Skip to content

Commit 8a783f2

Browse files
alexandrglmalexandrglm
committed
nss-switch: add new nss-switch tool
A tool designed to manage Hardware Offload for qualcommax platorms to permit a real non-shadowed packet inspection. While optimised for NSS-enabled hardware, it remains compatible with any other platform using Software Offloading (SFE). Signed-off-by: Alexander Gomez <alexandrglm@proton.me>
1 parent 29a4635 commit 8a783f2

16 files changed

Lines changed: 4394 additions & 0 deletions

File tree

‎net/nss-switch/Makefile‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
#
2+
# SPDX-License-Identifier: GPL-2.0-or-later
3+
#
4+
include $(TOPDIR)/rules.mk
5+
PKG_NAME:=nss-switch
6+
PKG_VERSION:=1.0.0
7+
PKG_RELEASE:=1
8+
PKG_MAINTAINER:=Alexander Gomez <alexandrglm@proton.me>
9+
PKG_LICENSE:=GPL-2.0-or-later
10+
include $(INCLUDE_DIR)/package.mk
11+
define Package/nss-switch
12+
SECTION:=net
13+
CATEGORY:=Network
14+
TITLE:=Qualcomm NSS Bypass tool
15+
DEPENDS:=+conntrack
16+
endef
17+
define Package/nss-switch/description
18+
A tool designed to manage Hardware Offload for qualcommax NSS platforms.
19+
While optimised for NSS-enabled firmware to allow deep packet inspection,
20+
it remains compatible with any platform using Software Offloading (SFE).
21+
endef
22+
define Package/nss-switch/conffiles
23+
/etc/config/nss-switch-conf
24+
/etc/nss-switch/rules.conf
25+
endef
26+
define Build/Prepare
27+
mkdir -p $(PKG_BUILD_DIR)
28+
$(CP) ./src/* $(PKG_BUILD_DIR)/
29+
endef
30+
define Build/Compile
31+
$(MAKE) -C $(PKG_BUILD_DIR) \
32+
CC="$(TARGET_CC)" \
33+
CFLAGS="$(TARGET_CFLAGS)" \
34+
LDFLAGS="$(TARGET_LDFLAGS)"
35+
endef
36+
define Package/nss-switch/install
37+
$(INSTALL_DIR) $(1)/usr/lib/nss-switch/bin
38+
$(INSTALL_DIR) $(1)/usr/lib/nss-switch/lib
39+
$(INSTALL_DIR) $(1)/etc/config
40+
$(INSTALL_DIR) $(1)/etc/nss-switch
41+
$(INSTALL_DIR) $(1)/etc/firewall.d
42+
$(INSTALL_DIR) $(1)/usr/bin
43+
$(INSTALL_BIN) $(PKG_BUILD_DIR)/nss-ct-dump $(1)/usr/lib/nss-switch/bin/nss-ct-dump
44+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/nss-switch.sh $(1)/usr/lib/nss-switch/nss-switch.sh
45+
$(INSTALL_BIN) ./files/etc/firewall.d/nss-bypass-rules $(1)/etc/firewall.d/nss-bypass-rules
46+
$(INSTALL_DATA) ./files/etc/config/nss-switch-conf $(1)/etc/config/nss-switch-conf
47+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/chandler.sh $(1)/usr/lib/nss-switch/lib/chandler.sh
48+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/conntrack.sh $(1)/usr/lib/nss-switch/lib/conntrack.sh
49+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/debug.sh $(1)/usr/lib/nss-switch/lib/debug.sh
50+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/detect.sh $(1)/usr/lib/nss-switch/lib/detect.sh
51+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/ecm.sh $(1)/usr/lib/nss-switch/lib/ecm.sh
52+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/nft.sh $(1)/usr/lib/nss-switch/lib/nft.sh
53+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/rules.sh $(1)/usr/lib/nss-switch/lib/rules.sh
54+
$(INSTALL_BIN) ./files/usr/lib/nss-switch/lib/ui.sh $(1)/usr/lib/nss-switch/lib/ui.sh
55+
$(INSTALL_DATA) ./files/etc/nss-switch/rules.conf $(1)/etc/nss-switch/rules.conf
56+
ln -sf /usr/lib/nss-switch/nss-switch.sh $(1)/usr/bin/nss-switch
57+
endef
58+
define Package/nss-switch/preinst
59+
#!/bin/sh
60+
if [ -z "$${IPKG_INSTROOT}" ]; then
61+
echo "Checking platform compatibility..."
62+
if lsmod 2>/dev/null | grep -q "qca_nss_drv"; then
63+
echo "[OK] Qualcomm NSS (Hardware offload)"
64+
elif [ -d /sys/kernel/debug/ecm/ecm_sfe_ipv4 ] || \
65+
lsmod 2>/dev/null | grep -q "^shortcut_fe"; then
66+
echo "[OK] Qualcomm SFE (Software offload)"
67+
elif [ -d /sys/kernel/debug/ppe0 ]; then
68+
echo "[OK] MediaTek PPE/HNAT (Hardware offload)"
69+
elif lsmod 2>/dev/null | grep -q "^nf_flow_table"; then
70+
echo "[OK] Linux flow offload (Software offload)"
71+
else
72+
echo "[NOTICE] No offload engine detected, tool will run in fallback mode"
73+
fi
74+
echo "Starting NSS-Switch installation..."
75+
fi
76+
exit 0
77+
endef
78+
define Package/nss-switch/postinst
79+
#!/bin/sh
80+
if [ -z "$${IPKG_INSTROOT}" ]; then
81+
if [ -x /etc/init.d/firewall ]; then
82+
/etc/init.d/firewall reload 2>/dev/null
83+
echo "[NSS-Switch] Firewall reloaded to apply post-install hooks" >&2
84+
fi
85+
fi
86+
exit 0
87+
endef
88+
define Package/nss-switch/prerm
89+
#!/bin/sh
90+
if [ -z "$${IPKG_INSTROOT}" ]; then
91+
NSS_MARK=0x00010000
92+
echo "Preparing a proper clean-up before package removal..."
93+
if command -v nft >/dev/null 2>&1; then
94+
for chain in mangle_prerouting mangle_postrouting; do
95+
handles=$$(nft -a list chain inet fw4 "$$chain" 2>/dev/null | grep -E "jump nss_bypass_pre|jump nss_bypass_post" | grep -oE 'handle [0-9]+' | awk '{print $$2}')
96+
for h in $$handles; do
97+
nft delete rule inet fw4 "$$chain" handle "$$h" 2>/dev/null
98+
done
99+
done
100+
nft delete chain inet fw4 nss_bypass_pre 2>/dev/null
101+
nft delete chain inet fw4 nss_bypass_post 2>/dev/null
102+
fi
103+
if [ -f /proc/net/nf_conntrack ] && command -v conntrack >/dev/null 2>&1; then
104+
conntrack -L 2>/dev/null | grep "mark=$$NSS_MARK" | while read -r line; do
105+
proto=$$(echo "$$line" | awk '{print $$1}')
106+
src=$$(echo "$$line" | grep -oE 'src=[^ ]+' | head -1 | cut -d= -f2)
107+
dst=$$(echo "$$line" | grep -oE 'dst=[^ ]+' | head -1 | cut -d= -f2)
108+
[ -n "$$proto" ] && [ -n "$$src" ] && [ -n "$$dst" ] && \
109+
conntrack -D -p "$$proto" -s "$$src" -d "$$dst" 2>/dev/null
110+
done
111+
fi
112+
if [ -f /sys/kernel/debug/ecm/ecm_db/defunct_all ]; then
113+
echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all 2>/dev/null
114+
fi
115+
if uci -q get firewall.nss_bypass_include.type >/dev/null 2>&1; then
116+
uci delete firewall.nss_bypass_include
117+
uci commit firewall
118+
fi
119+
fi
120+
exit 0
121+
endef
122+
define Package/nss-switch/postrm
123+
#!/bin/sh
124+
if [ -z "$${IPKG_INSTROOT}" ]; then
125+
rm -rf /usr/lib/nss-switch 2>/dev/null || true
126+
rm -f /etc/config/nss-switch-conf 2>/dev/null || true
127+
rm -rf /etc/nss-switch 2>/dev/null || true
128+
rm -f /etc/firewall.d/nss-bypass-rules 2>/dev/null || true
129+
if [ -x /etc/init.d/firewall ]; then
130+
/etc/init.d/firewall reload 2>/dev/null
131+
fi
132+
fi
133+
exit 0
134+
endef
135+
$(eval $(call BuildPackage,nss-switch))

