test out the new loxilb with fix for kernel 6.12 issue
git clone --recurse-submodules https://github.com/loxilb-io/loxilb.git
mv loxilb loxilb-0.9.9
tar czvf loxilb-0.9.9.tar.gz loxilb-0.9.9
mv loxilb-0.9.9.tar.gz <BPFire source>/cache
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
loxilb 0.9.8 requires --egress flag for firewall
rule to masquerade/SNAT GREEN network source IP
for Internet access. to access host in RED network
another firewall rule is required. see [0].
[0]: https://github.com/loxilb-io/loxilb/issues/957
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
now x86 and loongarch64 share same user space
xdp_sni xdp_dns program with path argument to
bpf map, change xdpsni and xdpdns init script
with bpf path argument.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
pwru is an utility to trouble shoot network issue,
and to speed up pwru kprobe attachement, kernel needs
to have CONFIG_FPROBE.
running pwru also result in:
Opening kprobe-multi: invalid argument \
(missing kernel symbol or prog's AttachType not AttachTraceKprobeMulti?)
need following to avoid above invalid argument
echo -1 > /proc/sys/kernel/perf_event_paranoid
echo 0 > /proc/sys/kernel/kptr_restrict
see https://github.com/cilium/pwru/issues/460
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
UDP DDoS has pattern of flooding game server with
random source IP and UDP with random payload. game
server UDP traffic requires certain payload
pattern, so this XDP program can serve as example
to stop UDP DDoS attack with UDP payload that does not
match game UDP traffic payload pattern.
without UDP DDoS protection, under DDoS attack:
BPFire UI RED Traffic: in 9xx Mbit/s.
with UDP DDoS protection, under DDoS attack:
BPFire UI RED Traffic: in 1xx Mbit/s.
Tested-by: Muhammad Haikal <eykalpirates@gmail.com>
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
set tcp_syncookies to 1 alone with iptables
SYNPROXY module reduce latency, this improves
situation when XDP acceleration is not enabled
and just let iptables SYNPROXY handles SYN flood
attack, see [0]
[0]: https://bugzilla.kernel.org/show_bug.cgi?id=219500
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
XDP generated SYNACK tcp options with window
scaling and timestamp could intermittently cause
small packet transmission on DDoS protected server.
allow user to disable window scaling when such
problem occurs. see [0]
[0]: https://github.com/vincentmli/xdp-tools/issues/7
Reported-by: DNSPROXY.ORG LLC <dnsproxyorg@gmail.com>
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
move haproxy to core package
prepare /var/ipfire/haproxy for haproxy UI, use
/var/ipfire/haproxy/haproxy.cfg
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
When XDP DDoS syncookie program is attached
to red0 interface, green network client internet
connection to website like gmail/youtube... failed.
it is because these sites does not have IP DF flag
set for each tcp packet, and syncookie_xdp program
would drop these packets when they arrived at red0
interface.
see https://github.com/vincentmli/BPFire/issues/59
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
suricata XDP support requires xdp-tools with
libbpf 1.4 to resolve stack smash issue.
also workaround memlock operation not permitted
by running suricata as root since load/attach
XDP program requires root privilige anyway.
see: https://github.com/vincentmli/BPFire/issues/54
Usage scenario:
since suricata IPS XDP capture mode works as
layer 2 bridge, BPFire netfilter firewall, NAT
IP route will be bypassed. no IP address should
be assigned to red0 and green0 interface.
172.16.1.0/24 inline 172.16.1.0/24
red network<-->red0(xdp)<-->green0(xdp)<-->green network
we can run setup command to assign IP/Mask 0.0.0.0/0.0.0.0
to red0 and green0, then reboot BPFire, BPFire DHCP
will stops working after reboot. green network client
can get DHCP IP from upstream dhcp server.
start suricata manually
suricata -c /etc/suricata/suricata-xdp.yaml --af-packet
xdp_filter.bpf program will be attached to red0 and gree0
interface
not sure if we should add GUI for suricata XDP capture mode
since this is not common use case.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
switch xdp_sni.bpf.o LPM trie map to hash map
to reduce code complexity and avoid verifier error
now need to add domain and its sub domain to hash
map to block each domain and its sub domain site.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
add XDP TLS SNI logging with bpf ringbuf
drop xdp_sni.bpf.o reverse_string due to
bpf verifier complaining program is too large.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
add the missing config/cfgroot/xdpdns-settings file
and use ENABLE_DNSBLOCK=on by default, so XDP DNS
Blocklist is enabled by default.
also add domainfile so when BPFire reboot first time
and when xdpdns init startup, it will not complain
missing domainfile
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
domain name in xdp_dns.bpf.o not reversed properly
result in domain name mismatch with domain inserted
from user space xdp_dns
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
run xdp_dns in xdpdns init script to populate
domain_denylist from domainfile saved from UI.
either xdpdns restart or bpfire reboot, the domain_denylist
is restored with domain blocklist
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
