mptcp/openmptcprouter-feeds
1
0
Fork 0
mirror of https://github.com/Ysurac/openmptcprouter-feeds.git synced 2025-02-13 02:51:50 +00:00
Code Issues Releases Wiki Activity

Bypass changes

Browse source
This commit is contained in:
Ycarus 2018-10-20 19:20:51 +02:00
parent 008cdcc468
commit 703e376d60
5 changed files with 62 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

64
luci-app-omr-bypass/root/etc/init.d/omr-bypass
View file

@ -50,11 +50,28 @@ _bypass_proto() {
[ -z "$intf" ] && intf="all" [ -z "$intf" ] && intf="all"
[ -z "$proto" ] && return [ -z "$proto" ] && return
if [ "$intf" = "all" ]; then if [ "$intf" = "all" ]; then
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539 echo "Add $proto"
$ndpi_rules" iptables-restore --wait=60 --noflush <<-EOF
*mangle
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
COMMIT
EOF
ip6tables-restore --wait=60 --noflush <<-EOF
*mangle
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
COMMIT
EOF
else else
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid iptables-restore --wait=60 --noflush <<-EOF
$ndpi_rules" *mangle
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
COMMIT
EOF
ip6tables-restore --wait=60 --noflush <<-EOF
*mangle
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
COMMIT
EOF
fi fi
} }
@ -82,14 +99,15 @@ _intf_rule() {
EOF EOF
fi fi
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
echo "add nat rules..."
iptables-restore --wait=60 --noflush <<-EOF iptables-restore --wait=60 --noflush <<-EOF
*nat *nat
-I ss_rules_dst 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN -I ss_rules_dst 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
-I ss_rules_local_out 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN -I ss_rules_local_out 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
-I ss_rules_local_out 2 -m mark --mark 0x539$count -j RETURN
-I ss_rules_pre_src 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count -I ss_rules_pre_src 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
-I ss_rules_pre_src 2 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN -I ss_rules_pre_src 2 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
-I ss_rules_pre_src 3 -m mark --mark 0x539$count -j RETURN -I ss_rules_pre_src 3 -m mark --mark 0x539$count -j RETURN
-I ss_rules_local_out 1 -m mark --mark 0x539$count -j RETURN
COMMIT COMMIT
EOF EOF
fi fi
@ -105,10 +123,10 @@ _intf_rule() {
*nat *nat
-I ss_rules6_dst 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN -I ss_rules6_dst 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
-I ss_rules6_local_out 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN -I ss_rules6_local_out 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
-I ss_rules6_local_out 2 -m mark --mark 0x539$count -j RETURN
-I ss_rules6_pre_src 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count -I ss_rules6_pre_src 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
-I ss_rules6_pre_src 2 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN -I ss_rules6_pre_src 2 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
-I ss_rules6_pre_src 3 -m mark --mark 0x539$count -j RETURN -I ss_rules6_pre_src 3 -m mark --mark 0x539$count -j RETURN
-I ss_rules6_local_out 1 -m mark --mark 0x539$count -j RETURN
COMMIT COMMIT
EOF EOF
fi fi
@ -144,7 +162,7 @@ start_service() {
config_foreach _bypass_domain domains config_foreach _bypass_domain domains
uci -q commit dhcp uci -q commit dhcp
/etc/init.d/dnsmasq reload /etc/init.d/dnsmasq reload
config_foreach _bypass_proto dpis #config_foreach _bypass_proto dpis
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1 ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
ip -6 rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1 ip -6 rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
@ -167,28 +185,26 @@ start_service() {
iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters
ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters
ndpi_rules=$(echo $ndpi_rules | awk 'NF') ndpi_rules=$(echo $ndpi_rules | awk 'NF')
if [ "$ndpi_rules" != "" ]; then #iptables-restore --wait=60 --noflush <<-EOF
iptables-restore --wait=60 --noflush <<-EOF #*mangle
*mangle #:omr-bypass-dpi -
:omr-bypass-dpi - #-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi #COMMIT
$ndpi_rules #EOF
COMMIT ip6tables-restore --wait=60 --noflush <<-EOF
EOF *mangle
ip6tables-restore --wait=60 --noflush <<-EOF :omr-bypass-dpi -
*mangle -A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
:omr-bypass-dpi - COMMIT
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi EOF
$ndpi_rules config_load omr-bypass
COMMIT config_foreach _bypass_proto dpis
EOF
fi
logger -t "omr-bypass" "OMR-ByPass is running" logger -t "omr-bypass" "OMR-ByPass is running"
} }
service_triggers() { service_triggers() {
PROCD_RELOAD_DELAY=1000 PROCD_RELOAD_DELAY=1000
procd_add_reload_trigger omr-bypass shadowsocks-libev procd_add_reload_trigger omr-bypass
procd_add_raw_trigger "interface.*" 2000 /etc/init.d/omr-bypass restart procd_add_raw_trigger "interface.*" 2000 /etc/init.d/omr-bypass restart
} }

