net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="/usr/bin/ip -4"
   4 IP6="/usr/bin/ip -6"
   5 IPS="/usr/sbin/ipset"
   6 IPT4="/usr/sbin/iptables -t mangle -w"
   7 IPT6="/usr/sbin/ip6tables -t mangle -w"
   8 LOG="/usr/bin/logger -t mwan3 -p"
   9 CONNTRACK_FILE="/proc/net/nf_conntrack"
  10
  11 mwan3_get_iface_id()
  12 {
  13         local _tmp _iface _iface_count
  14
  15         _iface="$2"
  16
  17         mwan3_get_id()
  18         {
  19                 let _iface_count++
  20                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  21         }
  22         config_foreach mwan3_get_id interface
  23         export "$1=$_tmp"
  24 }
  25
  26 mwan3_set_connected_iptables()
  27 {
  28         local connected_network_v4 connected_network_v6
  29
  30         $IPS -! create mwan3_connected_v4 hash:net
  31         $IPS create mwan3_connected_v4_temp hash:net
  32
  33         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  34                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  35         done
  36
  37         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  38                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  39         done
  40
  41         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
  42
  43         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
  44         $IPS destroy mwan3_connected_v4_temp
  45
  46         $IPS -! create mwan3_connected_v6 hash:net family inet6
  47         $IPS create mwan3_connected_v6_temp hash:net family inet6
  48
  49         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
  50                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
  51         done
  52
  53         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
  54         $IPS destroy mwan3_connected_v6_temp
  55
  56         $IPS -! create mwan3_connected list:set
  57         $IPS -! add mwan3_connected mwan3_connected_v4
  58         $IPS -! add mwan3_connected mwan3_connected_v6
  59 }
  60
  61 mwan3_set_general_rules()
  62 {
  63         local IP
  64
  65         for IP in "$IP4" "$IP6"; do
  66
  67                 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
  68                         $IP rule add pref 2253 fwmark 0xfd00/0xff00 blackhole
  69                 fi
  70
  71                 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
  72                         $IP rule add pref 2254 fwmark 0xfe00/0xff00 unreachable
  73                 fi
  74         done
  75 }
  76
  77 mwan3_set_general_iptables()
  78 {
  79         local IPT
  80
  81         for IPT in "$IPT4" "$IPT6"; do
  82
  83                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
  84                         $IPT -N mwan3_ifaces_in
  85                 fi
  86
  87                 if ! $IPT -S mwan3_connected &> /dev/null; then
  88                         $IPT -N mwan3_connected
  89                         $IPS -! create mwan3_connected list:set
  90                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0xff00/0xff00
  91                 fi
  92
  93                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
  94                         $IPT -N mwan3_ifaces_out
  95                 fi
  96
  97                 if ! $IPT -S mwan3_rules &> /dev/null; then
  98                         $IPT -N mwan3_rules
  99                 fi
 100
 101                 if ! $IPT -S mwan3_hook &> /dev/null; then
 102                         $IPT -N mwan3_hook
 103                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask 0xff00 --ctmask 0xff00
 104                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_in
 105                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_connected
 106                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_out
 107                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_rules
 108                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
 109                         $IPT -A mwan3_hook -m mark ! --mark 0xff00/0xff00 -j mwan3_connected
 110                 fi
 111
 112                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 113                         $IPT -A PREROUTING -j mwan3_hook
 114                 fi
 115
 116                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 117                         $IPT -A OUTPUT -j mwan3_hook
 118                 fi
 119         done
 120 }
 121
 122 mwan3_create_iface_iptables()
 123 {
 124         local id family src_ip src_ipv6
 125
 126         config_get family $1 family ipv4
 127         mwan3_get_iface_id id $1
 128
 129         [ -n "$id" ] || return 0
 130
 131         if [ "$family" == "ipv4" ]; then
 132
 133                 ubus call network.interface.${1}_4 status &>/dev/null
 134                 if [ "$?" -eq "0" ]; then
 135                         network_get_ipaddr src_ip ${1}_4
 136                 else
 137                         network_get_ipaddr src_ip $1
 138                 fi
 139
 140                 $IPS -! create mwan3_connected list:set
 141
 142                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 143                         $IPT4 -N mwan3_ifaces_in
 144                 fi
 145
 146                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 147                         $IPT4 -N mwan3_ifaces_out
 148                 fi
