Add basic IPv6 support and replace haproxy by nginx for VPS failover

shadowsocks-libev/Makefile

@@ -15,7 +15,7 @@ include $(TOPDIR)/rules.mk
 #
 PKG_NAME:=shadowsocks-libev
 PKG_VERSION:=3.1.2
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/shadowsocks/shadowsocks-libev/releases/download/v$(PKG_VERSION)
@@ -88,6 +88,7 @@ endef
 define Package/shadowsocks-libev-ss-rules/install
 	$(INSTALL_DIR) $(1)/usr/bin
 	$(INSTALL_BIN) ./files/ss-rules $(1)/usr/bin
+	$(INSTALL_BIN) ./files/ss-rules6 $(1)/usr/bin
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_DATA) ./files/firewall.ss-rules $(1)/etc
 	$(INSTALL_BIN) ./files/ss-rules.defaults $(1)/etc/uci-defaults

shadowsocks-libev/files/shadowsocks-libev.config

@@ -1,7 +1,7 @@
 config ss_redir hi
 	option disabled 1
 	option server 'sss0'
-	option local_address '0.0.0.0'
+	option local_address '::'
 	option local_port '1100'
 	option mode 'tcp_and_udp'
 	option timeout '60'

shadowsocks-libev/files/shadowsocks-libev.init

@@ -178,9 +178,11 @@ ss_rules_cb() {
 		ss_redir_servers="$ss_redir_servers $server"
 		if [ "$mode" = tcp_only -o "$mode" = "tcp_and_udp" ]; then
 			eval "ss_rules_redir_tcp_$cfg=$local_port"
+			eval "ss_rules6_redir_tcp_$cfg=$local_port"
 		fi
 		if [ "$mode" = udp_only -o "$mode" = "tcp_and_udp" ]; then
 			eval "ss_rules_redir_udp_$cfg=$local_port"
+			eval "ss_rules6_redir_udp_$cfg=$local_port"
 		fi
 	fi
 }
@@ -203,11 +205,54 @@ ss_rules() {
 	eval local_port_tcp="\$ss_rules_redir_tcp_$redir_tcp"
 	eval local_port_udp="\$ss_rules_redir_udp_$redir_udp"
 	[ -n "$local_port_tcp" -o -n "$local_port_udp" ] || return 1
-	ss_redir_servers="$(echo "$ss_redir_servers" | tr ' ' '\n' | sort -u)"
+	ss_redir_servers4="$(echo "$ss_redir_servers" | awk -F. 'NF == 4' | tr ' ' '\n' | sort -u)"
+	
 	[ "$dst_forward_recentrst" = 0 ] || args="$args --dst-forward-recentrst"
 
 	"$bin" \
-			-s "$ss_redir_servers" \
+			-s "$ss_redir_servers4" \
+			-l "$local_port_tcp" \
+			-L "$local_port_udp" \
+			--src-default "$src_default" \
+			--dst-default "$dst_default" \
+			--local-default "$local_default" \
+			--dst-bypass-file "$dst_ips_bypass_file" \
+			--dst-forward-file "$dst_ips_forward_file" \
+			--dst-bypass "$dst_ips_bypass" \
+			--dst-forward "$dst_ips_forward" \
+			--src-bypass "$src_ips_bypass" \
+			--src-forward "$src_ips_forward" \
+			--src-checkdst "$src_ips_checkdst" \
+			--ifnames "$ifnames" \
+			--ipt-extra "$ipt_args" \
+			$args \
+		|| "$bin" -f
+}
+
+ss_rules6() {
+	local cfg="ss_rules"
+	local bin="$ss_bindir/ss-rules6"
+	local cfgtype
+	local local_port_tcp local_port_udp
+	local args
+
+	[ -x "$bin" ] || return 1
+	config_get cfgtype "$cfg" TYPE
+	[ "$cfgtype" = ss_rules ] || return 1
+
+	eval "$(validate_ss_rules_section "$cfg" ss_validate_mklocal)"
+	validate_ss_rules_section "$cfg" || return 1
+	[ "$disabled" = 0 ] || return 1
+
+	eval local_port_tcp="\$ss_rules6_redir_tcp_$redir_tcp"
+	eval local_port_udp="\$ss_rules6_redir_udp_$redir_udp"
+	[ -n "$local_port_tcp" -o -n "$local_port_udp" ] || return 1
+	ss_redir_servers6="$(echo "$ss_redir_servers" | awk -F: 'NF>4' | tr ' ' '\n' | sort -u)"
+
+	[ "$dst_forward_recentrst" = 0 ] || args="$args --dst-forward-recentrst"
+
+	"$bin" \
+			-s "$ss_redir_servers6" \
 			-l "$local_port_tcp" \
 			-L "$local_port_udp" \
 			--src-default "$src_default" \
@@ -235,12 +280,14 @@ start_service() {
 		config_foreach ss_xxx "$cfgtype" "$cfgtype"
 	done
 	ss_rules
+	ss_rules6
 }
 
