net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="/usr/bin/ip -4"
   4 IP6="/usr/bin/ip -6"
   5 IPS="/usr/sbin/ipset"
   6 IPT4="/usr/sbin/iptables -t mangle -w"
   7 IPT6="/usr/sbin/ip6tables -t mangle -w"
   8 LOG="/usr/bin/logger -t mwan3 -p"
   9 CONNTRACK_FILE="/proc/net/nf_conntrack"
  10
  11 mwan3_get_iface_id()
  12 {
  13         local _tmp _iface _iface_count
  14
  15         _iface="$2"
  16
  17         mwan3_get_id()
  18         {
  19                 let _iface_count++
  20                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  21         }
  22         config_foreach mwan3_get_id interface
  23         export "$1=$_tmp"
  24 }
  25
  26 mwan3_set_connected_iptables()
  27 {
  28         local connected_network_v4 connected_network_v6
  29
  30         $IPS -! create mwan3_connected_v4 hash:net
  31         $IPS create mwan3_connected_v4_temp hash:net
  32
  33         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  34                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  35         done
  36
  37         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  38                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  39         done
  40
  41         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
  42
  43         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
  44         $IPS destroy mwan3_connected_v4_temp
  45
  46         $IPS -! create mwan3_connected_v6 hash:net family inet6
  47         $IPS create mwan3_connected_v6_temp hash:net family inet6
  48
  49         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
  50                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
  51         done
  52
  53         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
  54         $IPS destroy mwan3_connected_v6_temp
  55
  56         $IPS -! create mwan3_connected list:set
  57         $IPS -! add mwan3_connected mwan3_connected_v4
  58         $IPS -! add mwan3_connected mwan3_connected_v6
  59 }
  60
  61 mwan3_set_general_rules()
  62 {
  63         local IP
  64
  65         for IP in "$IP4" "$IP6"; do
  66
  67                 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
  68                         $IP rule add pref 2253 fwmark 0xfd00/0xff00 blackhole
  69                 fi
  70
  71                 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
  72                         $IP rule add pref 2254 fwmark 0xfe00/0xff00 unreachable
  73                 fi
  74         done
  75 }
  76
  77 mwan3_set_general_iptables()
  78 {
  79         local IPT
  80
  81         for IPT in "$IPT4" "$IPT6"; do
  82
  83                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
  84                         $IPT -N mwan3_ifaces_in
  85                 fi
  86
  87                 if ! $IPT -S mwan3_connected &> /dev/null; then
  88                         $IPT -N mwan3_connected
  89                         $IPS -! create mwan3_connected list:set
  90                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0xff00/0xff00
  91                 fi
  92
  93                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
  94                         $IPT -N mwan3_ifaces_out
  95                 fi
  96
  97                 if ! $IPT -S mwan3_rules &> /dev/null; then
  98                         $IPT -N mwan3_rules
  99                 fi
 100
 101                 if ! $IPT -S mwan3_hook &> /dev/null; then
 102                         $IPT -N mwan3_hook
 103                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask 0xff00 --ctmask 0xff00
 104                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_in
 105                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_connected
 106                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_out
 107                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_rules
 108                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
 109                         $IPT -A mwan3_hook -m mark ! --mark 0xff00/0xff00 -j mwan3_connected
 110                 fi
 111
 112                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 113                         $IPT -A PREROUTING -j mwan3_hook
 114                 fi
 115
 116                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 117                         $IPT -A OUTPUT -j mwan3_hook
 118                 fi
 119         done
 120 }
 121
 122 mwan3_create_iface_iptables()
 123 {
 124         local id family src_ip src_ipv6
 125
 126         config_get family $1 family ipv4
 127         mwan3_get_iface_id id $1
 128
 129         [ -n "$id" ] || return 0
 130
 131         if [ "$family" == "ipv4" ]; then
 132
 133                 network_get_ipaddr src_ip $1
 134
 135                 $IPS -! create mwan3_connected list:set
 136
 137                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 138                         $IPT4 -N mwan3_ifaces_in
 139                 fi
 140
 141                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 142                         $IPT4 -N mwan3_ifaces_out
 143                 fi
 144
 145                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 146                         $IPT4 -N mwan3_iface_in_$1
 147                 fi
 148
 149                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 150                         $IPT4 -N mwan3_iface_out_$1
 151                 fi
 152
 153                 $IPT4 -F mwan3_iface_in_$1
 154                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 155                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 156
 157                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 158                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 159
 160                 $IPT4 -F mwan3_iface_out_$1
 161                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 162
 163                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 164                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 165         fi
 166
 167         if [ "$family" == "ipv6" ]; then
 168
 169                 network_get_ipaddr6 src_ipv6 $1
 170
