net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="/usr/bin/ip -4"
   4 IP6="/usr/bin/ip -6"
   5 IPS="/usr/sbin/ipset"
   6 IPT4="/usr/sbin/iptables -t mangle -w"
   7 IPT6="/usr/sbin/ip6tables -t mangle -w"
   8 LOG="/usr/bin/logger -t mwan3 -p"
   9
  10 mwan3_get_iface_id()
  11 {
  12         local _tmp _iface _iface_count
  13
  14         _iface="$2"
  15
  16         mwan3_get_id()
  17         {
  18                 let _iface_count++
  19                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  20         }
  21         config_foreach mwan3_get_id interface
  22         export "$1=$_tmp"
  23 }
  24
  25 mwan3_set_connected_iptables()
  26 {
  27         local connected_network_v4 connected_network_v6
  28
  29         $IPS -! create mwan3_connected_v4 hash:net
  30         $IPS create mwan3_connected_v4_temp hash:net
  31
  32         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  33                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  34         done
  35
  36         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  37                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  38         done
  39
  40         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
  41
  42         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
  43         $IPS destroy mwan3_connected_v4_temp
  44
  45         $IPS -! create mwan3_connected_v6 hash:net family inet6
  46         $IPS create mwan3_connected_v6_temp hash:net family inet6
  47
  48         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
  49                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
  50         done
  51
  52         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
  53         $IPS destroy mwan3_connected_v6_temp
  54
  55         $IPS -! create mwan3_connected list:set
  56         $IPS -! add mwan3_connected mwan3_connected_v4
  57         $IPS -! add mwan3_connected mwan3_connected_v6
  58 }
  59
  60 mwan3_set_general_rules()
  61 {
  62         local IP
  63
  64         for IP in "$IP4" "$IP6"; do
  65
  66                 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
  67                         $IP rule add pref 2253 fwmark 0xfd00/0xff00 blackhole
  68                 fi
  69
  70                 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
  71                         $IP rule add pref 2254 fwmark 0xfe00/0xff00 unreachable
  72                 fi
  73         done
  74 }
  75
  76 mwan3_set_general_iptables()
  77 {
  78         local IPT
  79
  80         for IPT in "$IPT4" "$IPT6"; do
  81
  82                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
  83                         $IPT -N mwan3_ifaces_in
  84                 fi
  85
  86                 if ! $IPT -S mwan3_connected &> /dev/null; then
  87                         $IPT -N mwan3_connected
  88                         $IPS -! create mwan3_connected list:set
  89                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0xff00/0xff00
  90                 fi
  91
  92                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
  93                         $IPT -N mwan3_ifaces_out
  94                 fi
  95
  96                 if ! $IPT -S mwan3_rules &> /dev/null; then
  97                         $IPT -N mwan3_rules
  98                 fi
  99
 100                 if ! $IPT -S mwan3_hook &> /dev/null; then
 101                         $IPT -N mwan3_hook
 102                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask 0xff00 --ctmask 0xff00
 103                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_in
 104                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_connected
 105                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_out
 106                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_rules
 107                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
 108                         $IPT -A mwan3_hook -m mark ! --mark 0xff00/0xff00 -j mwan3_connected
 109                 fi
 110
 111                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 112                         $IPT -A PREROUTING -j mwan3_hook
 113                 fi
 114
 115                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 116                         $IPT -A OUTPUT -j mwan3_hook
 117                 fi
 118         done
 119 }
 120
 121 mwan3_create_iface_iptables()
 122 {
 123         local id family src_ip src_ipv6
 124
 125         config_get family $1 family ipv4
 126         mwan3_get_iface_id id $1
 127
 128         [ -n "$id" ] || return 0
 129
 130         if [ "$family" == "ipv4" ]; then
 131
 132                 network_get_ipaddr src_ip $1
 133
 134                 $IPS -! create mwan3_connected list:set
 135
 136                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 137                         $IPT4 -N mwan3_ifaces_in
 138                 fi
 139
 140                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 141                         $IPT4 -N mwan3_ifaces_out
 142                 fi
 143
 144                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 145                         $IPT4 -N mwan3_iface_in_$1
 146                 fi
 147
 148                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 149                         $IPT4 -N mwan3_iface_out_$1
 150                 fi
 151
 152                 $IPT4 -F mwan3_iface_in_$1
 153                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 154                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 155
 156                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 157                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 158
 159                 $IPT4 -F mwan3_iface_out_$1
 160                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 161