 stop_service() {
 	local bin="$ss_bindir/ss-rules"
-
 	[ -x "$bin" ] && "$bin" -f
+	local bin6="$ss_bindir/ss-rules6"
+	[ -x "$bin6" ] && "$bin6" -f
 	rm -rf "$ss_confdir"
 }
 

shadowsocks-libev/files/ss-rules6

@@ -0,0 +1,247 @@
+#!/bin/sh -e
+#
+# Copyright (C) 2017 Yousong Zhou <yszhou4tech@gmail.com>
+#
+# The design idea was derived from ss-rules by Jian Chang <aa65535@live.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+ss_rules6_usage() {
+	cat >&2 <<EOF
+Usage: ss-rules [options]
+
+	-h, --help      Show this help message then exit
+	-f, --flush     Flush rules, ipset then exit
+	-l <port>       Local port number of ss-redir with TCP mode
+	-L <port>       Local port number of ss-redir with UDP mode
+	-s <ips>        List of ip addresses of remote shadowsocks server
+	--ifnames       Only apply rules on packets from these ifnames
+	--src-bypass <ips|cidr>
+	--src-forward <ips|cidr>
+	--src-checkdst <ips|cidr>
+	--src-default <bypass|forward|checkdst>
+	                Packets will have their src ip checked in order against
+	                bypass, forward, checkdst list and will bypass, forward
+	                through, or continue to have their dst ip checked
+	                respectively on the first match.  Otherwise, --src-default
+	                decide the default action
+	--dst-bypass <ips|cidr>
+	--dst-forward <ips|cidr>
+	--dst-bypass-file <file>
+	--dst-forward-file <file>
+	--dst-default <bypass|forward>
+	                Same as with their --src-xx equivalent
+	--dst-forward-recentrst
+	                Forward those packets whose destinations have recently
+	                sent to us multiple tcp-rst packets
+	--local-default <bypass|forward|checkdst>
+	                Default action for local out TCP traffic
+
+The following ipsets will be created by ss-rules.  They are also intended to be
+populated by other programs like dnsmasq with ipset support
+
+	ss_rules6_src_bypass
+	ss_rules6_src_forward
+	ss_rules6_src_checkdst
+	ss_rules6_dst_bypass
+	ss_rules6_dst_forward
+EOF
+}
+
+o_dst_bypass_="
+"
+o_src_default=bypass
+o_dst_default=bypass
+o_local_default=bypass
+
+__errmsg() {
+	echo "ss-rules6: $*" >&2
+}
+
+ss_rules6_parse_args() {
+	while [ "$#" -gt 0 ]; do
+		case "$1" in
+			-h|--help) ss_rules6_usage; exit 0;;
+			-f|--flush) ss_rules6_flush; exit 0;;
+			-l) o_redir_tcp_port="$2"; shift 2;;
+			-L) o_redir_udp_port="$2"; shift 2;;
+			-s) o_remote_servers="$2"; shift 2;;
+			--ifnames) o_ifnames="$2"; shift 2;;
+			--ipt-extra) o_ipt_extra="$2"; shift 2;;
+			--src-default) o_src_default="$2"; shift 2;;
+			--dst-default) o_dst_default="$2"; shift 2;;
+			--local-default) o_local_default="$2"; shift 2;;
+			--src-bypass) o_src_bypass="$2"; shift 2;;
+			--src-forward) o_src_forward="$2"; shift 2;;
+			--src-checkdst) o_src_checkdst="$2"; shift 2;;
+			--dst-bypass) o_dst_bypass="$2"; shift 2;;