 171                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 172
 173                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 174                         $IPT6 -N mwan3_ifaces_in
 175                 fi
 176
 177                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 178                         $IPT6 -N mwan3_ifaces_out
 179                 fi
 180
 181                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 182                         $IPT6 -N mwan3_iface_in_$1
 183                 fi
 184
 185                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 186                         $IPT6 -N mwan3_iface_out_$1
 187                 fi
 188
 189                 $IPT6 -F mwan3_iface_in_$1
 190                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 191                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 192
 193                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 194                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 195
 196                 $IPT6 -F mwan3_iface_out_$1
 197                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 198
 199                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 200                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 201         fi
 202 }
 203
 204 mwan3_delete_iface_iptables()
 205 {
 206         config_get family $1 family ipv4
 207
 208         if [ "$family" == "ipv4" ]; then
 209
 210                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 211                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 212                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 213
 214                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 215                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 216                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 217         fi
 218
 219         if [ "$family" == "ipv6" ]; then
 220
 221                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 222                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 223                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 224
 225                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 226                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 227                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 228         fi
 229 }
 230
 231 mwan3_create_iface_route()
 232 {
 233         local id route_args
 234
 235         config_get family $1 family ipv4
 236         mwan3_get_iface_id id $1
 237
 238         [ -n "$id" ] || return 0
 239
 240         if [ "$family" == "ipv4" ]; then
 241
 242                 network_get_gateway route_args $1
 243                 route_args="via $route_args dev $2"
 244
 245                 $IP4 route flush table $id
 246                 $IP4 route add table $id default $route_args
 247         fi
 248
 249         if [ "$family" == "ipv6" ]; then
 250
 251                 network_get_gateway6 route_args $1
 252                 route_args="via $route_args dev $2"
 253
 254                 $IP6 route flush table $id
 255                 $IP6 route add table $id default $route_args
 256         fi
 257 }
 258
 259 mwan3_delete_iface_route()
 260 {
 261         local id
 262
 263         config_get family $1 family ipv4
 264         mwan3_get_iface_id id $1
 265
 266         [ -n "$id" ] || return 0
 267
 268         if [ "$family" == "ipv4" ]; then
 269                 $IP4 route flush table $id
 270         fi
 271
 272         if [ "$family" == "ipv6" ]; then
 273                 $IP6 route flush table $id
 274         fi
 275 }
 276
 277 mwan3_create_iface_rules()
 278 {
 279         local id family
 280
 281         config_get family $1 family ipv4
 282         mwan3_get_iface_id id $1
 283
 284         [ -n "$id" ] || return 0
 285
 286         if [ "$family" == "ipv4" ]; then
 287
 288                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 289                         $IP4 rule del pref $(($id+1000))
 290                 done
 291
 292                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 293                         $IP4 rule del pref $(($id+2000))
 294                 done
 295
 296                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 297                 $IP4 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 298         fi
 299
 300         if [ "$family" == "ipv6" ]; then
 301
 302                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 303                         $IP6 rule del pref $(($id+1000))
 304                 done
 305
 306                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 307                         $IP6 rule del pref $(($id+2000))
 308                 done
 309
 310                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 311                 $IP6 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 312         fi
 313 }
 314
 315 mwan3_delete_iface_rules()
 316 {
 317         local id family
 318
 319         config_get family $1 family ipv4
 320         mwan3_get_iface_id id $1
 321
 322         [ -n "$id" ] || return 0
 323
 324         if [ "$family" == "ipv4" ]; then
 325
 326                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 327                         $IP4 rule del pref $(($id+1000))
 328                 done
 329
 330                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 331                         $IP4 rule del pref $(($id+2000))
 332                 done
 333         fi
 334
 335         if [ "$family" == "ipv6" ]; then
 336
 337                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 338                         $IP6 rule del pref $(($id+1000))
 339                 done
 340
 341                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 342                         $IP6 rule del pref $(($id+2000))
 343                 done
 344         fi
 345 }
 346
 347 mwan3_delete_iface_ipset_entries()
 348 {
 349         local id setname entry
 350
 351         mwan3_get_iface_id id $1
 352
 353         [ -n "$id" ] || return 0
 354