 149
 150                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 151                         $IPT4 -N mwan3_iface_in_$1
 152                 fi
 153
 154                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 155                         $IPT4 -N mwan3_iface_out_$1
 156                 fi
 157
 158                 $IPT4 -F mwan3_iface_in_$1
 159                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 160                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 161
 162                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 163                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 164
 165                 $IPT4 -F mwan3_iface_out_$1
 166                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 167
 168                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 169                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 170         fi
 171
 172         if [ "$family" == "ipv6" ]; then
 173
 174                 ubus call network.interface.${1}_6 status &>/dev/null
 175                 if [ "$?" -eq "0" ]; then
 176                         network_get_ipaddr6 src_ipv6 ${1}_6
 177                 else
 178                         network_get_ipaddr6 src_ipv6 $1
 179                 fi
 180
 181                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 182
 183                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 184                         $IPT6 -N mwan3_ifaces_in
 185                 fi
 186
 187                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 188                         $IPT6 -N mwan3_ifaces_out
 189                 fi
 190
 191                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 192                         $IPT6 -N mwan3_iface_in_$1
 193                 fi
 194
 195                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 196                         $IPT6 -N mwan3_iface_out_$1
 197                 fi
 198
 199                 $IPT6 -F mwan3_iface_in_$1
 200                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 201                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 202
 203                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 204                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 205
 206                 $IPT6 -F mwan3_iface_out_$1
 207                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 208
 209                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 210                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 211         fi
 212 }
 213
 214 mwan3_delete_iface_iptables()
 215 {
 216         config_get family $1 family ipv4
 217
 218         if [ "$family" == "ipv4" ]; then
 219
 220                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 221                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 222                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 223
 224                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 225                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 226                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 227         fi
 228
 229         if [ "$family" == "ipv6" ]; then
 230
 231                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 232                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 233                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 234
 235                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 236                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 237                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 238         fi
 239 }
 240
 241 mwan3_create_iface_route()
 242 {
 243         local id route_args
 244
 245         config_get family $1 family ipv4
 246         mwan3_get_iface_id id $1
 247
 248         [ -n "$id" ] || return 0
 249
 250         if [ "$family" == "ipv4" ]; then
 251                 ubus call network.interface.${1}_4 status &>/dev/null
 252                 if [ "$?" -eq "0" ]; then
 253                         network_get_gateway route_args ${1}_4
 254                 else
 255                         network_get_gateway route_args $1
 256                 fi
 257
 258                 route_args="via $route_args dev $2"
 259
 260                 $IP4 route flush table $id
 261                 $IP4 route add table $id default $route_args
 262         fi
 263
 264         if [ "$family" == "ipv6" ]; then
 265
 266                 ubus call network.interface.${1}_6 status &>/dev/null
 267                 if [ "$?" -eq "0" ]; then
 268                         network_get_gateway6 route_args ${1}_6
 269                 else
 270                         network_get_gateway6 route_args $1
 271                 fi
 272
 273                 route_args="via $route_args dev $2"
 274
 275                 $IP6 route flush table $id
 276                 $IP6 route add table $id default $route_args
 277         fi
 278 }
 279
 280 mwan3_delete_iface_route()
 281 {
 282         local id
 283
 284         config_get family $1 family ipv4
 285         mwan3_get_iface_id id $1
 286
 287         [ -n "$id" ] || return 0
 288
 289         if [ "$family" == "ipv4" ]; then
 290                 $IP4 route flush table $id
 291         fi
 292
