webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

xdp-dns: add start/stop init script and settings

Browse Source 
add xdpdns init script to load/unload xdp_dns_denylist
program and run xdp_dns_log to log dns query to system log

rm log/configroot log/initscripts to build image

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
2024-10-02 18:19:08 +00:00
parent 652ab98e1a
commit d30a7b2318
4 changed files with 86 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/rootfiles/common/configroot
View File

@@ -202,3 +202,4 @@ var/ipfire/wireless
#var/ipfire/wireless/settings
var/ipfire/ddos
var/ipfire/loxilb
var/ipfire/xdpdns

1
config/rootfiles/common/x86_64/initscripts
View File

@@ -93,6 +93,7 @@ etc/rc.d/init.d/waitdrives
etc/rc.d/init.d/wlanclient
etc/rc.d/init.d/ddos
etc/rc.d/init.d/loxilb
etc/rc.d/init.d/xdpdns
#etc/rc.d/rc0.d
#etc/rc.d/rc0.d/K01imspetor
#etc/rc.d/rc0.d/K01motion

5
lfs/configroot
View File

@@ -54,7 +54,7 @@ $(TARGET) :
ethernet extrahd/bin fwlogs fwhosts firewall ipblocklist key langs logging mac main \
menu.d modem optionsfw \
ovpn patches pakfire portfw ppp private proxy/advanced/cre \
proxy/calamaris/bin qos/bin red remote ddos loxilb keepalived sensors suricata time \
proxy/calamaris/bin qos/bin red remote ddos loxilb keepalived xdpdns sensors suricata time \
updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin vpn \
wakeonlan wireless ; do \
mkdir -p $(CONFIG_ROOT)/$$i; \
@@ -68,7 +68,7 @@ $(TARGET) :
fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customlocationgrp fwlogs/ipsettings fwlogs/portsettings ipblocklist/modified \
ipblocklist/settings mac/settings main/hosts main/routing main/security main/settings optionsfw/settings \
ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \
ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings ddos/settings ddos/tcp_ports ddos/udp-ddos-settings ddos/udp_ports ddos/dns-ddos-settings loxilb/settings keepalived/keepalived.conf keepalived/runsettings keepalived/settings keepalived/configvs keepalived/configrs qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings ddos/settings ddos/tcp_ports ddos/udp-ddos-settings ddos/udp_ports ddos/dns-ddos-settings loxilb/settings xdpdns/settings keepalived/keepalived.conf keepalived/runsettings keepalived/settings keepalived/configvs keepalived/configrs qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
qos/tosconfig suricata/settings vpn/config vpn/settings vpn/ipsec.conf \
vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings; do \
touch $(CONFIG_ROOT)/$$i; \
@@ -105,6 +105,7 @@ $(TARGET) :
cp $(DIR_SRC)/config/cfgroot/dns-ddos-settings $(CONFIG_ROOT)/ddos/dns-ddos-settings
cp $(DIR_SRC)/config/cfgroot/loxilb-settings $(CONFIG_ROOT)/loxilb/settings
cp $(DIR_SRC)/config/cfgroot/loxilb-FWconfig.txt $(CONFIG_ROOT)/loxilb/FWconfig.txt
cp $(DIR_SRC)/config/cfgroot/xdpdns-settings $(CONFIG_ROOT)/xdpdns/settings
cp $(DIR_SRC)/config/cfgroot/time-settings $(CONFIG_ROOT)/time/settings
cp $(DIR_SRC)/config/cfgroot/logging-settings $(CONFIG_ROOT)/logging/settings
cp $(DIR_SRC)/config/cfgroot/ethernet-vlans $(CONFIG_ROOT)/ethernet/vlans

81
src/initscripts/system/xdpdns Executable file
View File

@@ -0,0 +1,81 @@
#!/bin/sh
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
# Copyright (C) 2024 BPFire <vincent.mc.li@gmail.com> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
. /etc/sysconfig/rc
. $rc_functions
eval $(/usr/local/bin/readhash /var/ipfire/xdpdns/settings)
load_dnsblock () {
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_dns_denylist'
if [ $? -ne 0 ]; then
xdp-loader load green0 -P 70 -p /sys/fs/bpf/xdp-dns-denylist -n xdp_dns_denylist /usr/lib/bpf/xdp_dns.bpf.o
if [ $? -ge 1 ]; then
boot_mesg "Native mode not supported, try SKB"
xdp-loader load green0 -m skb -P 70 -p /sys/fs/bpf/xdp-dns-denylist -n xdp_dns_denylist /usr/lib/bpf/xdp_dns.bpf.o
fi
fi
}
unload_dnsblock () {
/usr/sbin/xdp-loader status green0 | grep -w 'xdp_dns_denylist'
if [ $? -eq 0 ]; then
prog_id=$(xdp-loader status green0 | grep 'xdp_dns_denylist' | awk '{print $4}')
/usr/sbin/xdp-loader unload -i $prog_id green0
else
boot_mesg "Error xdp_dns_denylist not loaded!"
fi
}
case "$1" in
start)
boot_mesg -n "Starting xdp-dns-denylist..."
if [ "$ENABLE_DNSBLOCK" == "on" ]; then
load_dnsblock
loadproc -b xdp_dns_log
fi
;;
stop)
boot_mesg "Stopping xdp-dns-denylist..."
if [ "$ENABLE_DNSBLOCK" == "off" ]; then
unload_dnsblock
killproc xdp_dns_log
fi
;;
status)
statusproc /usr/sbin/xdp_dns_log
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
;;
esac