From e053dc9dc470c819fce7120e0cf68f949a7b4104 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Tue, 23 Jan 2024 12:53:36 +0100 Subject: [PATCH] dnsdist: Implement proper parameters handling in the XDP helper --- contrib/xdp.py | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/contrib/xdp.py b/contrib/xdp.py index d6ef369708..089e68d9b1 100644 --- a/contrib/xdp.py +++ b/contrib/xdp.py @@ -1,10 +1,11 @@ #!/usr/bin/env python3 - -from bcc import BPF +import argparse import ctypes as ct import netaddr import socket +from bcc import BPF + # Constants QTYPES = {'LOC': 29, '*': 255, 'IXFR': 251, 'UINFO': 100, 'NSEC3': 50, 'AAAA': 28, 'CNAME': 5, 'MINFO': 14, 'EID': 31, 'GPOS': 27, 'X25': 19, 'HINFO': 13, 'CAA': 257, 'NULL': 10, 'DNSKEY': 48, 'DS': 43, 'ISDN': 20, 'SOA': 6, 'RP': 17, 'UID': 101, 'TALINK': 58, 'TKEY': 249, 'PX': 26, 'NSAP-PTR': 23, 'TXT': 16, 'IPSECKEY': 45, 'DNAME': 39, 'MAILA': 254, 'AFSDB': 18, 'SSHFP': 44, 'NS': 2, 'PTR': 12, 'SPF': 99, 'TA': 32768, 'A': 1, 'NXT': 30, 'AXFR': 252, 'RKEY': 57, 'KEY': 25, 'NIMLOC': 32, 'A6': 38, 'TLSA': 52, 'MG': 8, 'HIP': 55, 'NSEC': 47, 'GID': 102, 'SRV': 33, 'DLV': 32769, 'NSEC3PARAM': 51, 'UNSPEC': 103, 'TSIG': 250, 'ATMA': 34, 'RRSIG': 46, 'OPT': 41, 'MD': 3, 'NAPTR': 35, 'MF': 4, 'MB': 7, 'DHCID': 49, 'MX': 15, 'MAILB': 253, 'CERT': 37, 'NINFO': 56, 'APL': 42, 'MR': 9, 'SIG': 24, 'WKS': 11, 'KX': 36, 'NSAP': 22, 'RT': 21, 'SINK': 40} INV_QTYPES = {v: k for k, v in QTYPES.items()} @@ -13,9 +14,6 @@ ACTIONS = {1 : 'DROP', 2 : 'TC'} DROP_ACTION = 1 TC_ACTION = 2 -# The interface on wich the filter will be attached -DEV = "eth1" - # The list of blocked IPv4, IPv6 and QNames # IP format : (IPAddress, Action) # CIDR format : (IPAddress/cidr, Action) @@ -27,19 +25,26 @@ blocked_cidr6 = [("2001:db8::1/128", TC_ACTION)] blocked_qnames = [("localhost", "A", DROP_ACTION), ("test.com", "*", TC_ACTION)] # Main -useXsk = True +parser = argparse.ArgumentParser(description='XDP helper for DNSDist') +parser.add_argument('--xsk', action='store_true', help='Enable XSK (AF_XDP) mode', default=False) +parser.add_argument('--interface', '-i', type=str, default='eth0', help='The interface on which the filter will be attached') + +parameters = parser.parse_args() cflag = [] -if useXsk: +if parameters.xsk: + print(f'Enabling XSK (AF_XDP) on {parameters.interface}..') cflag.append("-DUseXsk") else: Ports = [53] + portsStr = ', '.join(str(port) for port in Ports) + print(f'Enabling XDP on {parameters.interface} and ports {portsStr}..') IN_DNS_PORT_SET = "||".join("COMPARE_PORT((x),"+str(i)+")" for i in Ports) cflag.append(r"-DIN_DNS_PORT_SET(x)=(" + IN_DNS_PORT_SET + r")") xdp = BPF(src_file="xdp-filter.ebpf.src", cflags=cflag) fn = xdp.load_func("xdp_dns_filter", BPF.XDP) -xdp.attach_xdp(DEV, fn, 0) +xdp.attach_xdp(parameters.interface, fn, 0) v4filter = xdp.get_table("v4filter") v6filter = xdp.get_table("v6filter") @@ -47,7 +52,7 @@ cidr4filter = xdp.get_table("cidr4filter") cidr6filter = xdp.get_table("cidr6filter") qnamefilter = xdp.get_table("qnamefilter") -if useXsk: +if parameters.xsk: xskDestinations = xdp.get_table("xskDestinationsV4") for ip in blocked_ipv4: @@ -108,7 +113,8 @@ for qname in blocked_qnames: leaf.action = qname[2] qnamefilter[key] = leaf -print("Filter is ready") +print(f"Filter is ready on {parameters.interface}") + try: xdp.trace_print() except KeyboardInterrupt: @@ -126,4 +132,4 @@ for item in cidr6filter.items(): for item in qnamefilter.items(): print(f"{''.join(map(chr, item[0].qname)).strip()}/{INV_QTYPES[item[0].qtype]} ({ACTIONS[item[1].action]}): {item[1].counter}") -xdp.remove_xdp(DEV, 0) +xdp.remove_xdp(parameters.interface, 0) -- 2.47.2