 162                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 163                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 164         fi
 165
 166         if [ "$family" == "ipv6" ]; then
 167
 168                 network_get_ipaddr6 src_ipv6 $1
 169
 170                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 171
 172                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 173                         $IPT6 -N mwan3_ifaces_in
 174                 fi
 175
 176                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 177                         $IPT6 -N mwan3_ifaces_out
 178                 fi
 179
 180                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 181                         $IPT6 -N mwan3_iface_in_$1
 182                 fi
 183
 184                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 185                         $IPT6 -N mwan3_iface_out_$1
 186                 fi
 187
 188                 $IPT6 -F mwan3_iface_in_$1
 189                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 190                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 191
 192                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 193                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 194
 195                 $IPT6 -F mwan3_iface_out_$1
 196                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 197
 198                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 199                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 200         fi
 201 }
 202
 203 mwan3_delete_iface_iptables()
 204 {
 205         config_get family $1 family ipv4
 206
 207         if [ "$family" == "ipv4" ]; then
 208
 209                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 210                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 211                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 212
 213                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 214                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 215                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 216         fi
 217
 218         if [ "$family" == "ipv6" ]; then
 219
 220                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 221                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 222                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 223
 224                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 225                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 226                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 227         fi
 228 }
 229
 230 mwan3_create_iface_route()
 231 {
 232         local id route_args
 233
 234         config_get family $1 family ipv4
 235         mwan3_get_iface_id id $1
 236
 237         [ -n "$id" ] || return 0
 238
 239         if [ "$family" == "ipv4" ]; then
 240
 241                 network_get_gateway route_args $1
 242                 route_args="via $route_args dev $2"
 243
 244                 $IP4 route flush table $id
 245                 $IP4 route add table $id default $route_args
 246         fi
 247
 248         if [ "$family" == "ipv6" ]; then
 249
 250                 network_get_gateway6 route_args $1
 251                 route_args="via $route_args dev $2"
 252
 253                 $IP6 route flush table $id
 254                 $IP6 route add table $id default $route_args
 255         fi
 256 }
 257
 258 mwan3_delete_iface_route()
 259 {
 260         local id
 261
 262         config_get family $1 family ipv4
 263         mwan3_get_iface_id id $1
 264
 265         [ -n "$id" ] || return 0
 266
 267         if [ "$family" == "ipv4" ]; then
 268                 $IP4 route flush table $id
 269         fi
 270
 271         if [ "$family" == "ipv6" ]; then
 272                 $IP6 route flush table $id
 273         fi
 274 }
 275
 276 mwan3_create_iface_rules()
 277 {
 278         local id family
 279
 280         config_get family $1 family ipv4
 281         mwan3_get_iface_id id $1
 282
 283         [ -n "$id" ] || return 0
 284
 285         if [ "$family" == "ipv4" ]; then
 286
 287                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 288                         $IP4 rule del pref $(($id+1000))
 289                 done
 290
 291                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 292                         $IP4 rule del pref $(($id+2000))
 293                 done
 294
 295                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 296                 $IP4 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 297         fi
 298
 299         if [ "$family" == "ipv6" ]; then
 300
 301                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 302                         $IP6 rule del pref $(($id+1000))
 303                 done
 304
 305                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 306                         $IP6 rule del pref $(($id+2000))
 307                 done
 308
 309                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 310                 $IP6 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 311         fi
 312 }
 313
 314 mwan3_delete_iface_rules()
 315 {
 316         local id family
 317
 318         config_get family $1 family ipv4
 319         mwan3_get_iface_id id $1
 320
 321         [ -n "$id" ] || return 0
 322
 323         if [ "$family" == "ipv4" ]; then
 324
 325                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 326                         $IP4 rule del pref $(($id+1000))
 327                 done
 328
 329                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 330                         $IP4 rule del pref $(($id+2000))
 331                 done
 332         fi
 333
 334         if [ "$family" == "ipv6" ]; then
 335
