webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-27 11:13:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

xdp-tailcall: add xdp-tailcall init script

Browse Source 
xdp-tailcall init script to start/stop XDP
tail call program DNS and TLS SNI on green0
interface

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
2025-01-10 20:27:46 -08:00
parent 959f35e44b
commit 8c30bad8f8
7 changed files with 114 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
src/initscripts/system/xdptailcall Executable file
View File

@@ -0,0 +1,105 @@
#!/bin/sh
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
# Copyright (C) 2024-2025 BPFire <vincent.mc.li@gmail.com> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
. /etc/sysconfig/rc
. $rc_functions
eval $(/usr/local/bin/readhash /var/ipfire/xdptailcall/settings)
sni_domainfile="/var/ipfire/xdptailcall/sni_domainfile"
dns_domainfile="/var/ipfire/xdptailcall/dns_domainfile"
load_xdptailcall () {
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall'
if [ $? -ne 0 ]; then
xdp-loader load green0 -P 80 -p /sys/fs/bpf/xdp-tailcall -n xdp_tailcall /usr/lib/bpf/xdp_tailcall.bpf.o
if [ $? -ge 1 ]; then
boot_mesg "Native mode not supported, try SKB"
xdp-loader load green0 -m skb -P 80 -p /sys/fs/bpf/xdp-tailcall -n xdp_tailcall /usr/lib/bpf/xdp_tailcall.bpf.o
fi
# allow WUI nobody with permission to update map
chown -R nobody /sys/fs/bpf/xdp-tailcall
# add domain to domain_denylist map
while IFS= read -r line; do
xdp_sni /sys/fs/bpf/xdp-tailcall/sni_denylist add $line
done < $sni_domainfile
while IFS= read -r line; do
xdp_dns /sys/fs/bpf/xdp-tailcall/domain_denylist add $line
done < $dns_domainfile
fi
}
unload_xdptailcall () {
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall'
if [ $? -eq 0 ]; then
prog_id=$(xdp-loader status green0 | grep 'xdp_tailcall' | awk '{print $4}')
/usr/sbin/xdp-loader unload -i $prog_id green0
else
boot_mesg "Error xdp_tailcall not loaded!"
fi
}
is_xdptailcall_attached () {
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_tailcall' >> /dev/null
if [ $? -eq 0 ]; then
echo "xdp_tailcall is attached to green0"
else
echo "xdp_tailcall is not attached to green0"
fi
}
case "$1" in
start)
boot_mesg -n "Starting xdp-tailcall..."
if [ "$ENABLE_XDPTAILCALL" == "on" ]; then
load_xdptailcall
loadproc -b xdp_sni_log /sys/fs/bpf/xdp-tailcall/sni_ringbuf
loadproc -b xdp_dns_log /sys/fs/bpf/xdp-tailcall/dns_ringbuf
fi
;;
stop)
boot_mesg "Stopping xdp-tailcall..."
if [ "$ENABLE_XDPTAILCALL" == "off" ]; then
unload_xdptailcall
killproc xdp_sni_log
killproc xdp_dns_log
fi
;;
status)
is_xdptailcall_attached
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
;;
esac