+			--dst-forward) o_dst_forward="$2"; shift 2;;
+			--dst-forward-recentrst) o_dst_forward_recentrst=1; shift 1;;
+			--dst-bypass-file) o_dst_bypass_file="$2"; shift 2;;
+			--dst-forward-file) o_dst_forward_file="$2"; shift 2;;
+			*) __errmsg "unknown option $1"; return 1;;
+		esac
+	done
+
+	if [ -z "$o_redir_tcp_port" -a -z "$o_redir_udp_port" ]; then
+		__errmsg "Requires at least -l or -L option"
+		return 1
+	fi
+	if [ -n "$o_dst_forward_recentrst" ] && ! ip6tables -m recent -h >/dev/null; then
+		__errmsg "Please install ip6tables-mod-conntrack-extra with opkg"
+		return 1
+	fi
+	o_remote_servers="$(for s in $o_remote_servers; do resolveip -6 "$s"; done)"
+}
+
+ss_rules6_flush() {
+	local setname
+
+	ip6tables-save --counters | grep -v ss_rules6_ | ip6tables-restore --counters
+	while ip -f inet6 rule del fwmark 1 lookup 100 2>/dev/null; do true; done
+	ip -f inet6 route flush table 100
+	for setname in $(ipset -n list | grep "ss_rules6_"); do
+		ipset destroy "$setname" 2>/dev/null || true
+	done
+}
+
+ss_rules6_ipset_init() {
+	ipset --exist restore <<-EOF
+		create ss_rules6_src_bypass hash:net family inet6 hashsize 64
+		create ss_rules6_src_forward hash:net family inet6 hashsize 64
+		create ss_rules6_src_checkdst hash:net family inet6 hashsize 64
+		create ss_rules6_dst_bypass hash:net family inet6 hashsize 64
+		create ss_rules6_dst_bypass_ hash:net family inet6 hashsize 64
+		create ss_rules6_dst_forward hash:net family inet6 hashsize 64
+		create ss_rules6_dst_forward_recrst_ hash:ip family inet6 hashsize 64 timeout 3600
+		$(ss_rules6_ipset_mkadd ss_rules6_dst_bypass_ "$o_dst_bypass_ $o_remote_servers")
+		$(ss_rules6_ipset_mkadd ss_rules6_src_bypass "$o_src_bypass")
+		$(ss_rules6_ipset_mkadd ss_rules6_src_forward "$o_src_forward")
+		$(ss_rules6_ipset_mkadd ss_rules6_src_checkdst "$o_src_checkdst")
+		$(ss_rules6_ipset_mkadd ss_rules6_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null)")
+		$(ss_rules6_ipset_mkadd ss_rules6_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null)")
+	EOF
+}
+
+ss_rules6_ipset_mkadd() {
+	local setname="$1"; shift
+	local i
+
+	for i in $*; do
+		echo "add $setname $i"
+	done
+}
+
+ss_rules6_iptchains_init() {
+	ss_rules6_iptchains_init_tcp
+	ss_rules6_iptchains_init_udp
+}
+
+ss_rules6_iptchains_init_tcp() {
+	local local_target
+
+	[ -n "$o_redir_tcp_port" ] || return 0
+
+	ss_rules6_iptchains_init_ nat tcp
+
+	case "$o_local_default" in
+		checkdst) local_target=ss_rules6_dst ;;
+		forward) local_target=ss_rules6_forward ;;
+		bypass|*) return 0;;
+	esac
+
+	ip6tables-restore --noflush <<-EOF
+		*nat
+		:ss_rules6_local_out -
+		-I OUTPUT 1 -p tcp -j ss_rules6_local_out
+		-A ss_rules6_local_out -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN
+		-A ss_rules6_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default"
+		COMMIT
+	EOF
+
+}
+
