mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-02-13 19:11:51 +00:00
253 lines
8.4 KiB
Bash
Executable file
253 lines
8.4 KiB
Bash
Executable file
#!/bin/sh /etc/rc.common
|
|
# Copyright (C) 2018 Ycarus (Yannick Chabanois) <ycarus@zugaina.org>
|
|
|
|
START=99
|
|
STOP=10
|
|
USE_PROCD=1
|
|
|
|
. /usr/lib/unbound/iptools.sh
|
|
|
|
_bypass_ip() {
|
|
local ip=$1
|
|
local type=$2
|
|
[ -z "$type" ] && type="all"
|
|
valid_ip4=$( valid_subnet4 $ip)
|
|
valid_ip6=$( valid_subnet6 $ip)
|
|
if [ "$valid_ip4" = "ok" ]; then
|
|
ipset -q add omr_rules_dst_bypass_$type $ip
|
|
elif [ "$valid_ip6" = "ok" ]; then
|
|
ipset -q add omr_rules6_dst_bypass_$type $ip
|
|
fi
|
|
}
|
|
|
|
_bypass_domain() {
|
|
local domain
|
|
local intf
|
|
config_get domain $1 name
|
|
config_get intf $1 interface
|
|
|
|
[ -z "$intf" ] && intf="all"
|
|
if [ -n "$domain" ]; then
|
|
#logger -t "omr-bypass" "Get IPs of $domain..."
|
|
if [ -z $BOOT ]; then
|
|
resolve=$(dig a +timeout=3 +nocmd +noall +answer $domain | awk '{print $5}')
|
|
for ip in $resolve; do
|
|
_bypass_ip $ip $intf
|
|
done
|
|
resolve=$(dig aaaa +timeout=3 +nocmd +noall +answer $domain | awk '{print $5}')
|
|
for ip in $resolve; do
|
|
_bypass_ip $ip $intf
|
|
done
|
|
fi
|
|
uci -q add_list dhcp.@dnsmasq[0].ipset="/$domain/omr_rules_dst_bypass_$intf,omr_rules6_dst_bypass_$intf"
|
|
#logger -t "omr-bypass" "Get IPs of $domain... Done"
|
|
fi
|
|
}
|
|
|
|
_bypass_proto() {
|
|
local proto
|
|
local intf
|
|
config_get proto $1 proto
|
|
config_get intf $1 interface
|
|
local intfid="$(uci -q get omr-bypass.$intf.id)"
|
|
|
|
[ -z "$intf" ] && intf="all"
|
|
[ -z "$proto" ] && return
|
|
if [ "$intf" = "all" ]; then
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
|
|
COMMIT
|
|
EOF
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x6539
|
|
COMMIT
|
|
EOF
|
|
else
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
|
|
COMMIT
|
|
EOF
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x6539$intfid
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
}
|
|
|
|
_intf_rule() {
|
|
local intf
|
|
config_get intf $1 ifname
|
|
count=$((count+1))
|
|
local mode
|
|
config_get mode $1 multipath "off"
|
|
[ "$mode" = "off" ] && return
|
|
[ "$(echo $1 | grep _dev)" != "" ] && return
|
|
ipset -q flush omr_rules_dst_bypass_$intf > /dev/null 2>&1
|
|
ipset -q flush omr_rules6_dst_bypass_$intf > /dev/null 2>&1
|
|
ipset -q --exist restore <<-EOF
|
|
create omr_rules_dst_bypass_$intf hash:net hashsize 64
|
|
create omr_rules6_dst_bypass_$intf hash:net family inet6 hashsize 64
|
|
EOF
|
|
ip rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
|
|
ip -6 rule add prio 1 fwmark 0x6539$count lookup 6$count > /dev/null 2>&1
|
|
if [ "$(iptables -w 40 -t mangle -L | grep omr_rules_dst_bypass_$intf)" = "" ]; then
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-I PREROUTING 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep omr_rules_dst_bypass_$intf)" = "" ]; then
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*nat
|
|
-I ss_rules_dst 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
|
-I ss_rules_local_out 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
|
-I ss_rules_local_out 2 -m mark --mark 0x539$count -j RETURN
|
|
-I ss_rules_pre_src 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
|
-I ss_rules_pre_src 2 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
|
-I ss_rules_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
if [ "$(ip6tables -w 40 -t mangle -L | grep omr_rules6_dst_bypass_$intf)" = "" ]; then
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-I PREROUTING 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x6539$count
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
if [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_pre_src)" != "" ] && [ "$(ip6tables -w 40 -t nat -L | grep omr_rules6_dst_bypass_$intf)" = "" ]; then
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*nat
|
|
-I ss_rules6_dst 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
|
-I ss_rules6_local_out 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
|
-I ss_rules6_local_out 2 -m mark --mark 0x539$count -j RETURN
|
|
-I ss_rules6_pre_src 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x6539$count
|
|
-I ss_rules6_pre_src 2 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
|
-I ss_rules6_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
uci -q set omr-bypass.$intf=interface
|
|
uci -q set omr-bypass.$intf.id=$count
|
|
}
|
|
|
|
_bypass_ip_set() {
|
|
local ip
|
|
local interface
|
|
config_get ip $1 ip
|
|
config_get interface $1 interface
|
|
_bypass_ip $ip $interface
|
|
}
|
|
|
|
boot() {
|
|
BOOT=1
|
|
start "$@"
|
|
}
|
|
|
|
start_service() {
|
|
local count
|
|
logger -t "omr-bypass" "Starting OMR-ByPass..."