 336                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 337                         $IP6 rule del pref $(($id+1000))
 338                 done
 339
 340                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 341                         $IP6 rule del pref $(($id+2000))
 342                 done
 343         fi
 344 }
 345
 346 mwan3_delete_iface_ipset_entries()
 347 {
 348         local id setname entry
 349
 350         mwan3_get_iface_id id $1
 351
 352         [ -n "$id" ] || return 0
 353
 354         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 355                 for entry in $(ipset list $setname | grep "$(echo $(($id*256)) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 356                         $IPS del $setname $entry
 357                 done
 358         done
 359 }
 360
 361 mwan3_track()
 362 {
 363         local track_ip track_ips reliability count timeout interval down up
 364
 365         mwan3_list_track_ips()
 366         {
 367                 track_ips="$1 $track_ips"
 368         }
 369         config_list_foreach $1 track_ip mwan3_list_track_ips
 370
 371         if [ -e /var/run/mwan3track-$1.pid ] ; then
 372                 kill $(cat /var/run/mwan3track-$1.pid) &> /dev/null
 373                 rm /var/run/mwan3track-$1.pid &> /dev/null
 374         fi
 375
 376         if [ -n "$track_ips" ]; then
 377                 config_get reliability $1 reliability 1
 378                 config_get count $1 count 1
 379                 config_get timeout $1 timeout 4
 380                 config_get interval $1 interval 10
 381                 config_get down $1 down 5
 382                 config_get up $1 up 5
 383
 384                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track $1 $2 $reliability $count $timeout $interval $down $up $track_ips &
 385         fi
 386 }
 387
 388 mwan3_set_policy()
 389 {
 390         local iface_count id iface family metric probability weight
 391
 392         config_get iface $1 interface
 393         config_get metric $1 metric 1
 394         config_get weight $1 weight 1
 395
 396         [ -n "$iface" ] || return 0
 397
 398         mwan3_get_iface_id id $iface
 399
 400         [ -n "$id" ] || return 0
 401
 402         config_get family $iface family ipv4
 403
 404         if [ "$family" == "ipv4" ]; then
 405
 406                 if [ -n "$($IP4 route list table $id)" ]; then
 407                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 408
 409                                 total_weight_v4=$weight
 410                                 $IPT4 -F mwan3_policy_$policy
 411                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 412
 413                                 lowest_metric_v4=$metric
 414
 415                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 416
 417                                 total_weight_v4=$(($total_weight_v4+$weight))
 418                                 probability=$(($weight*1000/$total_weight_v4))
 419
 420                                 if [ "$probability" -lt 10 ]; then
 421                                         probability="0.00$probability"
 422                                 elif [ $probability -lt 100 ]; then
 423                                         probability="0.0$probability"
 424                                 elif [ $probability -lt 1000 ]; then
 425                                         probability="0.$probability"
 426                                 else
 427                                         probability="1"
 428                                 fi
 429
 430                                 probability="-m statistic --mode random --probability $probability"
 431
 432                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(($id*256))/0xff00
 433                         fi
 434                 fi
 435         fi
 436
 437         if [ "$family" == "ipv6" ]; then
 438
 439                 if [ -n "$($IP6 route list table $id)" ]; then
 440                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 441
 442                                 total_weight_v6=$weight
 443                                 $IPT6 -F mwan3_policy_$policy
 444                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 445
 446                                 lowest_metric_v6=$metric
 447
 448                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 449
 450                                 total_weight_v6=$(($total_weight_v6+$weight))
 451                                 probability=$(($weight*1000/$total_weight_v6))
 452
 453                                 if [ "$probability" -lt 10 ]; then
 454                                         probability="0.00$probability"
 455                                 elif [ $probability -lt 100 ]; then
 456                                         probability="0.0$probability"
 457                                 elif [ $probability -lt 1000 ]; then
 458                                         probability="0.$probability"
 459                                 else
 460                                         probability="1"
 461                                 fi
 462
 463                                 probability="-m statistic --mode random --probability $probability"
 464
 465                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(($id*256))/0xff00
 466                         fi
 467                 fi
 468         fi
 469 }
 470
 471 mwan3_create_policies_iptables()
 472 {
 473         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 474
 475         policy="$1"
 476
 477         config_get last_resort $1 last_resort unreachable
 478
 479         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 480                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 481         fi
 482
 483         for IPT in "$IPT4" "$IPT6"; do
 484
 485                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 486                         $IPT -N mwan3_policy_$1
 487                 fi