 355         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 356                 for entry in $(ipset list $setname | grep "$(echo $(($id*256)) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 357                         $IPS del $setname $entry
 358                 done
 359         done
 360 }
 361
 362 mwan3_track()
 363 {
 364         local track_ip track_ips reliability count timeout interval down up
 365
 366         mwan3_list_track_ips()
 367         {
 368                 track_ips="$1 $track_ips"
 369         }
 370         config_list_foreach $1 track_ip mwan3_list_track_ips
 371
 372         if [ -e /var/run/mwan3track-$1.pid ] ; then
 373                 kill $(cat /var/run/mwan3track-$1.pid) &> /dev/null
 374                 rm /var/run/mwan3track-$1.pid &> /dev/null
 375         fi
 376
 377         if [ -n "$track_ips" ]; then
 378                 config_get reliability $1 reliability 1
 379                 config_get count $1 count 1
 380                 config_get timeout $1 timeout 4
 381                 config_get interval $1 interval 10
 382                 config_get down $1 down 5
 383                 config_get up $1 up 5
 384
 385                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track $1 $2 $reliability $count $timeout $interval $down $up $track_ips &
 386         fi
 387 }
 388
 389 mwan3_set_policy()
 390 {
 391         local iface_count id iface family metric probability weight
 392
 393         config_get iface $1 interface
 394         config_get metric $1 metric 1
 395         config_get weight $1 weight 1
 396
 397         [ -n "$iface" ] || return 0
 398
 399         mwan3_get_iface_id id $iface
 400
 401         [ -n "$id" ] || return 0
 402
 403         config_get family $iface family ipv4
 404
 405         if [ "$family" == "ipv4" ]; then
 406
 407                 if [ -n "$($IP4 route list table $id)" ]; then
 408                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 409
 410                                 total_weight_v4=$weight
 411                                 $IPT4 -F mwan3_policy_$policy
 412                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 413
 414                                 lowest_metric_v4=$metric
 415
 416                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 417
 418                                 total_weight_v4=$(($total_weight_v4+$weight))
 419                                 probability=$(($weight*1000/$total_weight_v4))
 420
 421                                 if [ "$probability" -lt 10 ]; then
 422                                         probability="0.00$probability"
 423                                 elif [ $probability -lt 100 ]; then
 424                                         probability="0.0$probability"
 425                                 elif [ $probability -lt 1000 ]; then
 426                                         probability="0.$probability"
 427                                 else
 428                                         probability="1"
 429                                 fi
 430
 431                                 probability="-m statistic --mode random --probability $probability"
 432
 433                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(($id*256))/0xff00
 434                         fi
 435                 fi
 436         fi
 437
 438         if [ "$family" == "ipv6" ]; then
 439
 440                 if [ -n "$($IP6 route list table $id)" ]; then
 441                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 442
 443                                 total_weight_v6=$weight
 444                                 $IPT6 -F mwan3_policy_$policy
 445                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 446
 447                                 lowest_metric_v6=$metric
 448
 449                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 450
 451                                 total_weight_v6=$(($total_weight_v6+$weight))
 452                                 probability=$(($weight*1000/$total_weight_v6))
 453
 454                                 if [ "$probability" -lt 10 ]; then
 455                                         probability="0.00$probability"
 456                                 elif [ $probability -lt 100 ]; then
 457                                         probability="0.0$probability"
 458                                 elif [ $probability -lt 1000 ]; then
 459                                         probability="0.$probability"
 460                                 else
 461                                         probability="1"
 462                                 fi
 463
 464                                 probability="-m statistic --mode random --probability $probability"
 465
 466                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(($id*256))/0xff00
 467                         fi
 468                 fi
 469         fi
 470 }
 471
 472 mwan3_create_policies_iptables()
 473 {
 474         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 475
 476         policy="$1"
 477
 478         config_get last_resort $1 last_resort unreachable
 479
 480         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 481                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 482         fi
 483
 484         for IPT in "$IPT4" "$IPT6"; do
 485
 486                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 487                         $IPT -N mwan3_policy_$1
 488                 fi
 489
 490                 $IPT -F mwan3_policy_$1
 491
 492                 case "$last_resort" in
 493                         blackhole)
 494                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "blackhole" -j MARK --set-xmark 0xfd00/0xff00
 495                         ;;
 496                         default)
 497                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 498                         ;;
 499                         *)
 500                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "unreachable" -j MARK --set-xmark 0xfe00/0xff00
 501                         ;;
 502                 esac
 503         done
 504
 505         lowest_metric_v4=256
 506         total_weight_v4=0
 507
 508         lowest_metric_v6=256
 509         total_weight_v6=0
 510
