#!/bin/sh ############################################################################### # # # IPFire.org - A linux based firewall # # Copyright (C) 2007-2022 IPFire Team # # Copyright (C) 2024-2026 LoongFire # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # # the Free Software Foundation, either version 3 of the License, or # # (at your option) any later version. # # # # This program is distributed in the hope that it will be useful, # # but WITHOUT ANY WARRANTY; without even the implied warranty of # # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # # GNU General Public License for more details. # # # # You should have received a copy of the GNU General Public License # # along with this program. If not, see . # # # ############################################################################### . /etc/sysconfig/rc . $rc_functions eval $(/usr/local/bin/readhash /var/ipfire/xdpdns/settings) domainfile="/var/ipfire/xdpdns/domainfile" allowlist_file="/var/ipfire/xdpdns/allowlist_file" map_pin_path="/sys/fs/bpf/xdp-dns-denylist" load_dnsblock () { /usr/sbin/xdp-loader status green0 | grep -w 'xdp_dns_denylist' if [ $? -ne 0 ]; then xdp-loader load green0 -P 60 -p ${map_pin_path} -n xdp_dns_denylist /usr/lib/bpf/xdp_dns.bpf.o if [ $? -ge 1 ]; then boot_mesg "Native mode not supported, try SKB" xdp-loader load green0 -m skb -P 60 -p ${map_pin_path} -n xdp_dns_denylist /usr/lib/bpf/xdp_dns.bpf.o fi # Allow WUI nobody with permission to update maps chown -R nobody ${map_pin_path} # Load denylist domains boot_mesg "Loading denylist domains..." if [ -f "$domainfile" ]; then while IFS= read -r line; do [ -z "$line" ] && continue echo "$line" | grep -q "^#" && continue xdp_dns -m ${map_pin_path}/domain_denylist add "$line" if [ $? -eq 0 ]; then boot_mesg "Added $line to denylist" else boot_mesg "Failed to add $line to denylist" fi done < "$domainfile" else boot_mesg "No denylist file found at $domainfile" fi # Load allowlist domains boot_mesg "Loading allowlist domains..." if [ -f "$allowlist_file" ]; then while IFS= read -r line; do [ -z "$line" ] && continue echo "$line" | grep -q "^#" && continue xdp_dns -m ${map_pin_path}/domain_allowlist add "$line" if [ $? -eq 0 ]; then boot_mesg "Added $line to allowlist" else boot_mesg "Failed to add $line to allowlist" fi done < "$allowlist_file" else boot_mesg "No allowlist file found at $allowlist_file" fi fi } unload_dnsblock () { # Check if the program is loaded /usr/sbin/xdp-loader status green0 | grep -w 'xdp_dns_denylist' if [ $? -eq 0 ]; then # Get the program ID prog_id=$(xdp-loader status green0 | grep 'xdp_dns_denylist' | awk '{print $4}') # Unload only this specific program by its ID /usr/sbin/xdp-loader unload -i $prog_id green0 if [ $? -eq 0 ]; then boot_mesg "xdp_dns_denylist unloaded successfully" ${SUCCESS} else boot_mesg "Error unloading xdp_dns_denylist" ${FAILURE} fi # Clean up pinned maps if they exist if [ -d "${map_pin_path}" ]; then boot_mesg "Removing pinned maps..." rm -rf ${map_pin_path} fi # Kill the log process if running if pgrep -f "xdp_dns_log" > /dev/null; then killproc xdp_dns_log fi else boot_mesg "xdp_dns_denylist not loaded, nothing to unload" fi } reload_dnsblock () { boot_mesg "Reloading xdp-dns-denylist configuration..." # Check if program is loaded /usr/sbin/xdp-loader status green0 | grep -w 'xdp_dns_denylist' > /dev/null if [ $? -eq 0 ]; then # Reload denylist if [ -f "$domainfile" ]; then boot_mesg "Reloading denylist..." # Clear existing denylist entries current_domains=$(xdp_dns -m ${map_pin_path}/domain_denylist list 2>/dev/null | grep -v "Domains in map" | grep -v "(empty)" | sed 's/^ //') if [ -n "$current_domains" ]; then echo "$current_domains" | while IFS= read -r domain; do [ -z "$domain" ] && continue xdp_dns -m ${map_pin_path}/domain_denylist delete "$domain" 2>/dev/null done fi # Add domains from file while IFS= read -r line; do [ -z "$line" ] && continue echo "$line" | grep -q "^#" && continue xdp_dns -m ${map_pin_path}/domain_denylist add "$line" done < "$domainfile" fi # Reload allowlist if [ -f "$allowlist_file" ]; then boot_mesg "Reloading allowlist..." # Clear existing allowlist entries current_domains=$(xdp_dns -m ${map_pin_path}/domain_allowlist list 2>/dev/null | grep -v "Domains in map" | grep -v "(empty)" | sed 's/^ //') if [ -n "$current_domains" ]; then echo "$current_domains" | while IFS= read -r domain; do [ -z "$domain" ] && continue xdp_dns -m ${map_pin_path}/domain_allowlist delete "$domain" 2>/dev/null done fi # Add domains from file while IFS= read -r line; do [ -z "$line" ] && continue echo "$line" | grep -q "^#" && continue xdp_dns -m ${map_pin_path}/domain_allowlist add "$line" done < "$allowlist_file" fi boot_mesg "Reload completed" else boot_mesg "xdp_dns_denylist not loaded! Starting..." load_dnsblock fi } is_xdpdns_attached () { /usr/sbin/xdp-loader status green0 | grep -w 'xdp_dns_denylist' >> /dev/null if [ $? -eq 0 ]; then echo "xdp_dns_denylist is attached to green0" echo "" echo "Domain lists:" echo " Denylist:" xdp_dns -m ${map_pin_path}/domain_denylist list 2>/dev/null || echo " (unable to read denylist)" echo "" echo " Allowlist:" xdp_dns -m ${map_pin_path}/domain_allowlist list 2>/dev/null || echo " (unable to read allowlist)" else echo "xdp_dns_denylist is not attached to green0" fi } case "$1" in start) boot_mesg -n "Starting xdp-dns-denylist..." if [ "$ENABLE_DNSBLOCK" == "on" ]; then load_dnsblock if ! pgrep -f "xdp_dns_log" > /dev/null; then loadproc -b xdp_dns_log ${map_pin_path}/dns_ringbuf fi boot_mesg "xdp-dns-denylist started successfully" ${SUCCESS} else boot_mesg "xdp-dns-denylist is disabled in settings" ${FAILURE} unload_dnsblock fi ;; stop) boot_mesg "Stopping xdp-dns-denylist..." unload_dnsblock ;; reload) boot_mesg "Reloading xdp-dns-denylist configuration..." reload_dnsblock ;; status) is_xdpdns_attached ;; restart) $0 stop sleep 1 $0 start ;; *) echo "Usage: $0 {start|stop|restart|reload|status}" exit 1 ;; esac exit 0