mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-09 18:45:54 +02:00
xdp-tailcall: add xdp-tailcall init script
xdp-tailcall init script to start/stop XDP tail call program DNS and TLS SNI on green0 interface Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
1
config/cfgroot/xdptailcall-settings
Normal file
1
config/cfgroot/xdptailcall-settings
Normal file
@@ -0,0 +1 @@
|
||||
ENABLE_XDPTAILCALL=on
|
||||
@@ -201,3 +201,4 @@ var/ipfire/wakeonlan
|
||||
var/ipfire/wireless
|
||||
#var/ipfire/wireless/config
|
||||
#var/ipfire/wireless/settings
|
||||
var/ipfire/xdptailcall
|
||||
|
||||
@@ -92,6 +92,7 @@ etc/rc.d/init.d/unbound
|
||||
etc/rc.d/init.d/vnstat
|
||||
etc/rc.d/init.d/waitdrives
|
||||
etc/rc.d/init.d/wlanclient
|
||||
etc/rc.d/init.d/xdptailcall
|
||||
#etc/rc.d/rc0.d
|
||||
etc/rc.d/rc0.d/K01grub-btrfsd
|
||||
#etc/rc.d/rc0.d/K01imspetor
|
||||
@@ -139,6 +140,7 @@ etc/rc.d/rc3.d/S99grub-btrfsd
|
||||
#etc/rc.d/rc3.d/S99imspetor
|
||||
#etc/rc.d/rc3.d/S99motion
|
||||
#etc/rc.d/rc3.d/S99vdradmin
|
||||
etc/rc.d/rc3.d/S102xdptailcall
|
||||
#etc/rc.d/rc6.d
|
||||
etc/rc.d/rc6.d/K01grub-btrfsd
|
||||
#etc/rc.d/rc6.d/K01imspetor
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
usr/lib/bpf/xdp-dispatcher.o
|
||||
usr/lib/bpf/xdp_synproxy.bpf.o
|
||||
#etc/rc.d/rc3.d/S105ddos
|
||||
usr/lib/bpf/xdp_dnsrrl.bpf.o
|
||||
usr/lib/bpf/xdp_udp.bpf.o
|
||||
usr/lib/bpf/xdp_dns.bpf.o
|
||||
@@ -10,17 +9,11 @@ usr/lib/bpf/xdp_udpddos.bpf.o
|
||||
usr/lib/bpf/xdp_tailcall.bpf.o
|
||||
usr/sbin/xdp-udp
|
||||
usr/sbin/xdp_dns
|
||||
usr/sbin/xdp_tailcall_dns
|
||||
#etc/rc.d/rc3.d/S102xdpdns
|
||||
usr/sbin/xdp_dns_log
|
||||
usr/sbin/xdp_tailcall_dns_log
|
||||
usr/sbin/xdp_sni
|
||||
usr/sbin/xdp_tailcall_sni
|
||||
usr/sbin/xdp_sni_log
|
||||
usr/sbin/xdp_tailcall_sni_log
|
||||
#etc/rc.d/rc3.d/S103xdpsni
|
||||
usr/sbin/xdp_dns_log
|
||||
usr/sbin/xdp_geoip
|
||||
#etc/rc.d/rc3.d/S104xdpgeoip
|
||||
usr/lib/bpf/xdpdump_bpf.o
|
||||
usr/lib/bpf/xdpdump_xdp.o
|
||||
usr/lib/bpf/xdpfilt_alw_all.o
|
||||
|
||||
@@ -56,7 +56,7 @@ $(TARGET) :
|
||||
ovpn patches pakfire portfw ppp private proxy/advanced/cre \
|
||||
proxy/calamaris/bin qos/bin red remote sensors suricata time \
|
||||
updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin vpn \
|
||||
wakeonlan wireless ; do \
|
||||
wakeonlan wireless xdptailcall; do \
|
||||
mkdir -p $(CONFIG_ROOT)/$$i; \
|
||||
done
|
||||
|
||||
@@ -70,7 +70,7 @@ $(TARGET) :
|
||||
ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \
|
||||
ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
|
||||
qos/tosconfig suricata/settings vpn/config vpn/settings vpn/ipsec.conf \
|
||||
vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings; do \
|
||||
vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings xdptailcall/settings; do \
|
||||
touch $(CONFIG_ROOT)/$$i; \
|
||||
done
|
||||
|
||||
@@ -111,6 +111,7 @@ $(TARGET) :
|
||||
cp $(DIR_SRC)/config/fwhosts/icmp-types $(CONFIG_ROOT)/fwhosts/icmp-types
|
||||
cp $(DIR_SRC)/config/fwhosts/customservices $(CONFIG_ROOT)/fwhosts/customservices
|
||||
cp $(DIR_SRC)/config/fwhosts/customservices $(CONFIG_ROOT)/fwhosts/customservices.default
|
||||
cp $(DIR_SRC)/config/cfgroot/xdptailcall-settings $(CONFIG_ROOT)/xdptailcall/settings
|
||||
# Oneliner configfiles
|
||||
echo "ENABLED=off" > $(CONFIG_ROOT)/vpn/settings
|
||||
echo "01" > $(CONFIG_ROOT)/certs/serial
|
||||
|
||||
@@ -181,7 +181,7 @@ $(TARGET) :
|
||||
ln -sf ../init.d/firstsetup /etc/rc.d/rcsysinit.d/S75firstsetup
|
||||
ln -sf ../init.d/localnet /etc/rc.d/rcsysinit.d/S80localnet
|
||||
ln -sf ../init.d/firewall /etc/rc.d/rcsysinit.d/S85firewall
|
||||
#ln -sf ../init.d/xdpdns /etc/rc.d/rc3.d/S102xdpdns
|
||||
ln -sf ../init.d/xdptailcall /etc/rc.d/rc3.d/S102xdptailcall
|
||||
#ln -sf ../init.d/xdpsni /etc/rc.d/rc3.d/S103xdpsni
|
||||