 511         config_list_foreach $1 use_member mwan3_set_policy
 512 }
 513
 514 mwan3_set_policies_iptables()
 515 {
 516         config_foreach mwan3_create_policies_iptables policy
 517 }
 518
 519 mwan3_set_sticky_iptables()
 520 {
 521         local id iface
 522
 523         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 524
 525                 if [ "$iface" == "$1" ]; then
 526
 527                         mwan3_get_iface_id id $1
 528
 529                         [ -n "$id" ] || return 0
 530
 531                         for IPT in "$IPT4" "$IPT6"; do
 532                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 533                                         $IPT -I mwan3_rule_$rule -m mark --mark $(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/0xff00
 534                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/0xff00 -j MARK --set-xmark $(($id*256))/0xff00
 535                                 fi
 536                         done
 537                 fi
 538         done
 539 }
 540
 541 mwan3_set_user_iptables_rule()
 542 {
 543         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 544
 545         rule="$1"
 546
 547         config_get sticky $1 sticky 0
 548         config_get timeout $1 timeout 600
 549         config_get ipset $1 ipset
 550         config_get proto $1 proto all
 551         config_get src_ip $1 src_ip 0.0.0.0/0
 552         config_get src_port $1 src_port 0:65535
 553         config_get dest_ip $1 dest_ip 0.0.0.0/0
 554         config_get dest_port $1 dest_port 0:65535
 555         config_get use_policy $1 use_policy
 556         config_get family $1 family any
 557
 558         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 559                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 560         fi
 561
 562         if [ -n "$ipset" ]; then
 563                 ipset="-m set --match-set $ipset dst"
 564         fi
 565
 566         if [ -n "$use_policy" ]; then
 567                 if [ "$use_policy" == "default" ]; then
 568                         policy="MARK --set-xmark 0xff00/0xff00"
 569                 elif [ "$use_policy" == "unreachable" ]; then
 570                         policy="MARK --set-xmark 0xfe00/0xff00"
 571                 elif [ "$use_policy" == "blackhole" ]; then
 572                         policy="MARK --set-xmark 0xfd00/0xff00"
 573                 else
 574                         if [ "$sticky" -eq 1 ]; then
 575
 576                                 policy="mwan3_policy_$use_policy"
 577
 578                                 for IPT in "$IPT4" "$IPT6"; do
 579                                         if ! $IPT -S $policy &> /dev/null; then
 580                                                 $IPT -N $policy
 581                                         fi
 582
 583                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 584                                                 $IPT -N mwan3_rule_$1
 585                                         fi
 586
 587                                         $IPT -F mwan3_rule_$1
 588                                 done
 589
 590                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask 0xff00 timeout $timeout
 591                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask 0xff00 timeout $timeout family inet6
 592                                 $IPS -! create mwan3_sticky_$rule list:set
 593                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 594                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 595
 596                                 config_foreach mwan3_set_sticky_iptables interface
 597
 598                                 for IPT in "$IPT4" "$IPT6"; do
 599                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/0xff00 -j $policy
 600                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 601                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 602                                 done
 603
 604                                 policy="mwan3_rule_$1"
 605                         else
 606                                 policy="mwan3_policy_$use_policy"
 607
 608                                 for IPT in "$IPT4" "$IPT6"; do
 609                                         if ! $IPT -S $policy &> /dev/null; then
 610                                                 $IPT -N $policy
 611                                         fi
 612                                 done
 613
 614                         fi
 615                 fi
 616
 617                 if [ "$family" == "any" ]; then
 618
 619                         for IPT in "$IPT4" "$IPT6"; do
 620                                 case $proto in
 621                                         tcp|udp)
 622                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 623                                         ;;
 624                                         *)
 625                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 626                                         ;;
 627                                 esac
 628                         done
 629
 630                 elif [ "$family" == "ipv4" ]; then
 631
 632                         case $proto in
 633                                 tcp|udp)
 634                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 635                                 ;;
 636                                 *)
 637                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 638                                 ;;
 639                         esac
 640
 641                 elif [ "$family" == "ipv6" ]; then
 642
 643                         case $proto in
 644                                 tcp|udp)
 645                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 646                                 ;;
 647                                 *)
 648                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 649                                 ;;
 650                         esac
 651                 fi
 652         fi
 653 }
 654
 655 mwan3_set_user_rules()
 656 {
 657         local IPT
 658
 659         for IPT in "$IPT4" "$IPT6"; do
 660
 661                 if ! $IPT -S mwan3_rules &> /dev/null; then
