From 9c28bd419d9570d0c62f3b3c86ba6c030ab8ab08 Mon Sep 17 00:00:00 2001 From: Vincent Li Date: Sun, 13 Oct 2024 20:35:44 +0000 Subject: [PATCH] xdp-geoip: Add XDP GeoIP location init Add XDP GeoIP country/region location block init script Signed-off-by: Vincent Li --- config/rootfiles/common/x86_64/initscripts | 1 + config/rootfiles/common/xdp-tools | 1 + lfs/initscripts | 1 + src/initscripts/system/xdpgeoip | 109 +++++++++++++++++++++ 4 files changed, 112 insertions(+) create mode 100755 src/initscripts/system/xdpgeoip diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index abce8e97f..048d59f2e 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -95,6 +95,7 @@ etc/rc.d/init.d/ddos etc/rc.d/init.d/loxilb etc/rc.d/init.d/xdpdns etc/rc.d/init.d/xdpsni +etc/rc.d/init.d/xdpgeoip #etc/rc.d/rc0.d #etc/rc.d/rc0.d/K01imspetor #etc/rc.d/rc0.d/K01motion diff --git a/config/rootfiles/common/xdp-tools b/config/rootfiles/common/xdp-tools index abc665495..052a3ed3b 100644 --- a/config/rootfiles/common/xdp-tools +++ b/config/rootfiles/common/xdp-tools @@ -13,6 +13,7 @@ usr/sbin/xdp_sni usr/sbin/xdp_sni_log etc/rc.d/rc3.d/S103xdpsni usr/sbin/xdp_geoip +etc/rc.d/rc3.d/S104xdpgeoip usr/lib/bpf/xdpdump_bpf.o usr/lib/bpf/xdpdump_xdp.o usr/lib/bpf/xdpfilt_alw_all.o diff --git a/lfs/initscripts b/lfs/initscripts index 4c96d37a5..b7614ee74 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -139,6 +139,7 @@ $(TARGET) : ln -sf ../init.d/keepalived /etc/rc.d/rc3.d/S101keepalived ln -sf ../init.d/xdpdns /etc/rc.d/rc3.d/S102xdpdns ln -sf ../init.d/xdpsni /etc/rc.d/rc3.d/S103xdpsni + ln -sf ../init.d/xdpgeoip /etc/rc.d/rc3.d/S104xdpgeoip ln -sf ../init.d/imspetor /etc/rc.d/rc6.d/K01imspetor ln -sf ../init.d/motion /etc/rc.d/rc6.d/K01motion diff --git a/src/initscripts/system/xdpgeoip b/src/initscripts/system/xdpgeoip new file mode 100755 index 000000000..15c2a2917 --- /dev/null +++ b/src/initscripts/system/xdpgeoip @@ -0,0 +1,109 @@ +#!/bin/sh +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team # +# Copyright (C) 2024 BPFire # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +. /etc/sysconfig/rc +. $rc_functions + +eval $(/usr/local/bin/readhash /var/ipfire/firewall/locationblock) + +locationsetting="/var/ipfire/firewall/locationblock" + +load_geoipblock () { + /usr/sbin/xdp-loader status red0 | grep -w 'xdp_geoip' + if [ $? -ne 0 ]; then + xdp-loader load red0 -P 80 -p /sys/fs/bpf/xdp-geoip -n xdp_geoip /usr/lib/bpf/xdp_geoip.bpf.o + if [ $? -ge 1 ]; then + boot_mesg "Native mode not supported, try SKB" + xdp-loader load red0 -m skb -P 80 -p /sys/fs/bpf/xdp-geoip -n xdp_geoip /usr/lib/bpf/xdp_geoip.bpf.o + fi + + # allow WUI nobody with permission to update map + chown -R nobody /sys/fs/bpf/xdp-geoip + + # Loop through the /var/ipfire/firewall/locationblock file directly + while IFS='=' read -r country status; do + + if [ "$country" = "LOCATIONBLOCK_ENABLED" ]; then + continue + fi + + if [ "$status" = "on" ]; then + # Construct the file path for the IP set + file="/var/lib/location/ipset/${country}v4.ipset" + # Add the country code to geoip_map using the constructed file path + boot_mesg "add $country location block" + xdp_geoip add $file $country >> /dev/null + fi + done < $locationsetting + fi +} + +unload_geoipblock () { + /usr/sbin/xdp-loader status red0 | grep -w 'xdp_geoip' + if [ $? -eq 0 ]; then + prog_id=$(xdp-loader status red0 | grep 'xdp_geoip' | awk '{print $4}') + /usr/sbin/xdp-loader unload -i $prog_id red0 + else + boot_mesg "Error xdp_geoip not loaded!" + fi +} + +is_xdpgeoip_attached () { + /usr/sbin/xdp-loader status red0 | grep -w 'xdp_geoip' >> /dev/null + if [ $? -eq 0 ]; then + echo "xdp_geoip is attached to red0" + else + echo "xdp_geoip is not attached to red0" + fi +} + + +case "$1" in + start) + boot_mesg -n "Starting xdp-geoip..." + if [ "$LOCATIONBLOCK_ENABLED" == "on" ]; then + load_geoipblock + fi + ;; + + stop) + boot_mesg "Stopping xdp-geoip..." + if [ "$LOCATIONBLOCK_ENABLED" == "off" ]; then + unload_geoipblock + fi + ;; + + status) + is_xdpgeoip_attached + ;; + + restart) + $0 stop + sleep 1 + $0 start + ;; + + *) + echo "Usage: $0 {start|stop|restart}" + exit 1 + ;; +esac