2
mptcp/files/usr/share/omr/post-tracking.d/post-tracking
View file

@ -198,7 +198,7 @@ if [ "$OMR_TRACKER_INTERFACE" = "glorytun" ] || [ "$OMR_TRACKER_INTERFACE" = "om
uci -q set openmptcprouter.$OMR_TRACKER_INTERFACE.mtu=$mtu uci -q set openmptcprouter.$OMR_TRACKER_INTERFACE.mtu=$mtu
ip link set dev $OMR_TRACKER_DEVICE mtu $mtu > /dev/null 2>&1 ip link set dev $OMR_TRACKER_DEVICE mtu $mtu > /dev/null 2>&1
uci -q set openmptcprouter.$OMR_TRACKER_INTERFACE.lc=$(date +"%s") uci -q set openmptcprouter.$OMR_TRACKER_INTERFACE.lc=$(date +"%s")
elif [ -z "$(uci -q get openmptcprouter.$OMR_TRACKER_INTERFACE.mtu)" ] || [ "$(uci -q get openmptcprouter.$OMR_TRACKER_INTERFACE.mtu)" = "1500" ]; then elif [ -z "$(uci -q get openmptcprouter.$OMR_TRACKER_INTERFACE.mtu)" ]; then
[ -n "$serverip" ] && { [ -n "$serverip" ] && {
local mtu=$(omr-mtu $OMR_TRACKER_DEVICE_IP $serverip) local mtu=$(omr-mtu $OMR_TRACKER_DEVICE_IP $serverip)
[ -n "$mtu" ] && { [ -n "$mtu" ] && {

16
shadowsocks-libev/files/shadowsocks-libev.init
View file

@ -307,17 +307,21 @@ start_service() {
for cfgtype in ss_local ss_redir ss_server ss_tunnel; do for cfgtype in ss_local ss_redir ss_server ss_tunnel; do
config_foreach ss_xxx "$cfgtype" "$cfgtype" config_foreach ss_xxx "$cfgtype" "$cfgtype"
done done
ss_rules rules_up
ss_rules6 #ss_rules
#ss_rules6
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
# Add rule to match traffic marked by firewall for bypass # Add rule to match traffic marked by firewall for bypass
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1 ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
} }
stop_service() { stop_service() {
local bin="$ss_bindir/ss-rules" #local bin="$ss_bindir/ss-rules"
[ -x "$bin" ] && "$bin" -f #[ -x "$bin" ] && "$bin" -f
local bin6="$ss_bindir/ss-rules6" #local bin6="$ss_bindir/ss-rules6"
[ -x "$bin6" ] && "$bin6" -f #[ -x "$bin6" ] && "$bin6" -f
rules_down
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
rm -rf "$ss_confdir" rm -rf "$ss_confdir"
} }

2
shadowsocks-libev/files/ss-rules
View file

@ -192,6 +192,7 @@ ss_rules_iptchains_init_tcp() {
-A ss_rules_local_out -m set --match-set ss_rules_dst_bypass dst -j RETURN -A ss_rules_local_out -m set --match-set ss_rules_dst_bypass dst -j RETURN
-A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_all dst -j RETURN -A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_all dst -j RETURN
-A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_ dst -j RETURN -A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_ dst -j RETURN
-A ss_rules_local_out -m mark --mark 0x539 -j RETURN
-A ss_rules_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default" -A ss_rules_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default"
COMMIT COMMIT
EOF EOF
@ -250,6 +251,7 @@ ss_rules_iptchains_init_() {
-A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_all dst -j MARK --set-mark 0x539 -A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_all dst -j MARK --set-mark 0x539
-A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_all dst -j RETURN -A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_all dst -j RETURN
-A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass dst -j RETURN -A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass dst -j RETURN
-A ss_rules_pre_src -m mark --mark 0x539 -j RETURN
-A ss_rules_dst -m set --match-set ss_rules_dst_bypass_all dst -j RETURN -A ss_rules_dst -m set --match-set ss_rules_dst_bypass_all dst -j RETURN
-A ss_rules_dst -m set --match-set ss_rules_dst_bypass dst -j RETURN -A ss_rules_dst -m set --match-set ss_rules_dst_bypass dst -j RETURN
-A ss_rules_pre_src -p $proto $o_ipt_extra -j ss_rules_src -A ss_rules_pre_src -p $proto $o_ipt_extra -j ss_rules_src

18
shadowsocks-libev/files/ss-rules.defaults
View file

@ -9,12 +9,12 @@ uci get "$s" >/dev/null || {
commit firewall commit firewall
EOF EOF
} }
s=firewall.ss_rules6 #s=firewall.ss_rules6
uci get "$s" >/dev/null || { #uci get "$s" >/dev/null || {
uci batch <<-EOF # uci batch <<-EOF
set $s=include # set $s=include
set $s.path=/etc/firewall.ss-rules6 # set $s.path=/etc/firewall.ss-rules6
set $s.reload=1 # set $s.reload=1
commit firewall # commit firewall
EOF # EOF
} #}