diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 index a725b33..48f4d96 100644 --- a/docs/libcurl/curl_easy_setopt.3 +++ b/docs/libcurl/curl_easy_setopt.3 @@ -1805,6 +1805,16 @@ resolves, by including a string in the linked list that uses the format and port number must exactly match what was already added previously. (Added in 7.12.3) +.IP CURLOPT_IGNORE_IPS +Pass a pointer to a linked list of strings with IP addresses (either +IPv4 or IPv6 notation). The listed addresses will not be used by curl +as destination address to connect to. This may be useful to blacklist +certain hosts if a DNS hostname resolves to multiple addresses. + +If all addresses of a host are mentioned in this list, then the connection +will fail. Even if a host only has one address (or an explicit IP address +is used in the request), then this address will not be used if it's in the +ignore list and the request will fail. .SH SSL and SECURITY OPTIONS .IP CURLOPT_SSLCERT Pass a pointer to a zero terminated string as parameter. The string should be diff --git a/include/curl/curl.h b/include/curl/curl.h index fbd0d9b..609ed43 100644 --- a/include/curl/curl.h +++ b/include/curl/curl.h @@ -1442,6 +1442,9 @@ typedef enum { /* send linked-list of name:port:address sets */ CINIT(RESOLVE, OBJECTPOINT, 203), + /* send linked-list of blacklisted IP addresses */ + CINIT(IGNORE_IPS, OBJECTPOINT, 204), + CURLOPT_LASTENTRY /* the last unused */ } CURLoption; diff --git a/lib/connect.c b/lib/connect.c index be87ed9..5d4ed5d 100644 --- a/lib/connect.c +++ b/lib/connect.c @@ -1054,6 +1054,22 @@ CURLcode Curl_connecthost(struct connectdata *conn, /* context */ ai = remotehost->addr; + /* Convert list of blacklisted IPs to address format */ + struct curl_slist *bad_addr; + struct Curl_addrinfo *blist, *next, *prev; + + blist = NULL; + for (bad_addr = data->set.ignoreip; bad_addr; bad_addr = bad_addr->next) { + next = Curl_str2addr(bad_addr->data, 0); + if (!next) + continue; + if (!blist) + blist = next; + else + prev->ai_next = next; + prev = next; + } + /* Below is the loop that attempts to connect to all IP-addresses we * know for the given host. One by one until one IP succeeds. */ @@ -1064,6 +1080,34 @@ CURLcode Curl_connecthost(struct connectdata *conn, /* context */ for (curr_addr = ai, aliasindex=0; curr_addr; curr_addr = curr_addr->ai_next, aliasindex++) { + /* Check IP blacklist */ + if (blist) { + bool flag_bad = FALSE; + + for (next = blist; next; next = next->ai_next) { + if (AF_INET == curr_addr->ai_family && + AF_INET == next->ai_family && + memcmp(&((struct sockaddr_in *)curr_addr->ai_addr)->sin_addr, + &((struct sockaddr_in *)next->ai_addr)->sin_addr, + sizeof(struct in_addr)) == 0) { + flag_bad = TRUE; + break; + } else if (AF_INET6 == curr_addr->ai_family && + AF_INET6 == next->ai_family && + IN6_ARE_ADDR_EQUAL( + &((struct sockaddr_in6 *)curr_addr->ai_addr)->sin6_addr, + &((struct sockaddr_in6 *)next->ai_addr)->sin6_addr)) { + flag_bad = TRUE; + break; + } + } + if (flag_bad) { + /* skip blacklisted IP */ + infof(data, "Ignoring blacklisted IP address\n"); + continue; + } + } + /* start connecting to the IP curr_addr points to */ CURLcode res = singleipconnect(conn, curr_addr, @@ -1071,8 +1115,10 @@ CURLcode Curl_connecthost(struct connectdata *conn, /* context */ (data->state.used_interface == Curl_if_multi)?0: conn->timeoutms_per_addr, &sockfd, connected); - if(res) + if(res) { + Curl_freeaddrinfo(blist); return res; + } if(sockfd != CURL_SOCKET_BAD) break; @@ -1082,11 +1128,14 @@ CURLcode Curl_connecthost(struct connectdata *conn, /* context */ timeout_ms -= Curl_tvdiff(after, before); if(timeout_ms < 0) { failf(data, "connect() timed out!"); + Curl_freeaddrinfo(blist); return CURLE_OPERATION_TIMEDOUT; } before = after; } /* end of connect-to-each-address loop */ + Curl_freeaddrinfo(blist); + *sockconn = sockfd; /* the socket descriptor we've connected */ if(sockfd == CURL_SOCKET_BAD) { diff --git a/lib/url.c b/lib/url.c index ed310b3..7f61651 100644 --- a/lib/url.c +++ b/lib/url.c @@ -1778,6 +1778,14 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, data->set.resolve = va_arg(param, struct curl_slist *); data->change.resolve = data->set.resolve; break; + case CURLOPT_IGNORE_IPS: + /* + * List of addresses to populate the DNS blacklist with. + * Blacklisting is intended for hostnames that resolve to multiple + * IP addresses: the blacklisted adresses are not used. + */ + data->set.ignoreip = va_arg(param, struct curl_slist *); + break; case CURLOPT_PROGRESSFUNCTION: /* * Progress callback function diff --git a/lib/urldata.h b/lib/urldata.h index 2765c3e..5caeb4d 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -1388,6 +1388,8 @@ struct UserDefined { struct curl_slist *telnet_options; /* linked list of telnet options */ struct curl_slist *resolve; /* list of names to add/remove from DNS cache */ + struct curl_slist *ignoreip; /* list of names to add/remove from + DNS blacklist */ curl_TimeCond timecondition; /* kind of time/date comparison */ time_t timevalue; /* what time to compare with */ Curl_HttpReq httpreq; /* what kind of HTTP request (if any) is this */ diff --git a/src/main.c b/src/main.c index 7e2e34e..4645720 100644 --- a/src/main.c +++ b/src/main.c @@ -582,6 +582,7 @@ struct Configurable { struct curl_httppost *last_post; struct curl_slist *telnet_options; struct curl_slist *resolve; + struct curl_slist *ignoreip; HttpReq httpreq; /* for bandwidth limiting features: */ @@ -813,6 +814,7 @@ static void help(void) " --hostpubmd5 Hex encoded MD5 string of the host public key. (SSH)", " -0/--http1.0 Use HTTP 1.0 (H)", " --ignore-content-length Ignore the HTTP Content-Length header", + " --ignoreip Blacklist use of IP ADDRESSES", " -i/--include Include protocol headers in the output (H/F)", " -k/--insecure Allow connections to SSL sites without certs (H)", " --interface Specify network interface/address to use", @@ -1887,6 +1889,7 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */ {"$D", "proto", TRUE}, {"$E", "proto-redir", TRUE}, {"$F", "resolve", TRUE}, + {"$G", "ignoreip", TRUE}, {"0", "http1.0", FALSE}, {"1", "tlsv1", FALSE}, {"2", "sslv2", FALSE}, @@ -2453,6 +2456,11 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */ if(err) return err; break; + case 'G': /* --ignoreip */ + err = add2list(&config->ignoreip, nextarg); + if(err) + return err; + break; } break; case '#': /* --progress-bar */ @@ -4060,6 +4068,7 @@ static void free_config_fields(struct Configurable *config) curl_slist_free_all(config->telnet_options); curl_slist_free_all(config->mail_rcpt); curl_slist_free_all(config->resolve); + curl_slist_free_all(config->ignoreip); if(config->easy) curl_easy_cleanup(config->easy); @@ -5462,6 +5471,9 @@ operate(struct Configurable *config, int argc, argv_item_t argv[]) /* new in 7.21.3 */ my_setopt(curl, CURLOPT_RESOLVE, config->resolve); + if(config->ignoreip) + my_setopt(curl, CURLOPT_IGNORE_IPS, config->ignoreip); + retry_numretries = config->req_retry; retrystart = cutil_tvnow();