From 8c30bad8f8d80d384057183076f10431f41a936b Mon Sep 17 00:00:00 2001 From: Vincent Li Date: Fri, 10 Jan 2025 20:27:46 -0800 Subject: [PATCH] xdp-tailcall: add xdp-tailcall init script xdp-tailcall init script to start/stop XDP tail call program DNS and TLS SNI on green0 interface Signed-off-by: Vincent Li --- config/cfgroot/xdptailcall-settings | 1 + config/rootfiles/common/configroot | 1 + .../rootfiles/common/loongarch64/initscripts | 2 + config/rootfiles/common/xdp-tools | 9 +- lfs/configroot | 5 +- lfs/initscripts | 2 +- src/initscripts/system/xdptailcall | 105 ++++++++++++++++++ 7 files changed, 114 insertions(+), 11 deletions(-) create mode 100644 config/cfgroot/xdptailcall-settings create mode 100755 src/initscripts/system/xdptailcall diff --git a/config/cfgroot/xdptailcall-settings b/config/cfgroot/xdptailcall-settings new file mode 100644 index 000000000..415266985 --- /dev/null +++ b/config/cfgroot/xdptailcall-settings @@ -0,0 +1 @@ +ENABLE_XDPTAILCALL=on diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index 9839eee45..e2352e8a7 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -201,3 +201,4 @@ var/ipfire/wakeonlan var/ipfire/wireless #var/ipfire/wireless/config #var/ipfire/wireless/settings +var/ipfire/xdptailcall diff --git a/config/rootfiles/common/loongarch64/initscripts b/config/rootfiles/common/loongarch64/initscripts index 0e4364f54..3f3276995 100644 --- a/config/rootfiles/common/loongarch64/initscripts +++ b/config/rootfiles/common/loongarch64/initscripts @@ -92,6 +92,7 @@ etc/rc.d/init.d/unbound etc/rc.d/init.d/vnstat etc/rc.d/init.d/waitdrives etc/rc.d/init.d/wlanclient +etc/rc.d/init.d/xdptailcall #etc/rc.d/rc0.d etc/rc.d/rc0.d/K01grub-btrfsd #etc/rc.d/rc0.d/K01imspetor @@ -139,6 +140,7 @@ etc/rc.d/rc3.d/S99grub-btrfsd #etc/rc.d/rc3.d/S99imspetor #etc/rc.d/rc3.d/S99motion #etc/rc.d/rc3.d/S99vdradmin +etc/rc.d/rc3.d/S102xdptailcall #etc/rc.d/rc6.d etc/rc.d/rc6.d/K01grub-btrfsd #etc/rc.d/rc6.d/K01imspetor diff --git a/config/rootfiles/common/xdp-tools b/config/rootfiles/common/xdp-tools index 3707f68b3..f45fb7106 100644 --- a/config/rootfiles/common/xdp-tools +++ b/config/rootfiles/common/xdp-tools @@ -1,6 +1,5 @@ usr/lib/bpf/xdp-dispatcher.o usr/lib/bpf/xdp_synproxy.bpf.o -#etc/rc.d/rc3.d/S105ddos usr/lib/bpf/xdp_dnsrrl.bpf.o usr/lib/bpf/xdp_udp.bpf.o usr/lib/bpf/xdp_dns.bpf.o @@ -10,17 +9,11 @@ usr/lib/bpf/xdp_udpddos.bpf.o usr/lib/bpf/xdp_tailcall.bpf.o usr/sbin/xdp-udp usr/sbin/xdp_dns -usr/sbin/xdp_tailcall_dns -#etc/rc.d/rc3.d/S102xdpdns usr/sbin/xdp_dns_log -usr/sbin/xdp_tailcall_dns_log usr/sbin/xdp_sni -usr/sbin/xdp_tailcall_sni usr/sbin/xdp_sni_log -usr/sbin/xdp_tailcall_sni_log -#etc/rc.d/rc3.d/S103xdpsni +usr/sbin/xdp_dns_log usr/sbin/xdp_geoip -#etc/rc.d/rc3.d/S104xdpgeoip usr/lib/bpf/xdpdump_bpf.o usr/lib/bpf/xdpdump_xdp.o usr/lib/bpf/xdpfilt_alw_all.o diff --git a/lfs/configroot b/lfs/configroot index 9f6c1ff8c..efd5b7b97 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -56,7 +56,7 @@ $(TARGET) : ovpn patches pakfire portfw ppp private proxy/advanced/cre \ proxy/calamaris/bin qos/bin red remote sensors suricata time \ updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin vpn \ - wakeonlan wireless ; do \ + wakeonlan wireless xdptailcall; do \ mkdir -p $(CONFIG_ROOT)/$$i; \ done @@ -70,7 +70,7 @@ $(TARGET) : ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \ ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \ qos/tosconfig suricata/settings vpn/config vpn/settings vpn/ipsec.conf \ - vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings; do \ + vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings xdptailcall/settings; do \ touch $(CONFIG_ROOT)/$$i; \ done @@ -111,6 +111,7 @@ $(TARGET) : cp $(DIR_SRC)/config/fwhosts/icmp-types $(CONFIG_ROOT)/fwhosts/icmp-types cp $(DIR_SRC)/config/fwhosts/customservices $(CONFIG_ROOT)/fwhosts/customservices cp $(DIR_SRC)/config/fwhosts/customservices $(CONFIG_ROOT)/fwhosts/customservices.default + cp $(DIR_SRC)/config/cfgroot/xdptailcall-settings $(CONFIG_ROOT)/xdptailcall/settings # Oneliner configfiles echo "ENABLED=off" > $(CONFIG_ROOT)/vpn/settings echo "01" > $(CONFIG_ROOT)/certs/serial diff --git a/lfs/initscripts b/lfs/initscripts index 8eacad12d..8f64635ad 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -181,7 +181,7 @@ $(TARGET) : ln -sf ../init.d/firstsetup /etc/rc.d/rcsysinit.d/S75firstsetup ln -sf ../init.d/localnet /etc/rc.d/rcsysinit.d/S80localnet ln -sf ../init.d/firewall /etc/rc.d/rcsysinit.d/S85firewall - #ln -sf ../init.d/xdpdns /etc/rc.d/rc3.d/S102xdpdns + ln -sf ../init.d/xdptailcall /etc/rc.d/rc3.d/S102xdptailcall #ln -sf ../init.d/xdpsni /etc/rc.d/rc3.d/S103xdpsni #ln -sf ../init.d/xdpgeoip /etc/rc.d/rc3.d/S104xdpgeoip #ln -sf ../init.d/ddos /etc/rc.d/rc3.d/S105ddos diff --git a/src/initscripts/system/xdptailcall b/src/initscripts/system/xdptailcall new file mode 100755 index 000000000..bfb63c6c8 --- /dev/null +++ b/src/initscripts/system/xdptailcall @@ -0,0 +1,105 @@ +#!/bin/sh +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team # +# Copyright (C) 2024-2025 BPFire # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +. /etc/sysconfig/rc +. $rc_functions + +eval $(/usr/local/bin/readhash /var/ipfire/xdptailcall/settings) + +sni_domainfile="/var/ipfire/xdptailcall/sni_domainfile" +dns_domainfile="/var/ipfire/xdptailcall/dns_domainfile" + +load_xdptailcall () { + /usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall' + if [ $? -ne 0 ]; then + xdp-loader load green0 -P 80 -p /sys/fs/bpf/xdp-tailcall -n xdp_tailcall /usr/lib/bpf/xdp_tailcall.bpf.o + if [ $? -ge 1 ]; then + boot_mesg "Native mode not supported, try SKB" + xdp-loader load green0 -m skb -P 80 -p /sys/fs/bpf/xdp-tailcall -n xdp_tailcall /usr/lib/bpf/xdp_tailcall.bpf.o + fi + # allow WUI nobody with permission to update map + chown -R nobody /sys/fs/bpf/xdp-tailcall + # add domain to domain_denylist map + while IFS= read -r line; do + xdp_sni /sys/fs/bpf/xdp-tailcall/sni_denylist add $line + done < $sni_domainfile + while IFS= read -r line; do + xdp_dns /sys/fs/bpf/xdp-tailcall/domain_denylist add $line + done < $dns_domainfile + + fi +} + +unload_xdptailcall () { + /usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall' + if [ $? -eq 0 ]; then + prog_id=$(xdp-loader status green0 | grep 'xdp_tailcall' | awk '{print $4}') + /usr/sbin/xdp-loader unload -i $prog_id green0 + else + boot_mesg "Error xdp_tailcall not loaded!" + fi +} + +is_xdptailcall_attached () { + /usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall' >> /dev/null + if [ $? -eq 0 ]; then + echo "xdp_tailcall is attached to green0" + else + echo "xdp_tailcall is not attached to green0" + fi +} + + +case "$1" in + start) + boot_mesg -n "Starting xdp-tailcall..." + if [ "$ENABLE_XDPTAILCALL" == "on" ]; then + load_xdptailcall + loadproc -b xdp_sni_log /sys/fs/bpf/xdp-tailcall/sni_ringbuf + loadproc -b xdp_dns_log /sys/fs/bpf/xdp-tailcall/dns_ringbuf + fi + ;; + + stop) + boot_mesg "Stopping xdp-tailcall..." + if [ "$ENABLE_XDPTAILCALL" == "off" ]; then + unload_xdptailcall + killproc xdp_sni_log + killproc xdp_dns_log + fi + ;; + + status) + is_xdptailcall_attached + ;; + + restart) + $0 stop + sleep 1 + $0 start + ;; + + *) + echo "Usage: $0 {start|stop|restart}" + exit 1 + ;; +esac