diff --git a/packages/ns-dpi/Makefile b/packages/ns-dpi/Makefile index 8ef988b45..e9a68c8f1 100644 --- a/packages/ns-dpi/Makefile +++ b/packages/ns-dpi/Makefile @@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk PKG_NAME:=ns-dpi -PKG_VERSION:=0.2.0 -PKG_RELEASE:=2 +PKG_VERSION:=0.3.0 +PKG_RELEASE:=1 PKG_BUILD_DIR:=$(BUILD_DIR)/ns-dpi-$(PKG_VERSION) diff --git a/packages/ns-dpi/README.md b/packages/ns-dpi/README.md index 8f993f28a..ff267ad6b 100644 --- a/packages/ns-dpi/README.md +++ b/packages/ns-dpi/README.md @@ -19,7 +19,7 @@ To enable traffic processing: Global options: - `enabled`: can be `0` or `1`, if set to `1` enable the service -- `log_blocked`: can be `0` or `1`, if set to `1` blocked connections will be logged +- `log_blocked`: can be `0` or `1`, if set to `1` blocked connections will be logged inside `/var/log/messages` - `firewall_exemption`: can be `0` or `1`, if set to `1` all firewall IP addresses will be added to global exemption list and will not match DPI rules - `popular_filters`: list of filters that will be returned to from `api-cli ns.dpi list-popular` call. @@ -41,6 +41,8 @@ Rule options: - `device`: optional device name, if set the rule will be applied only to the given device, example `br-lan` - `application`: list of applications to match, the list can contain application names like `netify.amazon-prime` - `enabled`: can be `0` or `1`, if set to `1` the rule will be enabled +- `log`: can be set to `1` to log matching connections, gives an improved visibility on matched connections; + logs are stored in `/var/run/netifyd/dpi-actions-*.json` Global exemptions options: diff --git a/packages/ns-dpi/files/dpi-config b/packages/ns-dpi/files/dpi-config index 32520b698..59738222c 100755 --- a/packages/ns-dpi/files/dpi-config +++ b/packages/ns-dpi/files/dpi-config @@ -47,7 +47,14 @@ config = { "other_port", "other_addr" ] - } + }, + "log": { + "target_type": "log", + "target_enabled": True, + "interval": 60, + "path": "/var/run/netifyd/", + "prefix": "dpi-actions", + }, }, "actions": {}, "exemptions": [] @@ -127,11 +134,14 @@ for section in u.get_all('dpi'): criteria = f'vlan_id == {vlan_id} && {criteria}' device = base_if + targets = [rule['action']] + if 'log' in rule and rule['log'] == '1': + targets.append('log') config["actions"][f"rule{rcount}"] = { "enabled": rule['enabled'] == '1', "interface": device, "criteria": criteria, - "targets": [rule['action']], + "targets": targets, "exemptions": rule.get('exemption', []) } rcount = rcount + 1