 488
 489                 $IPT -F mwan3_policy_$1
 490
 491                 case "$last_resort" in
 492                         blackhole)
 493                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "blackhole" -j MARK --set-xmark 0xfd00/0xff00
 494                         ;;
 495                         default)
 496                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 497                         ;;
 498                         *)
 499                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "unreachable" -j MARK --set-xmark 0xfe00/0xff00
 500                         ;;
 501                 esac
 502         done
 503
 504         lowest_metric_v4=256
 505         total_weight_v4=0
 506
 507         lowest_metric_v6=256
 508         total_weight_v6=0
 509
 510         config_list_foreach $1 use_member mwan3_set_policy
 511 }
 512
 513 mwan3_set_policies_iptables()
 514 {
 515         config_foreach mwan3_create_policies_iptables policy
 516 }
 517
 518 mwan3_set_sticky_iptables()
 519 {
 520         local id iface
 521
 522         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 523
 524                 if [ "$iface" == "$1" ]; then
 525
 526                         mwan3_get_iface_id id $1
 527
 528                         [ -n "$id" ] || return 0
 529
 530                         for IPT in "$IPT4" "$IPT6"; do
 531                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 532                                         $IPT -I mwan3_rule_$rule -m mark --mark $(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/0xff00
 533                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/0xff00 -j MARK --set-xmark $(($id*256))/0xff00
 534                                 fi
 535                         done
 536                 fi
 537         done
 538 }
 539
 540 mwan3_set_user_iptables_rule()
 541 {
 542         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 543
 544         rule="$1"
 545
 546         config_get sticky $1 sticky 0
 547         config_get timeout $1 timeout 600
 548         config_get ipset $1 ipset
 549         config_get proto $1 proto all
 550         config_get src_ip $1 src_ip 0.0.0.0/0
 551         config_get src_port $1 src_port 0:65535
 552         config_get dest_ip $1 dest_ip 0.0.0.0/0
 553         config_get dest_port $1 dest_port 0:65535
 554         config_get use_policy $1 use_policy
 555         config_get family $1 family any
 556
 557         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 558                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 559         fi
 560
 561         if [ -n "$ipset" ]; then
 562                 ipset="-m set --match-set $ipset dst"
 563         fi
 564
 565         if [ -n "$use_policy" ]; then
 566                 if [ "$use_policy" == "default" ]; then
 567                         policy="MARK --set-xmark 0xff00/0xff00"
 568                 elif [ "$use_policy" == "unreachable" ]; then
 569                         policy="MARK --set-xmark 0xfe00/0xff00"
 570                 elif [ "$use_policy" == "blackhole" ]; then
 571                         policy="MARK --set-xmark 0xfd00/0xff00"
 572                 else
 573                         if [ "$sticky" -eq 1 ]; then
 574
 575                                 policy="mwan3_policy_$use_policy"
 576
 577                                 for IPT in "$IPT4" "$IPT6"; do
 578                                         if ! $IPT -S $policy &> /dev/null; then
 579                                                 $IPT -N $policy
 580                                         fi
 581
 582                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 583                                                 $IPT -N mwan3_rule_$1
 584                                         fi
 585
 586                                         $IPT -F mwan3_rule_$1
 587                                 done
 588
 589                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask 0xff00 timeout $timeout
 590                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask 0xff00 timeout $timeout family inet6
 591                                 $IPS -! create mwan3_sticky_$rule list:set
 592                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 593                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 594
 595                                 config_foreach mwan3_set_sticky_iptables interface
 596
 597                                 for IPT in "$IPT4" "$IPT6"; do
 598                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/0xff00 -j $policy
 599                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 600                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 601                                 done
 602
 603                                 policy="mwan3_rule_$1"
 604                         else
 605                                 policy="mwan3_policy_$use_policy"
 606
 607                                 for IPT in "$IPT4" "$IPT6"; do
 608                                         if ! $IPT -S $policy &> /dev/null; then
 609                                                 $IPT -N $policy
 610                                         fi
 611                                 done
 612
 613                         fi
 614                 fi
 615
 616                 if [ "$family" == "any" ]; then
 617
 618                         for IPT in "$IPT4" "$IPT6"; do
 619                                 case $proto in
 620                                         tcp|udp)
 621                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 622                                         ;;
 623                                         *)
 624                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 625                                         ;;
 626                                 esac
 627                         done
 628
