net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="ip -4"
   4 IP6="ip -6"
   5 IPS="ipset"
   6 IPT4="iptables -t mangle -w"
   7 IPT6="ip6tables -t mangle -w"
   8 LOG="logger -t mwan3 -p"
   9 CONNTRACK_FILE="/proc/net/nf_conntrack"
  10
  11 mwan3_lock() {
  12         lock /var/run/mwan3.lock
  13 }
  14
  15 mwan3_unlock() {
  16         lock -u /var/run/mwan3.lock
  17 }
  18
  19 mwan3_get_iface_id()
  20 {
  21         local _tmp _iface _iface_count
  22
  23         _iface="$2"
  24
  25         mwan3_get_id()
  26         {
  27                 let _iface_count++
  28                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  29         }
  30         config_foreach mwan3_get_id interface
  31         export "$1=$_tmp"
  32 }
  33
  34 mwan3_set_connected_iptables()
  35 {
  36         local connected_network_v4 connected_network_v6
  37
  38         $IPS -! create mwan3_connected_v4 hash:net
  39         $IPS create mwan3_connected_v4_temp hash:net
  40
  41         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  42                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  43         done
  44
  45         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  46                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  47         done
  48
  49         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
  50
  51         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
  52         $IPS destroy mwan3_connected_v4_temp
  53
  54         $IPS -! create mwan3_connected_v6 hash:net family inet6
  55         $IPS create mwan3_connected_v6_temp hash:net family inet6
  56
  57         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
  58                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
  59         done
  60
  61         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
  62         $IPS destroy mwan3_connected_v6_temp
  63
  64         $IPS -! create mwan3_connected list:set
  65         $IPS -! add mwan3_connected mwan3_connected_v4
  66         $IPS -! add mwan3_connected mwan3_connected_v6
  67 }
  68
  69 mwan3_set_general_rules()
  70 {
  71         local IP
  72
  73         for IP in "$IP4" "$IP6"; do
  74
  75                 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
  76                         $IP rule add pref 2253 fwmark 0xfd00/0xff00 blackhole
  77                 fi
  78
  79                 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
  80                         $IP rule add pref 2254 fwmark 0xfe00/0xff00 unreachable
  81                 fi
  82         done
  83 }
  84
  85 mwan3_set_general_iptables()
  86 {
  87         local IPT
  88
  89         for IPT in "$IPT4" "$IPT6"; do
  90
  91                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
  92                         $IPT -N mwan3_ifaces_in
  93                 fi
  94
  95                 if ! $IPT -S mwan3_connected &> /dev/null; then
  96                         $IPT -N mwan3_connected
  97                         $IPS -! create mwan3_connected list:set
  98                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0xff00/0xff00
  99                 fi
 100
 101                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
 102                         $IPT -N mwan3_ifaces_out
 103                 fi
 104
 105                 if ! $IPT -S mwan3_rules &> /dev/null; then
 106                         $IPT -N mwan3_rules
 107                 fi
 108
 109                 if ! $IPT -S mwan3_hook &> /dev/null; then
 110                         $IPT -N mwan3_hook
 111                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask 0xff00 --ctmask 0xff00
 112                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_in
 113                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_connected
 114                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_out
 115                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_rules
 116                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
 117                         $IPT -A mwan3_hook -m mark ! --mark 0xff00/0xff00 -j mwan3_connected
 118                 fi
 119
 120                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 121                         $IPT -A PREROUTING -j mwan3_hook
 122                 fi
 123
 124                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 125                         $IPT -A OUTPUT -j mwan3_hook
 126                 fi
 127         done
 128 }
 129
 130 mwan3_create_iface_iptables()
 131 {
 132         local id family src_ip src_ipv6
 133
 134         config_get family $1 family ipv4
 135         mwan3_get_iface_id id $1
 136
 137         [ -n "$id" ] || return 0
 138
 139         if [ "$family" == "ipv4" ]; then
 140
 141                 ubus call network.interface.${1}_4 status &>/dev/null
 142                 if [ "$?" -eq "0" ]; then
 143                         network_get_ipaddr src_ip ${1}_4
 144                 else
 145                         network_get_ipaddr src_ip $1
 146                 fi
 147
 148                 $IPS -! create mwan3_connected list:set
 149
 150                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 151                         $IPT4 -N mwan3_ifaces_in
 152                 fi
 153
 154                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 155                         $IPT4 -N mwan3_ifaces_out