|
|
ipset -q flush omr_rules_dst_bypass_all > /dev/null 2>&1
|
|
ipset -q flush omr_rules6_dst_bypass_all > /dev/null 2>&1
|
|
ipset -q --exist restore <<-EOF
|
|
create omr_rules_dst_bypass_all hash:net hashsize 64
|
|
create omr_rules6_dst_bypass_all hash:net family inet6 hashsize 64
|
|
EOF
|
|
|
|
config_load network
|
|
config_foreach _intf_rule interface
|
|
|
|
local ndpi_rules=""
|
|
config_load omr-bypass
|
|
config_foreach _bypass_ip_set ips
|
|
uci -q del dhcp.@dnsmasq[0].ipset
|
|
config_foreach _bypass_domain domains
|
|
uci -q commit dhcp
|
|
/etc/init.d/dnsmasq reload
|
|
|
|
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
|
ip -6 rule add prio 1 fwmark 0x6539 lookup 6991337 > /dev/null 2>&1
|
|
|
|
if [ "$(iptables -w 40 -t mangle -L | grep 'match-set omr_rules_dst_bypass_all dst MARK set')" = "" ]; then
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-A PREROUTING -m set --match-set omr_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep omr_rules_dst_bypass_all)" = "" ]; then
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*nat
|
|
-I ss_rules_dst 1 -m set --match-set omr_rules_dst_bypass_all dst -j RETURN
|
|
-I ss_rules_local_out 1 -m set --match-set omr_rules_dst_bypass_all dst -j RETURN
|
|
-I ss_rules_local_out 2 -m mark --mark 0x539 -j RETURN
|
|
-I ss_rules_pre_src 1 -m set --match-set omr_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
|
-I ss_rules_pre_src 2 -m set --match-set omr_rules_dst_bypass_all dst -j RETURN
|
|
-I ss_rules_pre_src 3 -m mark --mark 0x539 -j RETURN
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
if [ "$(ip6tables -w 40 -t mangle -L | grep 'match-set omr_rules6_dst_bypass_all dst MARK set')" = "" ]; then
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
-A PREROUTING -m set --match-set omr_rules6_dst_bypass_all dst -j MARK --set-mark 0x6539
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
if [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_pre_src)" != "" ] && [ "$(ip6tables -w 40 -t nat -L | grep omr_rules6_dst_bypass_all)" = "" ]; then
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*nat
|
|
-I ss_rules6_dst 1 -m set --match-set omr_rules6_dst_bypass_all dst -j RETURN
|
|
-I ss_rules6_local_out 1 -m set --match-set omr_rules6_dst_bypass_all dst -j RETURN
|
|
-I ss_rules6_local_out 2 -m mark --mark 0x6539 -j RETURN
|
|
-I ss_rules6_pre_src 1 -m set --match-set omr_rules6_dst_bypass_all dst -j MARK --set-mark 0x6539
|
|
-I ss_rules6_pre_src 2 -m set --match-set omr_rules6_dst_bypass_all dst -j RETURN
|
|
-I ss_rules6_pre_src 3 -m mark --mark 0x6539 -j RETURN
|
|
COMMIT
|
|
EOF
|
|
fi
|
|
|
|
iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters
|
|
iptables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
:omr-bypass-dpi -
|
|
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
|
-A POSTROUTING -m addrtype --dst-type LOCAL -j omr-bypass-dpi
|
|
COMMIT
|
|
EOF
|
|
ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters
|
|
ip6tables-restore --wait=60 --noflush <<-EOF
|
|
*mangle
|
|
:omr-bypass-dpi -
|
|
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
|
-A POSTROUTING -m addrtype --dst-type LOCAL -j omr-bypass-dpi
|
|
COMMIT
|
|
EOF
|
|
config_load omr-bypass
|
|
config_foreach _bypass_proto dpis
|
|
|
|
logger -t "omr-bypass" "OMR-ByPass is running"
|
|
}
|
|
|
|
stop() {
|
|
iptables-save --counters | grep -v omr-bypass | iptables-restore --counters
|
|
for setname in $(ipset -n list | grep "omr_"); do
|
|
ipset destroy "$setname" 2>/dev/null || true
|
|
done
|
|
}
|
|
|
|
service_triggers() {
|
|
PROCD_RELOAD_DELAY=1000
|
|
procd_add_reload_trigger omr-bypass
|
|
procd_add_raw_trigger "interface.*" 2000 /etc/init.d/omr-bypass restart
|
|
}
|
|
|
|
reload_service() {
|
|
[ "$(ipset -n list | grep omr_)" = "" ] && return 0
|
|
start
|
|
}
|