 293         if [ "$family" == "ipv6" ]; then
 294                 $IP6 route flush table $id
 295         fi
 296 }
 297
 298 mwan3_create_iface_rules()
 299 {
 300         local id family
 301
 302         config_get family $1 family ipv4
 303         mwan3_get_iface_id id $1
 304
 305         [ -n "$id" ] || return 0
 306
 307         if [ "$family" == "ipv4" ]; then
 308
 309                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 310                         $IP4 rule del pref $(($id+1000))
 311                 done
 312
 313                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 314                         $IP4 rule del pref $(($id+2000))
 315                 done
 316
 317                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 318                 $IP4 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 319         fi
 320
 321         if [ "$family" == "ipv6" ]; then
 322
 323                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 324                         $IP6 rule del pref $(($id+1000))
 325                 done
 326
 327                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 328                         $IP6 rule del pref $(($id+2000))
 329                 done
 330
 331                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 332                 $IP6 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 333         fi
 334 }
 335
 336 mwan3_delete_iface_rules()
 337 {
 338         local id family
 339
 340         config_get family $1 family ipv4
 341         mwan3_get_iface_id id $1
 342
 343         [ -n "$id" ] || return 0
 344
 345         if [ "$family" == "ipv4" ]; then
 346
 347                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 348                         $IP4 rule del pref $(($id+1000))
 349                 done
 350
 351                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 352                         $IP4 rule del pref $(($id+2000))
 353                 done
 354         fi
 355
 356         if [ "$family" == "ipv6" ]; then
 357
 358                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 359                         $IP6 rule del pref $(($id+1000))
 360                 done
 361
 362                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 363                         $IP6 rule del pref $(($id+2000))
 364                 done
 365         fi
 366 }
 367
 368 mwan3_delete_iface_ipset_entries()
 369 {
 370         local id setname entry
 371
 372         mwan3_get_iface_id id $1
 373
 374         [ -n "$id" ] || return 0
 375
 376         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 377                 for entry in $(ipset list $setname | grep "$(echo $(($id*256)) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 378                         $IPS del $setname $entry
 379                 done
 380         done
 381 }
 382
 383 mwan3_track()
 384 {
 385         local track_ip track_ips reliability count timeout interval down up size
 386         local failure_interval recovery_interval
 387
 388         mwan3_list_track_ips()
 389         {
 390                 track_ips="$1 $track_ips"
 391         }
 392         config_list_foreach $1 track_ip mwan3_list_track_ips
 393
 394         if [ -e /var/run/mwan3track-$1.pid ] ; then
 395                 kill $(cat /var/run/mwan3track-$1.pid) &> /dev/null
 396         fi
 397
 398         if [ -n "$track_ips" ]; then
 399                 config_get reliability $1 reliability 1
 400                 config_get count $1 count 1
 401                 config_get timeout $1 timeout 4
 402                 config_get interval $1 interval 10
 403                 config_get failure_interval $1 failure_interval $interval
 404                 config_get recovery_interval $1 recovery_interval $interval
 405                 config_get down $1 down 5
 406                 config_get up $1 up 5
 407                 config_get size $1 size 56
 408
 409                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track $1 $2 $reliability $count $timeout $interval $down $up $size $failure_interval $recovery_interval $track_ips &
 410         fi
 411 }
 412
 413 mwan3_set_policy()
 414 {
 415         local iface_count id iface family metric probability weight
 416
 417         config_get iface $1 interface
 418         config_get metric $1 metric 1
 419         config_get weight $1 weight 1
 420
 421         [ -n "$iface" ] || return 0
 422
 423         mwan3_get_iface_id id $iface
 424
 425         [ -n "$id" ] || return 0
 426
 427         config_get family $iface family ipv4
 428
 429         if [ "$family" == "ipv4" ]; then
 430
 431                 if [ -n "$($IP4 route list table $id)" ]; then
 432                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 433
 434                                 total_weight_v4=$weight
 435                                 $IPT4 -F mwan3_policy_$policy
 436                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 437
 438                                 lowest_metric_v4=$metric
 439
 440                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 441
 442                                 total_weight_v4=$(($total_weight_v4+$weight))
 443                                 probability=$(($weight*1000/$total_weight_v4))
 444
 445                                 if [ "$probability" -lt 10 ]; then