#ln -sf ../init.d/xdpgeoip /etc/rc.d/rc3.d/S104xdpgeoip
|
||||
#ln -sf ../init.d/ddos /etc/rc.d/rc3.d/S105ddos
|
||||
|
||||
105
src/initscripts/system/xdptailcall
Executable file
105
src/initscripts/system/xdptailcall
Executable file
@@ -0,0 +1,105 @@
|
||||
#!/bin/sh
|
||||
###############################################################################
|
||||
# #
|
||||
# IPFire.org - A linux based firewall #
|
||||
# Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
|
||||
# Copyright (C) 2024-2025 BPFire <vincent.mc.li@gmail.com> #
|
||||
# #
|
||||
# This program is free software: you can redistribute it and/or modify #
|
||||
# it under the terms of the GNU General Public License as published by #
|
||||
# the Free Software Foundation, either version 3 of the License, or #
|
||||
# (at your option) any later version. #
|
||||
# #
|
||||
# This program is distributed in the hope that it will be useful, #
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
||||
# GNU General Public License for more details. #
|
||||
# #
|
||||
# You should have received a copy of the GNU General Public License #
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
||||
# #
|
||||
###############################################################################
|
||||
|
||||
. /etc/sysconfig/rc
|
||||
. $rc_functions
|
||||
|
||||
eval $(/usr/local/bin/readhash /var/ipfire/xdptailcall/settings)
|
||||
|
||||
sni_domainfile="/var/ipfire/xdptailcall/sni_domainfile"
|
||||
dns_domainfile="/var/ipfire/xdptailcall/dns_domainfile"
|
||||
|
||||
load_xdptailcall () {
|
||||
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall'
|
||||
if [ $? -ne 0 ]; then
|
||||
xdp-loader load green0 -P 80 -p /sys/fs/bpf/xdp-tailcall -n xdp_tailcall /usr/lib/bpf/xdp_tailcall.bpf.o
|
||||
if [ $? -ge 1 ]; then
|
||||
boot_mesg "Native mode not supported, try SKB"
|
||||
xdp-loader load green0 -m skb -P 80 -p /sys/fs/bpf/xdp-tailcall -n xdp_tailcall /usr/lib/bpf/xdp_tailcall.bpf.o
|
||||
fi
|
||||
# allow WUI nobody with permission to update map
|
||||
chown -R nobody /sys/fs/bpf/xdp-tailcall
|
||||
# add domain to domain_denylist map
|
||||
while IFS= read -r line; do
|
||||
xdp_sni /sys/fs/bpf/xdp-tailcall/sni_denylist add $line
|
||||
done < $sni_domainfile
|
||||
while IFS= read -r line; do
|
||||
xdp_dns /sys/fs/bpf/xdp-tailcall/domain_denylist add $line
|
||||
done < $dns_domainfile
|
||||
|
||||
fi
|
||||
}
|
||||
|
||||
unload_xdptailcall () {
|
||||
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall'
|
||||
if [ $? -eq 0 ]; then
|
||||
prog_id=$(xdp-loader status green0 | grep 'xdp_tailcall' | awk '{print $4}')
|
||||
/usr/sbin/xdp-loader unload -i $prog_id green0
|
||||
else
|
||||
boot_mesg "Error xdp_tailcall not loaded!"
|
||||
fi
|
||||
}
|
||||
|
||||
is_xdptailcall_attached () {
|
||||
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall' >> /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "xdp_tailcall is attached to green0"
|
||||
else
|
||||
echo "xdp_tailcall is not attached to green0"
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
boot_mesg -n "Starting xdp-tailcall..."
|
||||
if [ "$ENABLE_XDPTAILCALL" == "on" ]; then
|
||||
load_xdptailcall
|
||||
loadproc -b xdp_sni_log /sys/fs/bpf/xdp-tailcall/sni_ringbuf
|
||||
loadproc -b xdp_dns_log /sys/fs/bpf/xdp-tailcall/dns_ringbuf
|
||||
fi
|
||||
;;
|
||||
|
||||
stop)
|
||||
boot_mesg "Stopping xdp-tailcall..."
|
||||
if [ "$ENABLE_XDPTAILCALL" == "off" ]; then
|
||||
unload_xdptailcall
|
||||
killproc xdp_sni_log
|
||||
killproc xdp_dns_log
|
||||
fi
|
||||
;;
|
||||
|
||||
status)
|
||||
is_xdptailcall_attached
|
||||
;;
|
||||
|
||||
restart)
|
||||
$0 stop
|
||||
sleep 1
|
||||
$0 start
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "Usage: $0 {start|stop|restart}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue
Block a user