‎net/nss-switch/files/etc/config/nss-switch-conf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# NSS-Switch global configuration
2+
# /etc/config/nss-switch-conf
3+
4+
# Default persistence mode for new rules: yes | no
5+
PERSIST_DEFAULT=no
6+
7+
# Our reserved ct mark bit (bit 16, outside QoS 0x000000ff range)
8+
NSS_MARK=0x00010000
9+
NSS_MARK_MASK=0x00010000
10+
11+
# ECM debugfs base path
12+
ECM_DEBUGFS=/sys/kernel/debug/ecm
13+
14+
# Our nftables table and chain names
15+
NFT_TABLE="inet fw4"
16+
NFT_CHAIN_PRE="nss_bypass_pre"
17+
NFT_CHAIN_POST="nss_bypass_post"
18+
19+
# State and rules file
20+
RULES_FILE=/etc/nss-switch/rules.conf
21+
DEBUG_LOG=/tmp/nss-switch.log
22+
23+
# Firewall hook script (auto-generated, loaded by fw4)
24+
FW_SCRIPT=/etc/firewall.d/nss-bypass-rules
25+
26+
# Watch refresh interval in seconds
27+
WATCH_INTERVAL=3
28+
29+
# Debug mode: yes | no (can also be set via DEBUG=1 env var)
30+
DEBUG_MODE=no

