dp, true, optarg)) { DLOG_ERR("failed to register ipset '%s'\n", optarg); exit_clean(1); } break; - + case 64: /* ipset-exclude-ip */ + if (bSkip) break; + if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL))) + { + DLOG_ERR("failed to register anonymous ipset\n"); + exit_clean(1); + } + if (!parse_ip_list(optarg, &anon_ips_exclude->ipset)) + { + DLOG_ERR("failed to add subnets to anonymous ipset\n"); + exit_clean(1); + } + break; #ifdef __linux__ - case 61: /* bind-fix4 */ + case 65: /* bind-fix4 */ params.bind_fix4 = true; break; - case 62: /* bind-fix6 */ + case 66: /* bind-fix6 */ params.bind_fix6 = true; break; #elif defined(__CYGWIN__) - case 61: /* wf-iface */ + case 65: /* wf-iface */ if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx)) { DLOG_ERR("bad value for --wf-iface\n"); exit_clean(1); } break; - case 62: /* wf-l3 */ + case 66: /* wf-l3 */ if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6)) { DLOG_ERR("bad value for --wf-l3\n"); exit_clean(1); } break; - case 63: /* wf-tcp */ + case 67: /* wf-tcp */ hash_wf_tcp=hash_jen(optarg,strlen(optarg)); if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) || !wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst))) @@ -1928,7 +2037,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 64: /* wf-udp */ + case 68: /* wf-udp */ hash_wf_udp=hash_jen(optarg,strlen(optarg)); if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) || !wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst))) @@ -1937,7 +2046,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 65: /* wf-raw */ + case 69: /* wf-raw */ hash_wf_raw=hash_jen(optarg,strlen(optarg)); if (optarg[0]=='@') { @@ -1951,11 +2060,11 @@ int main(int argc, char **argv) windivert_filter[sizeof(windivert_filter) - 1] = '\0'; } break; - case 66: /* wf-save */ + case 70: /* wf-save */ strncpy(wf_save_file, optarg, sizeof(wf_save_file)); wf_save_file[sizeof(wf_save_file) - 1] = '\0'; break; - case 67: /* ssid-filter */ + case 71: /* ssid-filter */ hash_ssid_filter=hash_jen(optarg,strlen(optarg)); { char *e,*p = optarg; @@ -1973,7 +2082,7 @@ int main(int argc, char **argv) } } break; - case 68: /* nlm-filter */ + case 72: /* nlm-filter */ hash_nlm_filter=hash_jen(optarg,strlen(optarg)); { char *e,*p = optarg; @@ -1991,7 +2100,7 @@ int main(int argc, char **argv) } } break; - case 69: /* nlm-list */ + case 73: /* nlm-list */ if (!nlm_list(optarg && !strcmp(optarg,"all"))) { DLOG_ERR("could not get list of NLM networks\n"); diff --git a/nfq/pools.c b/nfq/pools.c index 81a7b80..4e96412 100644 --- a/nfq/pools.c +++ b/nfq/pools.c @@ -160,12 +160,17 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const struct hostlist_file *entry = malloc(sizeof(struct hostlist_file)); if (entry) { - if (!(entry->filename = strdup(filename))) + if (filename) { - free(entry); - return false; + if (!(entry->filename = strdup(filename))) + { + free(entry); + return false; + } } - entry->mod_time=0; + else + entry->filename = NULL; + entry->mod_time = 0; entry->hostlist = NULL; LIST_INSERT_HEAD(head, entry, next); } @@ -192,7 +197,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co LIST_FOREACH(hfile, head, next) { - if (!strcmp(hfile->filename,filename)) + if (hfile->filename && !strcmp(hfile->filename,filename)) return hfile; } return NULL; @@ -223,7 +228,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head LIST_FOREACH(item, head, next) { - if (!strcmp(item->hfile->filename,filename)) + if (item->hfile->filename && !strcmp(item->hfile->filename,filename)) return item; } return NULL; @@ -369,12 +374,17 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi struct ipset_file *entry = malloc(sizeof(struct ipset_file)); if (entry) { - if (!(entry->filename = strdup(filename))) + if (filename) { - free(entry); - return false; + if (!(entry->filename = strdup(filename))) + { + free(entry); + return false; + } } - entry->mod_time=0; + else + entry->filename = NULL; + entry->mod_time = 0; memset(&entry->ipset,0,sizeof(entry->ipset)); LIST_INSERT_HEAD(head, entry, next); } @@ -401,7 +411,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char LIST_FOREACH(hfile, head, next) { - if (!strcmp(hfile->filename,filename)) + if (hfile->filename && !strcmp(hfile->filename,filename)) return hfile; } return NULL; @@ -432,7 +442,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c LIST_FOREACH(item, head, next) { - if (!strcmp(item->hfile->filename,filename)) + if (item->hfile->filename && !strcmp(item->hfile->filename,filename)) return item; } return NULL;