mptcp/openmptcprouter-feeds
1
0
Fork 0
mirror of https://github.com/Ysurac/openmptcprouter-feeds.git synced 2025-03-09 15:40:03 +00:00
Code Issues Releases Wiki Activity

Choose interface used for each domains, ips, networks or protocols that bypass OMR

Browse source
This commit is contained in:
Ycarus 2018-10-05 17:13:38 +02:00
parent d1d69d8043
commit 4171d8e07a
7 changed files with 296 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

130
luci-app-omr-bypass/root/etc/init.d/omr-bypass
View file

@ -8,52 +8,119 @@ USE_PROCD=1
. /usr/lib/unbound/iptools.sh
_bypass_ip() {
local ip="$1"
local ip=$1
local type=$2
[ -z "$type" ] && type="all"
valid_ip4=$( valid_subnet4 $ip)
valid_ip6=$( valid_subnet6 $ip)
if [ "$valid_ip4" = "ok" ]; then
ipset add ss_rules_dst_bypass_all $ip
ipset add ss_rules_dst_bypass_$type $ip
elif [ "$valid_ip6" = "ok" ]; then
ipset add ss_rules6_dst_bypass_all $ip
ipset add ss_rules6_dst_bypass_$type $ip
fi
}
_bypass_domain() {
# Bypass domain even if OMR DNS is not used
domains=$(uci -q get dhcp.@dnsmasq[0].ipset)
for domain in ${domains//\// }; do
if [ -n "$domain" ] && [ "$domain" != "ss_rules_dst_bypass_all" ]; then
resolve=$(dig a +nocmd +noall +answer $domain | awk '{print $5}')
for ip in $resolve; do
_bypass_ip $ip
done
resolve=$(dig aaaa +nocmd +noall +answer $domain | awk '{print $5}')
for ip in $resolve; do
_bypass_ip $ip
done
fi
done
local domain
local intf
config_get domain $1 name
config_get intf $1 interface
[ -z "$intf" ] && intf="all"
if [ -n "$domain" ]; then
resolve=$(dig a +nocmd +noall +answer $domain | awk '{print $5}')
for ip in $resolve; do
_bypass_ip $ip $intf
done
resolve=$(dig aaaa +nocmd +noall +answer $domain | awk '{print $5}')
for ip in $resolve; do
_bypass_ip $ip $intf
done
uci -q add_list dhcp.@dnsmasq[0].ipset="/$domain/ss_rules_dst_bypass_$intf,ss_rules6_dst_bypass_$intf"
fi
}
_bypass_proto() {
local proto="$1"
local proto
local intf
config_get proto $1 proto
config_get intf $1 interface
local intfid="$(uci -q get omr-bypass.$intf.id)"
[ -z "$intf" ] && intf="all"
[ -z "$proto" ] && return
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
$ndpi_rules"
if [ "$intf" = "all" ]; then
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
$ndpi_rules"
else
local intfid="$(uci -q get omr-bypass.$intf.id)"
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
$ndpi_rules"
fi
}
_intf_rule() {
local intf="$1"
local mode
count=$((count+1))
ipset -q flush ss_rules_dst_bypass_$intf > /dev/null 2>&1
ipset -q flush ss_rules6_dst_bypass_$intf > /dev/null 2>&1
ipset -q --exist restore <<-EOF
create ss_rules_dst_bypass_$intf hash:net hashsize 64
create ss_rules6_dst_bypass_$intf hash:net family inet6 hashsize 64
EOF
ip rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
ip -6 rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
if [ "$(iptables -w 40 -t mangle -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
iptables-restore --wait=60 --noflush <<-EOF
*mangle
-A PREROUTING -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
COMMIT
EOF
fi
if [ "$(ip6tables -w 40 -t mangle -L | grep ss_rules6_dst_bypass_$intf)" = "" ]; then
ip6tables-restore --wait=60 --noflush <<-EOF
*mangle
-A PREROUTING -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
COMMIT
EOF
fi
uci -q set omr-bypass.$intf=interface
uci -q set omr-bypass.$intf.id=$count
}
_bypass_ip_set() {
local ip
local interface
config_get ip $1 ip
config_get interface $1 interface
_bypass_ip $ip $interface
}
start_service() {
local count
uci -q del omr-bypass
ipset -q flush ss_rules_dst_bypass_all > /dev/null 2>&1
ipset -q flush ss_rules6_dst_bypass_all > /dev/null 2>&1
ipset -q --exist restore <<-EOF
create ss_rules_dst_bypass_all hash:net hashsize 64
create ss_rules6_dst_bypass_all hash:net family inet6 hashsize 64
EOF
config_load omr-bypass
config_list_foreach ips "ip" _bypass_ip
config_load network
config_foreach _intf_rule interface
_bypass_domain
local ndpi_rules=""
config_load omr-bypass
config_foreach _bypass_ip_set ips
uci -q del dhcp.@dnsmasq[0].ipset
config_foreach _bypass_domain domains
config_foreach _bypass_proto dpis
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
ip -6 rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
if [ "$(iptables -w 40 -t mangle -L | grep 'match-set ss_rules_dst_bypass_all dst MARK set')" = "" ]; then
iptables-restore --wait=60 --noflush <<-EOF
@ -62,10 +129,16 @@ start_service() {
COMMIT
EOF
fi
if [ "$(ip6tables -w 40 -t mangle -L | grep 'match-set ss_rules6_dst_bypass_all dst MARK set')" = "" ]; then
ip6tables-restore --wait=60 --noflush <<-EOF
*mangle
-A PREROUTING -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x539
COMMIT
EOF
fi
iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters
local ndpi_rules=""
config_list_foreach dpi "proto" _bypass_proto
ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters
ndpi_rules=$(echo $ndpi_rules | awk 'NF')
if [ "$ndpi_rules" != "" ]; then
iptables-restore --wait=60 --noflush <<-EOF
@ -75,6 +148,13 @@ start_service() {
$ndpi_rules
COMMIT
EOF
ip6tables-restore --wait=60 --noflush <<-EOF
*mangle
:omr-bypass-dpi -
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
$ndpi_rules
COMMIT
EOF
fi
}