 446                                         probability="0.00$probability"
 447                                 elif [ $probability -lt 100 ]; then
 448                                         probability="0.0$probability"
 449                                 elif [ $probability -lt 1000 ]; then
 450                                         probability="0.$probability"
 451                                 else
 452                                         probability="1"
 453                                 fi
 454
 455                                 probability="-m statistic --mode random --probability $probability"
 456
 457                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(($id*256))/0xff00
 458                         fi
 459                 fi
 460         fi
 461
 462         if [ "$family" == "ipv6" ]; then
 463
 464                 if [ -n "$($IP6 route list table $id)" ]; then
 465                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 466
 467                                 total_weight_v6=$weight
 468                                 $IPT6 -F mwan3_policy_$policy
 469                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 470
 471                                 lowest_metric_v6=$metric
 472
 473                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 474
 475                                 total_weight_v6=$(($total_weight_v6+$weight))
 476                                 probability=$(($weight*1000/$total_weight_v6))
 477
 478                                 if [ "$probability" -lt 10 ]; then
 479                                         probability="0.00$probability"
 480                                 elif [ $probability -lt 100 ]; then
 481                                         probability="0.0$probability"
 482                                 elif [ $probability -lt 1000 ]; then
 483                                         probability="0.$probability"
 484                                 else
 485                                         probability="1"
 486                                 fi
 487
 488                                 probability="-m statistic --mode random --probability $probability"
 489
 490                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(($id*256))/0xff00
 491                         fi
 492                 fi
 493         fi
 494 }
 495
 496 mwan3_create_policies_iptables()
 497 {
 498         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 499
 500         policy="$1"
 501
 502         config_get last_resort $1 last_resort unreachable
 503
 504         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 505                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 506         fi
 507
 508         for IPT in "$IPT4" "$IPT6"; do
 509
 510                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 511                         $IPT -N mwan3_policy_$1
 512                 fi
 513
 514                 $IPT -F mwan3_policy_$1
 515
 516                 case "$last_resort" in
 517                         blackhole)
 518                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "blackhole" -j MARK --set-xmark 0xfd00/0xff00
 519                         ;;
 520                         default)
 521                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 522                         ;;
 523                         *)
 524                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "unreachable" -j MARK --set-xmark 0xfe00/0xff00
 525                         ;;
 526                 esac
 527         done
 528
 529         lowest_metric_v4=256
 530         total_weight_v4=0
 531
 532         lowest_metric_v6=256
 533         total_weight_v6=0
 534
 535         config_list_foreach $1 use_member mwan3_set_policy
 536 }
 537
 538 mwan3_set_policies_iptables()
 539 {
 540         config_foreach mwan3_create_policies_iptables policy
 541 }
 542
 543 mwan3_set_sticky_iptables()
 544 {
 545         local id iface
 546
 547         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 548
 549                 if [ "$iface" == "$1" ]; then
 550
 551                         mwan3_get_iface_id id $1
 552
 553                         [ -n "$id" ] || return 0
 554
 555                         for IPT in "$IPT4" "$IPT6"; do
 556                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 557                                         $IPT -I mwan3_rule_$rule -m mark --mark $(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/0xff00
 558                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/0xff00 -j MARK --set-xmark $(($id*256))/0xff00
 559                                 fi
 560                         done
 561                 fi
 562         done
 563 }
 564
 565 mwan3_set_user_iptables_rule()
 566 {
 567         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 568
 569         rule="$1"
 570
 571         config_get sticky $1 sticky 0
 572         config_get timeout $1 timeout 600
 573         config_get ipset $1 ipset
 574         config_get proto $1 proto all
 575         config_get src_ip $1 src_ip 0.0.0.0/0
 576         config_get src_port $1 src_port 0:65535
 577         config_get dest_ip $1 dest_ip 0.0.0.0/0
 578         config_get dest_port $1 dest_port 0:65535
 579         config_get use_policy $1 use_policy
 580         config_get family $1 family any
 581
