From b6b6d2fc291456bbcd5653417a6d2b6895ff53ca Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Thu, 15 Oct 2020 21:10:27 +0200 Subject: [PATCH] Add IPv6 support with v2ray --- v2ray-core/files/etc/init.d/v2ray | 28 +- .../files/etc/uci-defaults/3010-omr-v2ray | 13 +- v2ray-core/files/usr/bin/v2ray-rules6 | 281 ++++++++++++++++++ 3 files changed, 310 insertions(+), 12 deletions(-) create mode 100755 v2ray-core/files/usr/bin/v2ray-rules6 diff --git a/v2ray-core/files/etc/init.d/v2ray b/v2ray-core/files/etc/init.d/v2ray index 2205b7d0f..409df9ffe 100755 --- a/v2ray-core/files/etc/init.d/v2ray +++ b/v2ray-core/files/etc/init.d/v2ray @@ -411,8 +411,12 @@ add_v2ray_redirect_rules() { local ipset_dst_direct="$IPSET_DST_DIRECT_V4" test -n "$port" || return - #logger -t "v2ray" "v2ray-rules -l ${port} -L ${port} -s $OUTBOUND_SERVERS_V4 --rule-name def --src-default forward --dst-default forward --local-default forward" + logger -t "v2ray" "v2ray-rules -l ${port} -L ${port} -s $OUTBOUND_SERVERS_V4 --rule-name def --src-default forward --dst-default forward --local-default forward" v2ray-rules -l ${port} -L ${port} -s $OUTBOUND_SERVERS_V4 --rule-name def --src-default forward --dst-default forward --local-default forward + logger -t "v2ray" "v2ray-rules2 -l $((port+1)) -L $((port+1)) -s $OUTBOUND_SERVERS_V6 --rule-name def --src-default forward --dst-default forward --local-default forward" + v2ray-rules6 -l $((port+1)) -L $((port+1)) --rule-name def --src-default forward --dst-default forward --local-default forward + logger -t "V2Ray" "Reload omr-bypass rules" + /etc/init.d/omr-bypass reload_rules } init_rules_for_listfile() { @@ -1268,18 +1272,18 @@ add_inbound_setting() { json_add_object "sockopt" - if [ -n "$port" ] && [ "x$port" = "x$TRANSPARENT_PROXY_PORT" ] ; then - if [ "x$TRANSPARENT_PROXY_USE_TPROXY" = "x1" ] ; then - json_add_string "tproxy" "tproxy" - else - json_add_string "tproxy" "redirect" - fi - else +# if [ -n "$port" ] && [ "x$port" = "x$TRANSPARENT_PROXY_PORT" ] ; then +# if [ "x$TRANSPARENT_PROXY_USE_TPROXY" = "x1" ] ; then +# json_add_string "tproxy" "tproxy" +# else +# json_add_string "tproxy" "redirect" +# fi +# else test -n "$ss_sockopt_tcp_fast_open" && \ json_add_boolean "tcpFastOpen" "$ss_sockopt_tcp_fast_open" test -n "$ss_sockopt_tproxy" && \ json_add_string "tproxy" "$ss_sockopt_tproxy" - fi +# fi json_close_object # sockopt @@ -2082,10 +2086,11 @@ rules_up() { config_get enabled main enabled "0" [ "$enabled" = "0" ] && return logger -t "V2Ray" "Rules UP" + #local bin="/usr/bin/v2ray-rules" [ -x "$bin" ] && { "$bin" >/dev/null 2>&1 } - local bin6="/usr/bin/v2ray-rules6" + #local bin6="/usr/bin/v2ray-rules6" [ -x "$bin6" ] && { "$bin6" >/dev/null 2>&1 } @@ -2122,6 +2127,7 @@ start_service() { setup_transparent_proxy gracefully_restart_dnsmasq + rules_up unset OUTBOUND_SERVERS_V4 \ OUTBOUND_SERVERS_V6 \ @@ -2138,8 +2144,8 @@ stop_service() { fi clear_transparent_proxy + rules_down gracefully_restart_dnsmasq - test -d "$CONFIG_FOLDER" && rm -rf "$CONFIG_FOLDER" } diff --git a/v2ray-core/files/etc/uci-defaults/3010-omr-v2ray b/v2ray-core/files/etc/uci-defaults/3010-omr-v2ray index 4f2df8b5d..4077ab0eb 100644 --- a/v2ray-core/files/etc/uci-defaults/3010-omr-v2ray +++ b/v2ray-core/files/etc/uci-defaults/3010-omr-v2ray @@ -12,6 +12,7 @@ if [ -z "$(uci -q get v2ray.main)" ]; then set v2ray.main.enabled='0' set v2ray.main.outbounds='omrout' set v2ray.main.inbounds='omr' + add_list v2ray.main.inbounds='omr6' add_list v2ray.main.inbounds='omrtest' set v2ray.main_dns=dns set v2ray.main_dns.hosts='example.com|127.0.0.1' @@ -62,7 +63,7 @@ if [ -z "$(uci -q get v2ray.main)" ]; then set v2ray.omrout.mux_concurrency='8' set v2ray.omr=inbound set v2ray.omr.alias='V2RayServer' - set v2ray.omr.listen='::' + set v2ray.omr.listen='0.0.0.0' set v2ray.omr.port='1897' set v2ray.omr.protocol='dokodemo-door' set v2ray.omr.s_dokodemo_door_network='tcp' @@ -70,6 +71,16 @@ if [ -z "$(uci -q get v2ray.main)" ]; then set v2ray.omr.ss_sockopt_tproxy='redirect' set v2ray.omr.ss_sockopt_tcp_fast_open='1' set v2ray.omr.s_dokodemo_door_follow_redirect='1' + set v2ray.omr6=inbound + set v2ray.omr6.alias='V2RayServer' + set v2ray.omr6.listen='::' + set v2ray.omr6.port='1898' + set v2ray.omr6.protocol='dokodemo-door' + set v2ray.omr6.s_dokodemo_door_network='tcp' + add_list v2ray.omr6.s_dokodemo_door_network='udp' + set v2ray.omr6.ss_sockopt_tproxy='tproxy' + set v2ray.omr6.ss_sockopt_tcp_fast_open='1' + set v2ray.omr6.s_dokodemo_door_follow_redirect='1' set v2ray.omrtest=inbound set v2ray.omrtest.port='1111' set v2ray.omrtest.protocol='socks' diff --git a/v2ray-core/files/usr/bin/v2ray-rules6 b/v2ray-core/files/usr/bin/v2ray-rules6 new file mode 100755 index 000000000..04be0086d --- /dev/null +++ b/v2ray-core/files/usr/bin/v2ray-rules6 @@ -0,0 +1,281 @@ +#!/bin/sh -e +# +# Copyright (C) 2017 Yousong Zhou +# Copyright (C) 2018-2020 Ycarus (Yannick Chabanois) +# +# The design idea was derived from ss-rules by Jian Chang +# +# This is free software, licensed under the GNU General Public License v3. +# See /LICENSE for more information. +# + +v2ray_rules6_usage() { + cat >&2 < Local port number of ss-redir with TCP mode + -L Local port number of ss-redir with UDP mode + -s List of ip addresses of remote shadowsocks server + --ifnames Only apply rules on packets from these ifnames + --src-bypass + --src-forward + --src-checkdst + --src-default + Packets will have their src ip checked in order against + bypass, forward, checkdst list and will bypass, forward + through, or continue to have their dst ip checked + respectively on the first match. Otherwise, --src-default + decide the default action + --dst-bypass + --dst-forward + --dst-bypass-file + --dst-forward-file + --dst-default + Same as with their --src-xx equivalent + --dst-forward-recentrst + Forward those packets whose destinations have recently + sent to us multiple tcp-rst packets + --local-default + Default action for local out TCP traffic + +The following ipsets will be created by ss-rules. They are also intended to be +populated by other programs like dnsmasq with ipset support + + v2ray_rules6_src_bypass + v2ray_rules6_src_forward + v2ray_rules6_src_checkdst + v2ray_rules6_dst_bypass + v2ray_rules6_dst_forward +EOF +} + +o_dst_bypass_=" + fe80::/10 + fd00::/8 + ::1 +" +o_src_default=bypass +o_dst_default=bypass +o_local_default=bypass + +__errmsg() { + echo "ss-rules6: $*" >&2 +} + +v2ray_rules6_parse_args() { + while [ "$#" -gt 0 ]; do + case "$1" in + -h|--help) v2ray_rules6_usage; exit 0;; + -f|--flush) v2ray_rules6_flush; exit 0;; + -l) o_redir_tcp_port="$2"; shift 2;; + -L) o_redir_udp_port="$2"; shift 2;; + -s) o_remote_servers="$2"; shift 2;; + --ifnames) o_ifnames="$2"; shift 2;; + --ipt-extra) o_ipt_extra="$2"; shift 2;; + --src-default) o_src_default="$2"; shift 2;; + --dst-default) o_dst_default="$2"; shift 2;; + --local-default) o_local_default="$2"; shift 2;; + --src-bypass) o_src_bypass="$2"; shift 2;; + --src-forward) o_src_forward="$2"; shift 2;; + --src-checkdst) o_src_checkdst="$2"; shift 2;; + --dst-bypass) o_dst_bypass="$2"; shift 2;; + --dst-bypass_all) o_dst_bypass_all="$2"; shift 