+ss_rules6_iptchains_init_udp() {
+	[ -n "$o_redir_udp_port" ] || return 0
+	ss_rules6_iptchains_init_ mangle udp
+}
+
+ss_rules6_iptchains_init_() {
+	local table="$1"
+	local proto="$2"
+	local forward_rules
+	local src_default_target dst_default_target
+	local recentrst_mangle_rules recentrst_addset_rules
+
+	case "$proto" in
+		tcp)
+			forward_rules="-A ss_rules6_forward -p tcp -j REDIRECT --to-ports $o_redir_tcp_port"
+			if [ -n "$o_dst_forward_recentrst" ]; then
+				recentrst_mangle_rules="
+					*mangle
+					-I PREROUTING 1 -p tcp -m tcp --tcp-flags RST RST -m recent --name ss_rules6_recentrst --set --rsource
+					COMMIT
+				"
+				recentrst_addset_rules="
+					-A ss_rules6_dst -m recent --name ss_rules6_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules6_dst_forward_recrst_ dst --exist
+					-A ss_rules6_dst -m set --match-set ss_rules6_dst_forward_recrst_ dst -j ss_rules6_forward
+				"
+			fi
+			;;
+		udp)
+			ip -f inet6 rule add fwmark 1 lookup 100
+			ip -f inet6 route add local default dev lo table 100
+			forward_rules="-A ss_rules6_forward -p udp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01"
+			;;
+	esac
+	case "$o_src_default" in
+		forward) src_default_target=ss_rules6_forward ;;
+		checkdst) src_default_target=ss_rules6_dst ;;
+		bypass|*) src_default_target=RETURN ;;
+	esac
+	case "$o_dst_default" in
+		forward) dst_default_target=ss_rules6_forward ;;
+		bypass|*) dst_default_target=RETURN ;;
+	esac
+	sed -e '/^\s*$/d' -e 's/^\s\+//' <<-EOF | ip6tables-restore --noflush
+		*$table
+		:ss_rules6_pre_src -
+		:ss_rules6_src -
+		:ss_rules6_dst -
+		:ss_rules6_forward -
+		$(ss_rules6_iptchains_mkprerules "$proto")
+		-A ss_rules6_pre_src -p $proto $o_ipt_extra -j ss_rules6_src
+		-A ss_rules6_src -m set --match-set ss_rules6_src_bypass src -j RETURN
+		-A ss_rules6_src -m set --match-set ss_rules6_src_forward src -j ss_rules6_forward
+		-A ss_rules6_src -m set --match-set ss_rules6_src_checkdst src -j ss_rules6_dst
+		-A ss_rules6_src -j $src_default_target -m comment --comment "src_default: $o_src_default"
+		-A ss_rules6_pre_src -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN
+		-A ss_rules6_dst -m set --match-set ss_rules6_dst_bypass dst -j RETURN
+		-A ss_rules6_dst -m set --match-set ss_rules6_dst_forward dst -j ss_rules6_forward
+		$recentrst_addset_rules
+		-A ss_rules6_dst -j $dst_default_target -m comment --comment "dst_default: $o_dst_default"
+		$forward_rules
+		COMMIT
+		$recentrst_mangle_rules
+	EOF
+
+}
+
+ss_rules6_iptchains_mkprerules() {
+	local proto="$1"
+
+	if [ -z "$o_ifnames" ]; then
+		echo "-I PREROUTING 1 -p $proto -j ss_rules6_pre_src"
+	else
+		echo $o_ifnames \
+			| tr ' ' '\n' \
+			| sed "s/.*/-I PREROUTING 1 -i \\0 -p $proto -j ss_rules6_pre_src/"
+	fi
+}
+
+ss_rules6_parse_args "$@"
+ss_rules6_flush
+ss_rules6_ipset_init
+ss_rules6_iptchains_init