Skip to content

Commit f961a80

Browse files
committed
refactor(netifyd, ns-dpi): blocking using conntrack labels
1 parent a035991 commit f961a80

File tree

8 files changed

+52
-57
lines changed

8 files changed

+52
-57
lines changed

packages/netifyd/Makefile

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,6 @@ define Package/netifyd/install
166166
$(INSTALL_DIR) $(1)/usr/share
167167
$(INSTALL_DIR) $(1)/usr/share/netifyd
168168
$(INSTALL_DIR) $(1)/usr/share/netifyd/plugins.d
169-
$(INSTALL_DIR) $(1)/usr/share/nftables.d/table-pre
170169

171170
# netifyd
172171
$(INSTALL_DATA) ./files/etc/config/netifyd $(1)/etc/config/netifyd
@@ -185,7 +184,6 @@ define Package/netifyd/install
185184
$(INSTALL_DATA) ./files/usr/share/netifyd/netify-sink-http-auto.json $(1)/usr/share/netifyd/netify-sink-http-auto.json
186185
$(INSTALL_DATA) ./files/usr/share/netifyd/plugins.d/99-netify-proc-core-auto.conf $(1)/usr/share/netifyd/plugins.d/99-netify-proc-core-auto.conf
187186
$(INSTALL_DATA) ./files/usr/share/netifyd/plugins.d/99-netify-sink-http-auto.conf $(1)/usr/share/netifyd/plugins.d/99-netify-sink-http-auto.conf
188-
$(INSTALL_DATA) ./files/usr/share/nftables.d/table-pre/10-netifyd.nft $(1)/usr/share/nftables.d/table-pre/10-netifyd.nft
189187
$(LN) /usr/lib/libnetifyd.so.4.0.0 $(1)/usr/lib/libnetifyd.so
190188
$(LN) /usr/lib/libnetifyd.so.4.0.0 $(1)/usr/lib/libnetifyd.so.4
191189
# netify-plm

packages/netifyd/files/usr/share/nftables.d/table-pre/10-netifyd.nft

Lines changed: 0 additions & 10 deletions
This file was deleted.

packages/ns-dpi/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ define Package/ns-dpi/install
6363
$(INSTALL_DIR) $(1)/etc/uci-defaults
6464
$(INSTALL_DIR) $(1)/usr/share/ns-plug/hooks/unregister
6565
$(INSTALL_DIR) $(1)/etc/xtables
66-
$(INSTALL_CONF) ./files/connlabel.conf $(1)/etc/xtables/connlabel.conf
66+
$(INSTALL_CONF) ./files/connlabel.conf $(1)/etc/connlabel.conf
6767
$(INSTALL_BIN) ./files/dpi.init $(1)/etc/init.d/dpi
6868
$(INSTALL_BIN) ./files/dpi-license-update.init $(1)/etc/init.d/dpi-license-update
6969
$(INSTALL_BIN) ./files/dpi $(1)/usr/sbin/

packages/ns-dpi/files/connlabel.conf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
0 dummy
2-
1 block
1+
0 netify-init
2+
1 netify-block
33
2 bulk
44
3 best_effort
55
4 video

packages/ns-dpi/files/dpi

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@
88
# Generate netify flow actions config file
99
/usr/sbin/dpi-config
1010
# Apply nftables rules
11-
/usr/sbin/dpi-nft | nft -f -
11+
/usr/sbin/dpi-nft
1212
# reload netifyd daemon
1313
/etc/init.d/netifyd reload