2;; + --dst-forward) o_dst_forward="$2"; shift 2;; + --dst-forward-recentrst) o_dst_forward_recentrst=1; shift 1;; + --dst-bypass-file) o_dst_bypass_file="$2"; shift 2;; + --dst-forward-file) o_dst_forward_file="$2"; shift 2;; + --rule-name) rule="$2"; shift 2;; + *) __errmsg "unknown option $1"; return 1;; + esac + done + + if [ -z "$o_redir_tcp_port" -a -z "$o_redir_udp_port" ]; then + __errmsg "Requires at least -l or -L option" + return 1 + fi + if [ -n "$o_dst_forward_recentrst" ] && ! ip6tables -m recent -h >/dev/null; then + __errmsg "Please install ip6tables-mod-conntrack-extra with opkg" + return 1 + fi + o_remote_servers="$(for s in $o_remote_servers; do resolveip -6 "$s"; done)" +} + +v2ray_rules6_flush() { + local setname + + ip6tables-save --counters | grep -v v2r6_ | ip6tables-restore -w --counters + while ip -f inet6 rule del fwmark 1 lookup 100 2>/dev/null; do true; done + ip -f inet6 route flush table 100 || true + for setname in $(ipset -n list | grep "ss_rules6_"); do + ipset destroy "$setname" 2>/dev/null || true + done +} + +v2ray_rules6_ipset_init() { + ipset --exist restore <<-EOF + create ss_rules6_src_bypass hash:net family inet6 hashsize 64 + create ss_rules6_src_forward hash:net family inet6 hashsize 64 + create ss_rules6_src_checkdst hash:net family inet6 hashsize 64 + create ss_rules6_dst_bypass hash:net family inet6 hashsize 64 + create ss_rules6_dst_bypass_all hash:net family inet6 hashsize 64 + create ss_rules6_dst_bypass_ hash:net family inet6 hashsize 64 + create ss_rules6_dst_forward hash:net family inet6 hashsize 64 + create ss_rules6_dst_forward_recrst_ hash:ip family inet6 hashsize 64 timeout 3600 + $(v2ray_rules6_ipset_mkadd ss_rules6_dst_bypass_ "$o_dst_bypass_ $o_remote_servers") + $(v2ray_rules6_ipset_mkadd ss_rules6_dst_bypass_all "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}')") + $(v2ray_rules6_ipset_mkadd ss_rules6_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}')") + $(v2ray_rules6_ipset_mkadd ss_rules6_src_bypass "$o_src_bypass") + $(v2ray_rules6_ipset_mkadd ss_rules6_src_forward "$o_src_forward") + $(v2ray_rules6_ipset_mkadd ss_rules6_src_checkdst "$o_src_checkdst") + $(v2ray_rules6_ipset_mkadd ss_rules6_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}')") + EOF +} + +v2ray_rules6_ipset_mkadd() { + local setname="$1"; shift + local i + + for i in $*; do + echo "add $setname $i" + done +} + +v2ray_rules6_iptchains_init() { + v2ray_rules6_iptchains_init_mark + v2ray_rules6_iptchains_init_tcp + v2ray_rules6_iptchains_init_udp +} + +v2ray_rules6_iptchains_init_mark() { + ip6tables-restore -w --noflush <<-EOF + *mangle + -A PREROUTING -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x6539 + COMMIT + EOF +} + + +v2ray_rules6_iptchains_init_tcp() { + local local_target + + [ -n "$o_redir_tcp_port" ] || return 0 + + #v2ray_rules6_iptchains_init_ nat tcp + v2ray_rules6_iptchains_init_ mangle tcp + + case "$o_local_default" in + checkdst) local_target=v2r6_${rule}_dst ;; + forward) local_target=v2r6_${rule}_forward ;; + bypass|*) return 0;; + esac + +# echo "tcp mangle" +# ip6tables-restore -w --noflush <<-EOF +# *mangle +# :v2r6_${rule}_local_out - +# -I OUTPUT 1 -p tcp -j v2r6_${rule}_local_out +# -A v2r6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass dst -j RETURN +# -A v2r6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN +# -A v2r6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN +# -A v2r6_${rule}_local_out -m mark --mark 0x6539 -j RETURN +# -A v2r6_${rule}_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default" +# COMMIT +# EOF +# echo "done" +} + +v2ray_rules6_iptchains_init_udp() { + [ -n "$o_redir_udp_port" ] || return 0 + echo "v2ray udp" + v2ray_rules6_iptchains_init_ mangle udp +} + +v2ray_rules6_iptchains_init_() { + local table="$1" + local proto="$2" + local forward_rules + local src_default_target dst_default_target + local recentrst_mangle_rules recentrst_addset_rules + + case "$proto" in + tcp) + #forward_rules="-A v2r6_${rule}_forward -p tcp -j REDIRECT --to-ports $o_redir_tcp_port" + forward_rules="-A v2r6_${rule}_forward -p tcp -j TPROXY --on-port $o_redir_tcp_port --tproxy-mark 0x01/0x01" + if [ -n "$o_dst_forward_recentrst" ]; then + recentrst_mangle_rules=" + *mangle + -I PREROUTING 1 -p tcp -m tcp --tcp-flags RST RST -m recent --name ss_rules6_recentrst --set --rsource + COMMIT + " + recentrst_addset_rules=" + -A v2r6_${rule}_dst -m recent --name ss_rules6_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules6_dst_forward_recrst_ dst --exist + -A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_forward_recrst_ dst -j v2r6_${rule}_forward + " + fi + ;; + udp) + ip -f inet6 rule add fwmark 1 lookup 100 + ip -f inet6 route add local default dev lo table 100 + forward_rules=" + -A v2r6_${rule}_forward -p udp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01 + -A v2r6_${rule}_forward -p tcp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01 + " + ;; + esac + case "$o_src_default" in + forward) src_default_target=v2r6_${rule}_forward ;; + checkdst) src_default_target=v2r6_${rule}_dst ;; + bypass|*) src_default_target=RETURN ;; + esac + case "$o_dst_default" in + forward) dst_default_target=v2r6_${rule}_forward ;; + bypass|*) dst_default_target=RETURN ;; + esac + sed -e '/^\s*$/d' -e 's/^\s\+//' <<-EOF | ip6tables-restore -w --noflush + *$table + :v2r6_${rule}_pre_src - + :v2r6_${rule}_src - + :v2r6_${rule}_dst - + :v2r6_${rule}_forward - + $(v2ray_rules6_iptchains_mkprerules "udp") + $(v2ray_rules6_iptchains_mkprerules "tcp") + -A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN + -A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x6539 + -A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN + -A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass dst -j RETURN + -A v2r6_${rule}_pre_src -m mark --mark 0x6539 -j RETURN + -A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN + -A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_bypass dst -j RETURN + -A v2r6_${rule}_pre_src -p tcp $o_ipt_extra -j v2r6_${rule}_src + -A v2r6_${rule}_pre_src -p udp $o_ipt_extra -j v2r6_${rule}_src + -A v2r6_${rule}_src -m set --match-set ss_rules6_src_bypass src -j RETURN + -A v2r6_${rule}_src -m set --match-set ss_rules6_src_forward src -j v2r6_${rule}_forward + -A v2r6_${rule}_src -m set --match-set ss_rules6_src_checkdst src -j v2r6_${rule}_dst + -A v2r6_${rule}_src -j $src_default_target -m comment --comment "src_default: $o_src_default" + -A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_forward dst -j v2r6_${rule}_forward + $recentrst_addset_rules + -A v2r6_${rule}_dst -j $dst_default_target -m comment --comment "dst_default: $o_dst_default" + $forward_rules + COMMIT + $recentrst_mangle_rules + EOF +} + +v2ray_rules6_iptchains_mkprerules() { + local proto="$1" + + if [ -z "$o_ifnames" ]; then + echo "-I PREROUTING 1 -p $proto -j v2r6_${rule}_pre_src" + else + echo $o_ifnames \ + | tr ' ' '\n' \ + | sed "s/.*/-I PREROUTING 1 -i \\0 -p $proto -j v2r6_${rule}_pre_src/" + fi +} + +v2ray_rules6_parse_args "$@" +v2ray_rules6_flush +v2ray_rules6_ipset_init +v2ray_rules6_iptchains_init