- Added documentation to the ipset files (for doxygen output).

diff --git a/doc/Changelog b/doc/Changelog
index 62bc98f60507aa645dd74cf4e8ddf01d48f7387a..210223d0d91dd08e3769ab0726f2afc1bde57a90 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -7,6 +7,7 @@
          use unsigned type because of comparison, and assign null instead
          of compare with it.  Remade lex and yacc output.
        - make depend
+       - Added documentation to the ipset files (for doxygen output).
 
 17 June 2019: Wouter
        - Master contains version 1.9.3 in development.

diff --git a/ipset/ipset.c b/ipset/ipset.c
index 49484361d872861f5c01cf4879738a80c70e6340..85b2edea9ed4c1d55a91604b237f8dd04ad2e72b 100755 (executable)
--- a/ipset/ipset.c
+++ b/ipset/ipset.c
@@ -1,3 +1,10 @@
+/**
+ * \file
+ * This file implements the ipset module.  It can handle packets by putting
+ * the A and AAAA addresses that are configured in unbound.conf as type
+ * ipset (local-zone statements) into a firewall rule IPSet.  For firewall
+ * blacklist and whitelist usage.
+ */
 #include "config.h"
 #include "ipset/ipset.h"
 #include "util/regional.h"

diff --git a/ipset/ipset.h b/ipset/ipset.h
index 19a12e038eba9889b154c71c3fe4d6d6398809aa..f60a8be8c8377da240452b2464298a83772dff44 100755 (executable)
--- a/ipset/ipset.h
+++ b/ipset/ipset.h
@@ -6,6 +6,29 @@
  */
 #ifndef IPSET_H
 #define IPSET_H
+/** \file
+ *
+ * This file implements the ipset module.  It can handle packets by putting
+ * the A and AAAA addresses that are configured in unbound.conf as type
+ * ipset (local-zone statements) into a firewall rule IPSet.  For firewall
+ * blacklist and whitelist usage.
+ *
+ * To use the IPset module, install the libmnl-dev (or libmnl-devel) package
+ * and configure with --enable-ipset.  And compile.  Then enable the ipset
+ * module in unbound.conf with module-config: "ipset validator iterator"
+ * then create it with ipset -N blacklist iphash and then add
+ * local-zone: "example.com." ipset
+ * statements for the zones where you want the addresses of the names
+ * looked up added to the set.
+ *
+ * Set the name of the set with
+ * ipset:
+ *   name-v4: "blacklist"
+ *   name-v6: "blacklist6"
+ * in unbound.conf.  The set can be used in this way:
+ *   iptables -A INPUT -m set --set blacklist src -j DROP
+ *   ip6tables -A INPUT -m set --set blacklist6 src -j DROP
+ */
 
 #include "util/module.h"