packages/ns-dpi/files/dpi-config

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -30,22 +30,17 @@ def get_interface_ips(interface):
3030
cfg_file = "/etc/netifyd/netify-proc-flow-actions.json"
3131
config = {
3232
"reprocess_flows": True,
33+
"target_globals": {
34+
"ctlabel": {
35+
"connlabel_conf": "/etc/connlabel.conf"
36+
},
37+
},
3338
"targets": {
3439
"block": {
35-
"target_type": "nftset",
40+
"target_type": "ctlabel",
3641
"target_enabled": True,
37-
"table_name": "fw4",
38-
"table_family": "inet",
39-
"size": 65535,
40-
"ttl": 900,
41-
"set_name": "nfa.blocks",
42-
"set_family": "ipv4",
43-
"flush_on_destroy": True,
44-
"type": [
45-
"local_addr",
46-
"ip_proto",
47-
"other_port",
48-
"other_addr"
42+
"labels": [
43+
"netify-block"
4944
]
5045
},
5146
"log": {

packages/ns-dpi/files/dpi-nft

Lines changed: 40 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,46 @@
1-
#!/bin/sh
1+
#!/usr/bin/env python
22

33
#
4-
# Copyright (C) 2025 Nethesis S.r.l.
4+
# Copyright (C) 2026 Nethesis S.r.l.
55
# SPDX-License-Identifier: GPL-2.0-only
66
#
77

8-
#
9-
# DPI: generate NFT script
10-
#
8+
import os
9+
import subprocess
10+
11+
from euci import EUci
12+
from jinja2 import Environment, BaseLoader
13+
14+
CHAIN = """
15+
chain dpi_blocks {
16+
type filter hook prerouting priority filter + 10; policy accept;
17+
18+
# init is to allow kernel to set labels
19+
ct label set netify-init
20+
ct label netify-block counter {% if log_enabled %}log prefix "DPI block: " limit rate {{ log_limit }} {% endif %}drop
21+
}
22+
23+
"""
24+
25+
26+
def generate_dpi():
27+
e_uci = EUci()
28+
template = Environment(loader=BaseLoader()).from_string(CHAIN)
29+
render = template.render(
30+
log_enabled=e_uci.get('dpi', 'config', 'log_blocked', dtype=bool, default=False),
31+
log_limit=e_uci.get('firewall', 'ns_defaults', 'rule_log_limit', dtype=str, default='1/second')
32+
)
33+
# save to nftables directory table-pre, only if the file is changed
34+
file_path = '/usr/share/nftables.d/table-pre/dpi_blocks.nft'
35+
current = None
36+
if os.path.exists(file_path):
37+
with open(file_path, 'r') as f:
38+
current = f.read()
39+
if current != render:
40+
with open(file_path, 'w') as f:
41+
f.write(render)
42+
# reload nftables
43+
subprocess.run(['fw4', 'reload'], check=True, capture_output=True)
1144

12-
log_opt=""
13-
if [ $(uci -q get dpi.config.log_blocked) = "1" ]; then
14-
log_opt='log prefix "DPI block: "'
15-
limit=$(uci -q get firewall.ns_defaults.rule_log_limit)
16-
# validate limit syntax to avoid error on nft rules
17-
if echo "$limit" | grep -qE '^[0-9]+/s$'; then
18-
limit="${limit}econd"
19-
else
20-
limit="1/second"
21-
fi
22-
fi
23-
24-
if nft list chain inet fw4 block_chain >/dev/null 2>&1; then
25-
echo flush chain inet fw4 block_chain
26-
fi
27-
28-
echo add set inet fw4 nfa.blocks.v4 '{ type ipv4_addr . inet_proto . inet_service . ipv4_addr; size 65536; timeout 15m; }'
29-
echo add chain inet fw4 block_chain '{ type filter hook forward priority -10; }'
30-
if [ -n "$log_opt" ]; then
31-
echo add rule inet fw4 block_chain ip saddr . ip protocol . th dport . ip daddr @nfa.blocks.v4 limit rate $limit burst 5 packets $log_opt
32-
fi
33-
echo add rule inet fw4 block_chain ip saddr . ip protocol . th dport . ip daddr @nfa.blocks.v4 counter drop
45+
if __name__ == "__main__":
46+
generate_dpi()

packages/ns-dpi/files/dpi.init

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ start_service() {
2525

2626
reload_service()
2727
{
28-
stop
2928
start
3029
}
3130

0 commit comments

Comments
 (0)