 582         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 583                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 584         fi
 585
 586         if [ -n "$ipset" ]; then
 587                 ipset="-m set --match-set $ipset dst"
 588         fi
 589
 590         if [ -n "$use_policy" ]; then
 591                 if [ "$use_policy" == "default" ]; then
 592                         policy="MARK --set-xmark 0xff00/0xff00"
 593                 elif [ "$use_policy" == "unreachable" ]; then
 594                         policy="MARK --set-xmark 0xfe00/0xff00"
 595                 elif [ "$use_policy" == "blackhole" ]; then
 596                         policy="MARK --set-xmark 0xfd00/0xff00"
 597                 else
 598                         if [ "$sticky" -eq 1 ]; then
 599
 600                                 policy="mwan3_policy_$use_policy"
 601
 602                                 for IPT in "$IPT4" "$IPT6"; do
 603                                         if ! $IPT -S $policy &> /dev/null; then
 604                                                 $IPT -N $policy
 605                                         fi
 606
 607                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 608                                                 $IPT -N mwan3_rule_$1
 609                                         fi
 610
 611                                         $IPT -F mwan3_rule_$1
 612                                 done
 613
 614                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask 0xff00 timeout $timeout
 615                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask 0xff00 timeout $timeout family inet6
 616                                 $IPS -! create mwan3_sticky_$rule list:set
 617                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 618                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 619
 620                                 config_foreach mwan3_set_sticky_iptables interface
 621
 622                                 for IPT in "$IPT4" "$IPT6"; do
 623                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/0xff00 -j $policy
 624                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 625                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 626                                 done
 627
 628                                 policy="mwan3_rule_$1"
 629                         else
 630                                 policy="mwan3_policy_$use_policy"
 631
 632                                 for IPT in "$IPT4" "$IPT6"; do
 633                                         if ! $IPT -S $policy &> /dev/null; then
 634                                                 $IPT -N $policy
 635                                         fi
 636                                 done
 637
 638                         fi
 639                 fi
 640
 641                 if [ "$family" == "any" ]; then
 642
 643                         for IPT in "$IPT4" "$IPT6"; do
 644                                 case $proto in
 645                                         tcp|udp)
 646                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 647                                         ;;
 648                                         *)
 649                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 650                                         ;;
 651                                 esac
 652                         done
 653
 654                 elif [ "$family" == "ipv4" ]; then
 655
 656                         case $proto in
 657                                 tcp|udp)
 658                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 659                                 ;;
 660                                 *)
 661                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 662                                 ;;
 663                         esac
 664
 665                 elif [ "$family" == "ipv6" ]; then
 666
 667                         case $proto in
 668                                 tcp|udp)
 669                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 670                                 ;;
 671                                 *)
 672                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 673                                 ;;
 674                         esac
 675                 fi
 676         fi
 677 }
 678
 679 mwan3_set_user_rules()
 680 {
 681         local IPT
 682
 683         for IPT in "$IPT4" "$IPT6"; do
 684
 685                 if ! $IPT -S mwan3_rules &> /dev/null; then
 686                         $IPT -N mwan3_rules
 687                 fi
 688
 689                 $IPT -F mwan3_rules
 690         done
 691
 692         config_foreach mwan3_set_user_iptables_rule rule
 693 }
 694
 695 mwan3_report_iface_status()
 696 {
 697         local device result track_ips tracking IP IPT
 698
 699         mwan3_get_iface_id id $1
 700         network_get_device device $1
 701         config_get enabled "$1" enabled 0
 702         config_get family "$1" family ipv4
 703
 704         if [ "$family" == "ipv4" ]; then
 705                 IP="$IP4"
 706                 IPT="$IPT4"
 707         fi
 708
 709         if [ "$family" == "ipv6" ]; then
 710                 IP="$IP6"
 711                 IPT="$IPT6"
 712         fi
 713
 714         if [ -z "$id" -o -z "$device" ]; then
 715                 result="unknown"
