diff --git a/config/cfgroot/xdpsni-settings b/config/cfgroot/xdpsni-settings new file mode 100644 index 000000000..9ffc75cab --- /dev/null +++ b/config/cfgroot/xdpsni-settings @@ -0,0 +1 @@ +ENABLE_SNIBLOCK=on diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index 11ec28ca4..bf74a487a 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -203,3 +203,4 @@ var/ipfire/wireless var/ipfire/ddos var/ipfire/loxilb var/ipfire/xdpdns +var/ipfire/xdpsni diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index 10f013a7b..abce8e97f 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -94,6 +94,7 @@ etc/rc.d/init.d/wlanclient etc/rc.d/init.d/ddos etc/rc.d/init.d/loxilb etc/rc.d/init.d/xdpdns +etc/rc.d/init.d/xdpsni #etc/rc.d/rc0.d #etc/rc.d/rc0.d/K01imspetor #etc/rc.d/rc0.d/K01motion diff --git a/config/rootfiles/common/xdp-tools b/config/rootfiles/common/xdp-tools index 91ac53e9d..ae145b4d9 100644 --- a/config/rootfiles/common/xdp-tools +++ b/config/rootfiles/common/xdp-tools @@ -10,6 +10,7 @@ etc/rc.d/rc3.d/S102xdpdns usr/sbin/xdp_dns_log usr/sbin/xdp_sni usr/sbin/xdp_sni_log +etc/rc.d/rc3.d/S103xdpsni usr/lib/bpf/xdpdump_bpf.o usr/lib/bpf/xdpdump_xdp.o usr/lib/bpf/xdpfilt_alw_all.o diff --git a/lfs/configroot b/lfs/configroot index f3ff33bfb..fa0fcf6e9 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -54,7 +54,7 @@ $(TARGET) : ethernet extrahd/bin fwlogs fwhosts firewall ipblocklist key langs logging mac main \ menu.d modem optionsfw \ ovpn patches pakfire portfw ppp private proxy/advanced/cre \ - proxy/calamaris/bin qos/bin red remote ddos loxilb keepalived xdpdns sensors suricata time \ + proxy/calamaris/bin qos/bin red remote ddos loxilb keepalived xdpdns xdpsni sensors suricata time \ updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin vpn \ wakeonlan wireless ; do \ mkdir -p $(CONFIG_ROOT)/$$i; \ @@ -68,7 +68,7 @@ $(TARGET) : fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customlocationgrp fwlogs/ipsettings fwlogs/portsettings ipblocklist/modified \ ipblocklist/settings mac/settings main/hosts main/routing main/security main/settings optionsfw/settings \ ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \ - ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings ddos/settings ddos/tcp_ports ddos/udp-ddos-settings ddos/udp_ports ddos/dns-ddos-settings loxilb/settings xdpdns/settings xdpdns/domainfile keepalived/keepalived.conf keepalived/runsettings keepalived/settings keepalived/configvs keepalived/configrs qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \ + ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings ddos/settings ddos/tcp_ports ddos/udp-ddos-settings ddos/udp_ports ddos/dns-ddos-settings loxilb/settings xdpdns/settings xdpdns/domainfile xdpsni/settings xdpsni/domainfile keepalived/keepalived.conf keepalived/runsettings keepalived/settings keepalived/configvs keepalived/configrs qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \ qos/tosconfig suricata/settings vpn/config vpn/settings vpn/ipsec.conf \ vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings; do \ touch $(CONFIG_ROOT)/$$i; \ @@ -106,6 +106,7 @@ $(TARGET) : cp $(DIR_SRC)/config/cfgroot/loxilb-settings $(CONFIG_ROOT)/loxilb/settings cp $(DIR_SRC)/config/cfgroot/loxilb-FWconfig.txt $(CONFIG_ROOT)/loxilb/FWconfig.txt cp $(DIR_SRC)/config/cfgroot/xdpdns-settings $(CONFIG_ROOT)/xdpdns/settings + cp $(DIR_SRC)/config/cfgroot/xdpsni-settings $(CONFIG_ROOT)/xdpsni/settings cp $(DIR_SRC)/config/cfgroot/time-settings $(CONFIG_ROOT)/time/settings cp $(DIR_SRC)/config/cfgroot/logging-settings $(CONFIG_ROOT)/logging/settings cp $(DIR_SRC)/config/cfgroot/ethernet-vlans $(CONFIG_ROOT)/ethernet/vlans diff --git a/lfs/initscripts b/lfs/initscripts index 7a17847ae..4c96d37a5 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -138,6 +138,7 @@ $(TARGET) : ln -sf ../init.d/loxilb /etc/rc.d/rc3.d/S100loxilb ln -sf ../init.d/keepalived /etc/rc.d/rc3.d/S101keepalived ln -sf ../init.d/xdpdns /etc/rc.d/rc3.d/S102xdpdns + ln -sf ../init.d/xdpsni /etc/rc.d/rc3.d/S103xdpsni ln -sf ../init.d/imspetor /etc/rc.d/rc6.d/K01imspetor ln -sf ../init.d/motion /etc/rc.d/rc6.d/K01motion diff --git a/src/initscripts/system/xdpsni b/src/initscripts/system/xdpsni new file mode 100755 index 000000000..c703f4eda --- /dev/null +++ b/src/initscripts/system/xdpsni @@ -0,0 +1,99 @@ +#!/bin/sh +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team # +# Copyright (C) 2024 BPFire # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +. /etc/sysconfig/rc +. $rc_functions + +eval $(/usr/local/bin/readhash /var/ipfire/xdpsni/settings) + +domainfile="/var/ipfire/xdpsni/domainfile" + +load_sniblock () { + /usr/sbin/xdp-loader status green0 | grep -w 'xdp_tls_sni' + if [ $? -ne 0 ]; then + xdp-loader load green0 -P 80 -p /sys/fs/bpf/xdp-sni -n xdp_tls_sni /usr/lib/bpf/xdp_sni.bpf.o + if [ $? -ge 1 ]; then + boot_mesg "Native mode not supported, try SKB" + xdp-loader load green0 -m skb -P 80 -p /sys/fs/bpf/xdp-sni -n xdp_tls_sni /usr/lib/bpf/xdp_sni.bpf.o + fi + # allow WUI nobody with permission to update map + chown -R nobody /sys/fs/bpf/xdp-sni + # add domain to domain_denylist map + while IFS= read -r line; do + xdp_sni add $line + done < $domainfile + + fi +} + +unload_sniblock () { + /usr/sbin/xdp-loader status green0 | grep -w 'xdp_tls_sni' + if [ $? -eq 0 ]; then + prog_id=$(xdp-loader status green0 | grep 'xdp_tls_sni' | awk '{print $4}') + /usr/sbin/xdp-loader unload -i $prog_id green0 + else + boot_mesg "Error xdp_tls_sni not loaded!" + fi +} + +is_xdpsni_attached () { + /usr/sbin/xdp-loader status green0 | grep -w 'xdp_tls_sni' >> /dev/null + if [ $? -eq 0 ]; then + echo "xdp_tls_sni is attached to green0" + else + echo "xdp_tls_sni is not attached to green0" + fi +} + + +case "$1" in + start) + boot_mesg -n "Starting xdp-sni..." + if [ "$ENABLE_SNIBLOCK" == "on" ]; then + load_sniblock + loadproc -b xdp_sni_log + fi + ;; + + stop) + boot_mesg "Stopping xdp-sni..." + if [ "$ENABLE_SNIBLOCK" == "off" ]; then + unload_sniblock + killproc xdp_sni_log + fi + ;; + + status) + is_xdpsni_attached + ;; + + restart) + $0 stop + sleep 1 + $0 start + ;; + + *) + echo "Usage: $0 {start|stop|restart}" + exit 1 + ;; +esac