added :excludeRange and :includeRange methods to DynBPFFilter class

diff --git a/pdns/dnsdist-dynbpf.cc b/pdns/dnsdist-dynbpf.cc
index 7abddedf530cc3021d204ac39e913b0195c33683..bdaa3c578a9f3df9a21745816db5cbf194c0fe88 100644 (file)
--- a/pdns/dnsdist-dynbpf.cc
+++ b/pdns/dnsdist-dynbpf.cc
@@ -28,6 +28,11 @@ bool DynBPFFilter::block(const ComboAddress& addr, const struct timespec& until)
   bool inserted = false;
   std::unique_lock<std::mutex> lock(d_mutex);
 
+  if (d_excludedSubnets.match(addr)) {
+    /* do not add a block for excluded subnets */
+    return inserted;
+  }
+
   const container_t::iterator it = d_entries.find(addr);
   if (it != d_entries.end()) {
     if (it->d_until < until) {

diff --git a/pdns/dnsdist-dynbpf.hh b/pdns/dnsdist-dynbpf.hh
index 321e930beace6485b04889fcb099692946bb52d3..521006bd3df5b037eefe56f1dedb30bf4a3036f2 100644 (file)
--- a/pdns/dnsdist-dynbpf.hh
+++ b/pdns/dnsdist-dynbpf.hh
@@ -41,6 +41,14 @@ public:
   ~DynBPFFilter()
   {
   }
+  void excludeRange(const Netmask& range)
+  {
+    d_excludedSubnets.addMask(range);
+  }
+  void includeRange(const Netmask& range)
+  {
+    d_excludedSubnets.addMask(range, false);
+  }
   /* returns true if the addr wasn't already blocked, false otherwise */
   bool block(const ComboAddress& addr, const struct timespec& until);
   void purgeExpired(const struct timespec& now);
@@ -63,6 +71,7 @@ private:
   container_t d_entries;
   std::mutex d_mutex;
   std::shared_ptr<BPFFilter> d_bpf;
+  NetmaskGroup d_excludedSubnets;
 };
 
 #endif /* HAVE_EBPF */

diff --git a/pdns/dnsdist-lua-bindings.cc b/pdns/dnsdist-lua-bindings.cc
index 334310d00fcef2aec11054d5d00e6598ce5e1746..0902c7d7e707cd881cd7a2f7622cf4c409ef1837 100644 (file)
--- a/pdns/dnsdist-lua-bindings.cc
+++ b/pdns/dnsdist-lua-bindings.cc
@@ -544,5 +544,27 @@ void setupLuaBindings(bool client)
           dbpf->purgeExpired(now);
         }
     });
+
+    g_lua.registerFunction<void(std::shared_ptr<DynBPFFilter>::*)(boost::variant<std::string, std::vector<std::pair<int, std::string>>>)>("excludeRange", [](std::shared_ptr<DynBPFFilter> dbpf, boost::variant<std::string, std::vector<std::pair<int, std::string>>> ranges) {
+      if (ranges.type() == typeid(std::vector<std::pair<int, std::string>>)) {
+        for (const auto& range : *boost::get<std::vector<std::pair<int, std::string>>>(&ranges)) {
+          dbpf->excludeRange(Netmask(range.second));
+        }
+      }
+      else {
+        dbpf->excludeRange(Netmask(*boost::get<std::string>(&ranges)));
+      }
+    });
+
+    g_lua.registerFunction<void(std::shared_ptr<DynBPFFilter>::*)(boost::variant<std::string, std::vector<std::pair<int, std::string>>>)>("includeRange", [](std::shared_ptr<DynBPFFilter> dbpf, boost::variant<std::string, std::vector<std::pair<int, std::string>>> ranges) {
+      if (ranges.type() == typeid(std::vector<std::pair<int, std::string>>)) {
+        for (const auto& range : *boost::get<std::vector<std::pair<int, std::string>>>(&ranges)) {
+          dbpf->includeRange(Netmask(range.second));
+        }
+      }
+      else {
+        dbpf->includeRange(Netmask(*boost::get<std::string>(&ranges)));
+      }
+    });
 #endif /* HAVE_EBPF */
 }

diff --git a/pdns/dnsdistdist/docs/reference/ebpf.rst b/pdns/dnsdistdist/docs/reference/ebpf.rst
index 482b1ff5c8097e909e46d029056393bb87095d79..4c432a235163950932d8acf934e190331414ed1b 100644 (file)
--- a/pdns/dnsdistdist/docs/reference/ebpf.rst
+++ b/pdns/dnsdistdist/docs/reference/ebpf.rst
@@ -95,3 +95,18 @@ These are all the functions, objects and methods related to the :doc:`../advance
 
   Represents an dynamic eBPF filter, allowing the use of ephemeral rules to an existing eBPF filter.
 
+  .. method:: DynBPFFilter:excludeRange(netmasks)
+
+    .. versionadded:: 1.3.3
+
+    Exclude this range, or list of ranges, meaning that no dynamic block will ever be inserted for clients in that range. Default to empty, meaning rules are applied to all ranges. When used in combination with :meth:`DynBPFFilter:includeRange`, the more specific entry wins.
+
+    :param int netmasks: A netmask, or list of netmasks, as strings, like for example "192.0.2.1/24"
+
+  .. method:: DynBPFFilter:includeRange(netmasks)
+
+    .. versionadded:: 1.3.3
+
+    Include this range, or list of ranges, meaning that rules will be applied to this range. When used in combination with :meth:`DynBPFFilter:excludeRange`, the more specific entry wins.
+
+    :param int netmasks: A netmask, or list of netmasks, as strings, like for example "192.0.2.1/24"