 629                 elif [ "$family" == "ipv4" ]; then
 630
 631                         case $proto in
 632                                 tcp|udp)
 633                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 634                                 ;;
 635                                 *)
 636                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 637                                 ;;
 638                         esac
 639
 640                 elif [ "$family" == "ipv6" ]; then
 641
 642                         case $proto in
 643                                 tcp|udp)
 644                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 645                                 ;;
 646                                 *)
 647                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 648                                 ;;
 649                         esac
 650                 fi
 651         fi
 652 }
 653
 654 mwan3_set_user_rules()
 655 {
 656         local IPT
 657
 658         for IPT in "$IPT4" "$IPT6"; do
 659
 660                 if ! $IPT -S mwan3_rules &> /dev/null; then
 661                         $IPT -N mwan3_rules
 662                 fi
 663
 664                 $IPT -F mwan3_rules
 665         done
 666
 667         config_foreach mwan3_set_user_iptables_rule rule
 668 }
 669
 670 mwan3_report_iface_status()
 671 {
 672         local device result track_ips tracking IP IPT
 673
 674         mwan3_get_iface_id id $1
 675         network_get_device device $1
 676         config_get enabled "$1" enabled 0
 677         config_get family "$1" family ipv4
 678
 679         if [ "$family" == "ipv4" ]; then
 680                 IP="$IP4"
 681                 IPT="$IPT4"
 682         fi
 683
 684         if [ "$family" == "ipv6" ]; then
 685                 IP="$IP6"
 686                 IPT="$IPT6"
 687         fi
 688
 689         if [ -z "$id" -o -z "$device" ]; then
 690                 result="unknown"
 691         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 692                 result="online"
 693         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 694                 result="error"
 695         else
 696                 if [ "$enabled" == "1" ]; then
 697                         result="offline"
 698                 else
 699                         result="disabled"
 700                 fi
 701         fi
 702
 703         mwan3_list_track_ips()
 704         {
 705                 track_ips="$1 $track_ips"
 706         }
 707         config_list_foreach $1 track_ip mwan3_list_track_ips
 708
 709         if [ -n "$track_ips" ]; then
 710                 if [ -n "$(ps -w | grep mwan3track | grep -v grep | sed '/.*\/usr\/sbin\/mwan3track \([^ ]*\) .*$/!d;s//\1/' | awk '$1 == "'$1'"')" ]; then
 711                         tracking="active"
 712                 else
 713                         tracking="down"
 714                 fi
 715         else
 716                 tracking="not enabled"
 717         fi
 718
 719         echo " interface $1 is $result and tracking is $tracking"
 720 }
 721
 722 mwan3_report_policies_v4()
 723 {
 724         local percent policy share total_weight weight iface
 725
 726         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 727                 echo "$policy:" | sed 's/mwan3_policy_//'
 728
 729                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 730
 731                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 732                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 733                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 734                                 percent=$(($weight*100/$total_weight))
 735                                 echo " $iface ($percent%)"
 736                         done
 737                 else
 738                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 739                 fi
 740
 741                 unset total_weight
 742
 743                 echo -e
 744         done
 745 }
 746
 747 mwan3_report_policies_v6()
 748 {
 749         local percent policy share total_weight weight iface
 750
 751         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 752                 echo "$policy:" | sed 's/mwan3_policy_//'
 753
 754                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 755
 756                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 757                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 758                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 759                                 percent=$(($weight*100/$total_weight))
 760                                 echo " $iface ($percent%)"
 761                         done
 762                 else
 763                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 764                 fi
 765
 766                 unset total_weight
 767
 768                 echo -e
 769         done
 770 }
 771
 772 mwan3_report_connected_v4()
 773 {
 774         local address
 775
 776         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 777                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 778                         echo " $address"
 779                 done
 780         fi
 781 }
 782
 783 mwan3_report_connected_v6()
 784 {
 785         local address
 786
 787         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 788                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 789                         echo " $address"
 790                 done
 791         fi
 792 }
 793
 794 mwan3_report_rules_v4()
 795 {
 796         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 797                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 798         fi
 799 }
 800
 801 mwan3_report_rules_v6()
 802 {
 803         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 804                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 805         fi
 806 }