Skip to content

Commit ae38d73

Browse files
TbaileTbaile
committed
refactor: enabling nfqueue for netifyd
1 parent 645bebe commit ae38d73

File tree

7 files changed

+67
-82
lines changed

7 files changed

+67
-82
lines changed

‎packages/netifyd/Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ define Package/netifyd/install
157157
$(INSTALL_DIR) $(1)/etc/init.d
158158
$(INSTALL_DIR) $(1)/etc/netifyd
159159
$(INSTALL_DIR) $(1)/etc/netifyd/categories.d
160+
$(INSTALL_DIR) $(1)/etc/netifyd/interfaces.d
160161
$(INSTALL_DIR) $(1)/etc/netifyd/plugins.d
161162
$(INSTALL_DIR) $(1)/etc/netifyd/profiles.d
162163
$(INSTALL_DIR) $(1)/etc/uci-defaults
@@ -172,6 +173,7 @@ define Package/netifyd/install
172173
$(INSTALL_DATA) ./files/etc/config/netifyd $(1)/etc/config/netifyd
173174
$(INSTALL_BIN) ./files/etc/init.d/netifyd $(1)/etc/init.d/netifyd
174175
$(INSTALL_DATA) ./files/etc/netifyd.conf $(1)/etc/netifyd.conf
176+
$(INSTALL_DATA) ./files/etc/netifyd/interfaces.d/10-nfqueue.conf $(1)/etc/netifyd/interfaces.d/10-nfqueue.conf
175177
$(INSTALL_DATA) ./files/etc/netifyd/netify-apps.conf $(1)/etc/netifyd/netify-apps.conf
176178
$(INSTALL_DATA) ./files/etc/netifyd/netify-categories.json $(1)/etc/netifyd/netify-categories.json
177179
$(INSTALL_DATA) ./files/etc/netifyd/profiles.d/00-default.conf $(1)/etc/netifyd/profiles.d/00-default.conf
@@ -186,6 +188,7 @@ define Package/netifyd/install
186188
$(INSTALL_DATA) ./files/usr/share/netifyd/plugins.d/99-netify-proc-core-auto.conf $(1)/usr/share/netifyd/plugins.d/99-netify-proc-core-auto.conf
187189
$(INSTALL_DATA) ./files/usr/share/netifyd/plugins.d/99-netify-sink-http-auto.conf $(1)/usr/share/netifyd/plugins.d/99-netify-sink-http-auto.conf
188190
$(INSTALL_DATA) ./files/usr/share/nftables.d/table-pre/10-netifyd.nft $(1)/usr/share/nftables.d/table-pre/10-netifyd.nft
191+
$(INSTALL_DATA) ./files/usr/share/nftables.d/table-pre/10-netifyd-nfqueue.nft $(1)/usr/share/nftables.d/table-pre/10-netifyd-nfqueue.nft
189192
$(LN) /usr/lib/libnetifyd.so.4.0.0 $(1)/usr/lib/libnetifyd.so
190193
$(LN) /usr/lib/libnetifyd.so.4.0.0 $(1)/usr/lib/libnetifyd.so.4
191194
# netify-plm

‎packages/netifyd/files/etc/netifyd/interfaces.d/10-nfqueue.conf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Netify Agent Example Capture Interface Configuration
2+
# Copyright (C) 2024-2025 eGloo Incorporated
3+
#
4+
##############################################################################
5+
6+
# Example Netfilter QUEUE capture source
7+
##############################################################################
8+
9+
[capture-interface-LAN]
10+
capture_type = nfqueue
11+
role = lan
12+
queue_id = 10
13+
queue_instances = 10
14+
conntrack_counters = true
15+
16+
[capture-interface-WAN]
17+
capture_type = nfqueue
18+
role = wan
19+
queue_id = 20
20+
queue_instances = 10
21+
conntrack_counters = true
22+
23+
# vim: set ft=dosini :

‎packages/netifyd/files/etc/uci-defaults/99-netify-enable-nfqueue.uci-default‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/sh
2+
3+
#
4+
# Copyright (C) 2025 Nethesis S.r.l.
5+
# SPDX-License-Identifier: GPL-2.0-only
6+
#
7+
8+
# Removing the interfaces from netifyd configuration, ignore exit codes
9+
if uci -q get netifyd.@netifyd[0].external_if > /dev/null; then
10+
uci -q del netifyd.@netifyd[0].external_if
11+
fi
12+
if uci -q get netifyd.@netifyd[0].internal_if > /dev/null; then
13+
uci -q del netifyd.@netifyd[0].internal_if
14+
fi