‎net/nss-switch/files/etc/firewall.d/nss-bypass-rules‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/usr/bin/env ash
2+
# NSS-Switch firewall.d hook — auto-generated, do not edit manually
3+
# This file is regenerated by nss-switch whenever rules change.
4+
# To modify rules: use nss-switch add / remove / pick
5+
# To regenerate: nss-switch apply
6+
7+
NSS_MARK=0x00010000
8+
NFT_CHAIN_PRE=nss_bypass_pre
9+
NFT_CHAIN_POST=nss_bypass_post
10+
11+
nft_add_chains() {
12+
nft add chain inet fw4 ${NFT_CHAIN_PRE} 2>/dev/null || true
13+
nft flush chain inet fw4 ${NFT_CHAIN_PRE} 2>/dev/null || true
14+
nft add chain inet fw4 ${NFT_CHAIN_POST} 2>/dev/null || true
15+
nft flush chain inet fw4 ${NFT_CHAIN_POST} 2>/dev/null || true
16+
handles=$(nft -a list chain inet fw4 mangle_prerouting 2>/dev/null | grep "jump ${NFT_CHAIN_PRE}" | grep -oE 'handle [0-9]+' | awk '{print $2}')
17+
for h in $handles; do nft delete rule inet fw4 mangle_prerouting handle "$h" 2>/dev/null; done
18+
handles=$(nft -a list chain inet fw4 mangle_postrouting 2>/dev/null | grep "jump ${NFT_CHAIN_POST}" | grep -oE 'handle [0-9]+' | awk '{print $2}')
19+
for h in $handles; do nft delete rule inet fw4 mangle_postrouting handle "$h" 2>/dev/null; done
20+
nft add rule inet fw4 mangle_prerouting jump ${NFT_CHAIN_PRE} comment '"NSS-Switch prerouting"'
21+
nft add rule inet fw4 mangle_postrouting jump ${NFT_CHAIN_POST} comment '"NSS-Switch postrouting"'
22+
nft add rule inet fw4 ${NFT_CHAIN_POST} meta mark and ${NSS_MARK} != 0 ct mark set meta mark and ${NSS_MARK} comment '"NSS-Switch: save bypass mark to conntrack"'
23+
nft add rule inet fw4 ${NFT_CHAIN_PRE} ct mark and ${NSS_MARK} != 0 meta mark set ct mark comment '"NSS-Switch: restore bypass mark from conntrack"'
24+
}
25+
26+
nft_add_rules() {
27+
true
28+
}
29+
30+
nft_add_chains
31+
nft_add_rules

‎net/nss-switch/files/etc/nss-switch/rules.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# NSS-Switch rules: id|proto|src_ip|dst_ip|src_port|dst_port|iface|persist|comment
2+
# Example:
3+
# 1|tcp|192.168.1.3|any|80|any|any|no|This rule bypasses any FROM tcp 192.168.1.3:80 and it does NOT survive
4+
# 2|any|any|any|any|any|wan|yes|This other bypasses ALL from/to WAN and persists on reboot
5+
# NSS-Switch rules.conf — auto-generated, do not edit manually
6+
# This file is regenerated by nss-switch whenever rules are added or removed.
7+
# To modify rules: use nss-switch add / remove / pick
8+
# To regenerate: nss-switch apply
9+

‎net/nss-switch/files/usr/lib/nss-switch/bin/.placeholder‎

Whitespace-only changes.

‎net/nss-switch/files/usr/lib/nss-switch/lib/chandler.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env ash
2+
# lib/chandler.sh: C compiled bin handler
3+
BIN_DIR="/usr/lib/nss-switch/bin"
4+
LIB_DIR="/usr/lib/nss-switch/lib"
5+
HAS_CT_DUMP="no"
6+
if [ -f "$BIN_DIR/nss-ct-dump" ] && [ -x "$BIN_DIR/nss-ct-dump" ]; then
7+
HAS_CT_DUMP="yes"
8+
CT_DUMP_BIN="$BIN_DIR/nss-ct-dump"
9+
fi
10+
export HAS_CT_DUMP
11+
export BIN_DIR
12+
export LIB_DIR
13+
export CT_DUMP_BIN

0 commit comments

Comments
 (0)