add XDP TLS SNI logging with bpf ringbuf
drop xdp_sni.bpf.o reverse_string due to
bpf verifier complaining program is too large.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
add the missing config/cfgroot/xdpdns-settings file
and use ENABLE_DNSBLOCK=on by default, so XDP DNS
Blocklist is enabled by default.
also add domainfile so when BPFire reboot first time
and when xdpdns init startup, it will not complain
missing domainfile
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
if XDP DNS is enabled, and BPFire reboot, XDP
DNS program should be attached and DNS query being
monitored after reboot.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
add xdpdns init script to load/unload xdp_dns_denylist
program and run xdp_dns_log to log dns query to system log
rm log/configroot log/initscripts to build image
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This reverts commit bb773a05d5.
drivers/video/logo/logo_linux_clut224.ppm: Binary PNM is not supported
Use pnmnoraw(1) to convert it to ASCII PNM
make[6]: *** [drivers/video/logo/Makefile:31: drivers/video/logo/logo_linux_clut224.c] Error 1
make[5]: *** [scripts/Makefile.build:485: drivers/video/logo] Error 2
make[4]: *** [scripts/Makefile.build:485: drivers/video] Error 2
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
whenever compile kernel due to kernel change
lunatik needs to be recompiled too since
lunatik depends on kernel
change filter example Makefile to depend on
current kernel build version
diff --git a/examples/filter/Makefile b/examples/filter/Makefile
index f7eb0f6d..e30566a2 100644
--- a/examples/filter/Makefile
+++ b/examples/filter/Makefile
@@ -1,10 +1,12 @@
# SPDX-FileCopyrightText: (c) 2023-2024 Ring Zero Desenvolvimento de Software LTDA
# SPDX-License-Identifier: MIT OR GPL-2.0-only
+VMLINUX_BTF_PATH = /lib/modules/${shell uname -r}/build
+
all: vmlinux https.o
vmlinux:
- bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h
+ bpftool btf dump file $(VMLINUX_BTF_PATH)/vmlinux format c > vmlinux.h
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
upgrade kernel to recent stable release 6.10.11
1, scripts/kconfig/merge_config.sh does not work for 6.10.11
2, vmlinux BTF binary name changed in 6.10.11
3, remove rtl8812au for now since it has compiling error
4, remove 5.15 nfqueue patch since it does not apply cleanly
also see [0]
[0]: https://github.com/vincentmli/BPFire/issues/41
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
BTF mismatch is not an issue since
we addressed lunatik kernel module
BTF mismatch issue using the same
chroot binary vmlinux BTF.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
xdp-loader to load https.o result in error below:
libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
libbpf: extern (func ksym) 'bpf_luaxdp_run': not found in kernel or module BTFs
libbpf: failed to load object '/usr/lib/bpf/https.o'
libxdp: Failed to load program filter_https: Invalid argument
Couldn't attach XDP program on iface 'green0': Invalid argument(-22)
xdp-tools/xdp-loader is built statically with libbpf 1.2
should not be xdp-loader libbpf issue
still try to upgrade bpfire libbpf to 1.3.0 for testing
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
kernel requires module to be signed, disable force
signing for now.
insmod: ERROR: could not insert module /lib/modules/6.6.15-ipfire/lunatik/lunatik.ko: Key was rejected by service
set CONFIG_MODULE_SIG_FORCE=n
failed to validate module [lunatik] BTF: -22
set CONFIG_MODULE_ALLOW_BTF_MISMATCH=y
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
allow syscall tracing with eBPF like
bcc libbpf-tools opensnoop to trouble
shoot open syscall for UI user nobody
unable to run loxicmd save -a -c /var/ipfire/loxilib/
see https://github.com/vincentmli/BPFire/issues/30
mount -t debugfs none /sys/kernel/debug/
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
when mouse select, vim automatically turns into
visual mode, this is not convienent when copy
and paste in vim with mouse select. create this
setting for root user.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
when loxilb is enabled and started, enable the
firewall SNAT for green network so green network
could have initiate outgoing traffic like internet
access.
we can achieve this by restoring firewall SNAT setting
from default /var/ipfire/loxilb/FWconfig.txt when loxilb
start up with --config-path=/var/ipfire/loxilb thanks
to the enhancement addressed in issue:
https://github.com/loxilb-io/loxilb/issues/706
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
When loxilb and keepalived are enabled, after BPFire
rebooted, loxilb and keepalived failed to start and
shows as "STOPPED" from UI, this is not expected since
we want to loxilb and keepalived to continue to be enabled
after reboot based on the enabled state of loxilb and
keepalived before reboot.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
BPFire red0 does not support multicast, need to
have unicast peer configured, then the virtual
ipaddress can be added to red0 interface.
the UI requires /var/ipfire/keepalived/runsettings
/var/ipfire/keepalived/settings to be created, so
add them lfs/configroot
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
change keepalived default config to
/var/ipfire/keepalived/keepalived.conf so keepalived WebUI
could read/write the configuration file. also add
/var/ipfire/keepalived directory
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
keepalived: create /var/ipfire/keepalived
since we added loxilb ip management to add ip on
red0 interface, we can select the virtual ip from
red0 interface.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
Re-arrange the menu to have BPF centric
main menu, this also easy the developing
of loxilb load balancer GUI since loxilb
will have multiple functions like enable
loxilb, create loxilb lb, create loxilb ip
...etc, so each loxilb function has their
own CGI UI.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
run command below when update language menu
perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
Avoid downloading golang dependency packages
during build time due to issue [0], run
go mod vendor so loxicmd source include vendor
directory to include golang dependency packages
[0]: https://github.com/vincentmli/BPFire/issues/18
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