 716         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 717                 result="online"
 718         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 719                 result="error"
 720         else
 721                 if [ "$enabled" == "1" ]; then
 722                         result="offline"
 723                 else
 724                         result="disabled"
 725                 fi
 726         fi
 727
 728         mwan3_list_track_ips()
 729         {
 730                 track_ips="$1 $track_ips"
 731         }
 732         config_list_foreach $1 track_ip mwan3_list_track_ips
 733
 734         if [ -n "$track_ips" ]; then
 735                 if [ -n "$(ps -w | grep mwan3track | grep -v grep | sed '/.*\/usr\/sbin\/mwan3track \([^ ]*\) .*$/!d;s//\1/' | awk '$1 == "'$1'"')" ]; then
 736                         tracking="active"
 737                 else
 738                         tracking="down"
 739                 fi
 740         else
 741                 tracking="not enabled"
 742         fi
 743
 744         echo " interface $1 is $result and tracking is $tracking"
 745 }
 746
 747 mwan3_report_policies_v4()
 748 {
 749         local percent policy share total_weight weight iface
 750
 751         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 752                 echo "$policy:" | sed 's/mwan3_policy_//'
 753
 754                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 755
 756                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 757                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 758                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 759                                 percent=$(($weight*100/$total_weight))
 760                                 echo " $iface ($percent%)"
 761                         done
 762                 else
 763                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 764                 fi
 765
 766                 unset total_weight
 767
 768                 echo -e
 769         done
 770 }
 771
 772 mwan3_report_policies_v6()
 773 {
 774         local percent policy share total_weight weight iface
 775
 776         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 777                 echo "$policy:" | sed 's/mwan3_policy_//'
 778
 779                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 780
 781                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 782                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 783                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 784                                 percent=$(($weight*100/$total_weight))
 785                                 echo " $iface ($percent%)"
 786                         done
 787                 else
 788                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 789                 fi
 790
 791                 unset total_weight
 792
 793                 echo -e
 794         done
 795 }
 796
 797 mwan3_report_connected_v4()
 798 {
 799         local address
 800
 801         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 802                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 803                         echo " $address"
 804                 done
 805         fi
 806 }
 807
 808 mwan3_report_connected_v6()
 809 {
 810         local address
 811
 812         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 813                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 814                         echo " $address"
 815                 done
 816         fi
 817 }
 818
 819 mwan3_report_rules_v4()
 820 {
 821         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 822                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 823         fi
 824 }
 825
 826 mwan3_report_rules_v6()
 827 {
 828         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 829                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 830         fi
 831 }
 832
 833 mwan3_flush_conntrack()
 834 {
 835         local flush_conntrack
 836
 837         config_get flush_conntrack $1 flush_conntrack never
 838
 839         if [ -e "$CONNTRACK_FILE" ]; then
 840                 case $flush_conntrack in
 841                         ifup)
 842                                 [ "$3" = "ifup" ] && {
 843                                         echo f > ${CONNTRACK_FILE}
 844                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 845                                 }
 846                                 ;;
 847                         ifdown)
 848                                 [ "$3" = "ifdown" ] && {
 849                                         echo f > ${CONNTRACK_FILE}
 850                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 851                                 }
 852                                 ;;
 853                         always)
 854                                 echo f > ${CONNTRACK_FILE}
 855                                 $LOG info "connection tracking flushed on interface $1 ($2) $3"
 856                                 ;;
 857                         never)
 858                                 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
 859                                 ;;
 860                 esac
 861         else
 862                 $LOG warning "connection tracking not enabled"
 863         fi
 864 }