 662                         $IPT -N mwan3_rules
 663                 fi
 664
 665                 $IPT -F mwan3_rules
 666         done
 667
 668         config_foreach mwan3_set_user_iptables_rule rule
 669 }
 670
 671 mwan3_report_iface_status()
 672 {
 673         local device result track_ips tracking IP IPT
 674
 675         mwan3_get_iface_id id $1
 676         network_get_device device $1
 677         config_get enabled "$1" enabled 0
 678         config_get family "$1" family ipv4
 679
 680         if [ "$family" == "ipv4" ]; then
 681                 IP="$IP4"
 682                 IPT="$IPT4"
 683         fi
 684
 685         if [ "$family" == "ipv6" ]; then
 686                 IP="$IP6"
 687                 IPT="$IPT6"
 688         fi
 689
 690         if [ -z "$id" -o -z "$device" ]; then
 691                 result="unknown"
 692         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 693                 result="online"
 694         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 695                 result="error"
 696         else
 697                 if [ "$enabled" == "1" ]; then
 698                         result="offline"
 699                 else
 700                         result="disabled"
 701                 fi
 702         fi
 703
 704         mwan3_list_track_ips()
 705         {
 706                 track_ips="$1 $track_ips"
 707         }
 708         config_list_foreach $1 track_ip mwan3_list_track_ips
 709
 710         if [ -n "$track_ips" ]; then
 711                 if [ -n "$(ps -w | grep mwan3track | grep -v grep | sed '/.*\/usr\/sbin\/mwan3track \([^ ]*\) .*$/!d;s//\1/' | awk '$1 == "'$1'"')" ]; then
 712                         tracking="active"
 713                 else
 714                         tracking="down"
 715                 fi
 716         else
 717                 tracking="not enabled"
 718         fi
 719
 720         echo " interface $1 is $result and tracking is $tracking"
 721 }
 722
 723 mwan3_report_policies_v4()
 724 {
 725         local percent policy share total_weight weight iface
 726
 727         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 728                 echo "$policy:" | sed 's/mwan3_policy_//'
 729
 730                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 731
 732                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 733                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 734                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 735                                 percent=$(($weight*100/$total_weight))
 736                                 echo " $iface ($percent%)"
 737                         done
 738                 else
 739                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 740                 fi
 741
 742                 unset total_weight
 743
 744                 echo -e
 745         done
 746 }
 747
 748 mwan3_report_policies_v6()
 749 {
 750         local percent policy share total_weight weight iface
 751
 752         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 753                 echo "$policy:" | sed 's/mwan3_policy_//'
 754
 755                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 756
 757                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 758                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 759                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 760                                 percent=$(($weight*100/$total_weight))
 761                                 echo " $iface ($percent%)"
 762                         done
 763                 else
 764                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 765                 fi
 766
 767                 unset total_weight
 768
 769                 echo -e
 770         done
 771 }
 772
 773 mwan3_report_connected_v4()
 774 {
 775         local address
 776
 777         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 778                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 779                         echo " $address"
 780                 done
 781         fi
 782 }
 783
 784 mwan3_report_connected_v6()
 785 {
 786         local address
 787
 788         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 789                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 790                         echo " $address"
 791                 done
 792         fi
 793 }
 794
 795 mwan3_report_rules_v4()
 796 {
 797         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 798                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 799         fi
 800 }
 801
 802 mwan3_report_rules_v6()
 803 {
 804         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 805                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 806         fi
 807 }
 808
 809 mwan3_flush_conntrack()
 810 {
 811         local flush_conntrack
 812
 813         config_get flush_conntrack $1 flush_conntrack never
 814
 815         if [ -e "$CONNTRACK_FILE" ]; then
 816                 case $flush_conntrack in
 817                         ifup)
 818                                 [ "$3" = "ifup" ] && {
 819                                         echo f > ${CONNTRACK_FILE}
 820                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 821                                 }
 822                                 ;;
 823                         ifdown)
 824                                 [ "$3" = "ifdown" ] && {
 825                                         echo f > ${CONNTRACK_FILE}
 826                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 827                                 }
 828                                 ;;
 829                         always)
 830                                 echo f > ${CONNTRACK_FILE}
 831                                 $LOG info "connection tracking flushed on interface $1 ($2) $3"
 832                                 ;;
 833                         never)
 834                                 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
 835                                 ;;
 836                 esac
 837         else
 838                 $LOG warning "connection tracking not enabled"
 839         fi
 840 }