‎packages/netifyd/files/usr/share/nftables.d/table-pre/10-netifyd-nfqueue.nft‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
chain nfq_input {
2+
type filter hook input priority filter + 10; policy accept;
3+
ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept
4+
ip6 saddr ::1 ip6 daddr ::1 accept
5+
6+
ct packets > 32 counter accept
7+
# Traffic FROM LAN interfaces -> Queue 10-19
8+
iifname != $wan_devices queue flags bypass to 10-19
9+
# Traffic FROM WAN interfaces -> Queue 20-29
10+
iifname $wan_devices queue flags bypass to 20-29
11+
}
12+
13+
chain nfq_forward {
14+
type filter hook forward priority filter + 10; policy accept;
15+
16+
ct packets > 32 counter accept
17+
# Traffic entering from LAN (Upload/LAN-to-LAN) -> Queue 10-19
18+
iifname != $wan_devices queue flags bypass to 10-19
19+
# Traffic entering from WAN (Download/Port Forwarding) -> Queue 20-29
20+
iifname $wan_devices queue flags bypass to 20-29
21+
}

‎packages/ns-api/Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,6 @@ define Package/ns-api/install
177177
$(INSTALL_BIN) ./files/post-commit/restart-netdata.py $(1)/usr/libexec/ns-api/post-commit/
178178
$(INSTALL_BIN) ./files/pre-commit/fix-redirect-reflections.py $(1)/usr/libexec/ns-api/pre-commit
179179
$(INSTALL_BIN) ./files/pre-commit/update-objects.py $(1)/usr/libexec/ns-api/pre-commit
180-
$(INSTALL_BIN) ./files/post-commit/configure-netifyd.py $(1)/usr/libexec/ns-api/post-commit
181180
$(INSTALL_BIN) ./files/post-commit/reload-ipsets.py $(1)/usr/libexec/ns-api/post-commit
182181
$(INSTALL_BIN) ./files/post-commit/restart-cron.py $(1)/usr/libexec/ns-api/post-commit
183182
$(INSTALL_BIN) ./files/post-commit/restart-wireguard.py $(1)/usr/libexec/ns-api/post-commit

‎packages/ns-api/files/post-commit/configure-netifyd.py‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

‎packages/ns-dpi/files/dpi-config‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,8 @@ for section in u.get_all('dpi'):
9191
if rule['action'] not in valid_actions or not rule['enabled']:
9292
continue
9393

94+
device = rule.get('device', '*')
95+
9496
if 'criteria' in rule:
9597
# criteria has precedence over sources, protocol, category and application
9698
criteria = rule['criteria'].replace('"',"'")
@@ -114,14 +116,14 @@ for section in u.get_all('dpi'):
114116

115117
sources_s = ' or '.join(sources)
116118
applications_s = ' or '.join(applications)
119+
criteria = f'(iface_nfq_src == \'{device}\' or iface_nfq_dst == \'{device}\') && '
117120
if len(sources) < 1:
118-
criteria = f'({applications_s}) ;'
121+
criteria += f'({applications_s}) ;'
119122
elif len(applications) < 1:
120-
criteria = f'({sources_s}) ;'
123+
criteria += f'({sources_s}) ;'
121124
else:
122-
criteria = f'({sources_s}) && ({applications_s}) ;'
125+
criteria += f'({sources_s}) && ({applications_s}) ;'
123126

124-
device = rule.get('device', '*')
125127
vlan_id = None
126128
base_if = None
127129
for item in utils.get_all_by_type(u, 'network', 'device').values():
@@ -139,7 +141,6 @@ for section in u.get_all('dpi'):
139141
targets.append('log')
140142
config["actions"][f"rule{rcount}"] = {
141143
"enabled": rule['enabled'] == '1',
142-
"interface": device,
143144
"criteria": criteria,
144145
"targets": targets,
145146
"exemptions": rule.get('exemption', [])

0 commit comments

Comments
 (0)