 156                 fi
 157
 158                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 159                         $IPT4 -N mwan3_iface_in_$1
 160                 fi
 161
 162                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 163                         $IPT4 -N mwan3_iface_out_$1
 164                 fi
 165
 166                 $IPT4 -F mwan3_iface_in_$1
 167                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 168                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 169
 170                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 171                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 172
 173                 $IPT4 -F mwan3_iface_out_$1
 174                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 175
 176                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 177                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 178         fi
 179
 180         if [ "$family" == "ipv6" ]; then
 181
 182                 ubus call network.interface.${1}_6 status &>/dev/null
 183                 if [ "$?" -eq "0" ]; then
 184                         network_get_ipaddr6 src_ipv6 ${1}_6
 185                 else
 186                         network_get_ipaddr6 src_ipv6 $1
 187                 fi
 188
 189                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 190
 191                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 192                         $IPT6 -N mwan3_ifaces_in
 193                 fi
 194
 195                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 196                         $IPT6 -N mwan3_ifaces_out
 197                 fi
 198
 199                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 200                         $IPT6 -N mwan3_iface_in_$1
 201                 fi
 202
 203                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 204                         $IPT6 -N mwan3_iface_out_$1
 205                 fi
 206
 207                 $IPT6 -F mwan3_iface_in_$1
 208                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 209                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 210
 211                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 212                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 213
 214                 $IPT6 -F mwan3_iface_out_$1
 215                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 216
 217                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 218                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 219         fi
 220 }
 221
 222 mwan3_delete_iface_iptables()
 223 {
 224         config_get family $1 family ipv4
 225
 226         if [ "$family" == "ipv4" ]; then
 227
 228                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 229                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 230                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 231
 232                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 233                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 234                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 235         fi
 236
 237         if [ "$family" == "ipv6" ]; then
 238
 239                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 240                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 241                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 242
 243                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 244                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 245                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 246         fi
 247 }
 248
 249 mwan3_create_iface_route()
 250 {
 251         local id route_args
 252
 253         config_get family $1 family ipv4
 254         mwan3_get_iface_id id $1
 255
 256         [ -n "$id" ] || return 0
 257
 258         if [ "$family" == "ipv4" ]; then
 259                 ubus call network.interface.${1}_4 status &>/dev/null
 260                 if [ "$?" -eq "0" ]; then
 261                         network_get_gateway route_args ${1}_4
 262                 else
 263                         network_get_gateway route_args $1
 264                 fi
 265
 266                 route_args="via $route_args dev $2"
 267
 268                 $IP4 route flush table $id
 269                 $IP4 route add table $id default $route_args
 270         fi
 271
 272         if [ "$family" == "ipv6" ]; then
 273
 274                 ubus call network.interface.${1}_6 status &>/dev/null
 275                 if [ "$?" -eq "0" ]; then
 276                         network_get_gateway6 route_args ${1}_6
 277                 else
 278                         network_get_gateway6 route_args $1
 279                 fi
 280
 281                 route_args="via $route_args dev $2"
 282
 283                 $IP6 route flush table $id
 284                 $IP6 route add table $id default $route_args
 285         fi
 286 }
 287
 288 mwan3_delete_iface_route()
 289 {
 290         local id
 291
 292         config_get family $1 family ipv4
 293         mwan3_get_iface_id id $1
 294
 295         [ -n "$id" ] || return 0
 296
 297         if [ "$family" == "ipv4" ]; then
 298                 $IP4 route flush table $id
 299         fi
 300
 301         if [ "$family" == "ipv6" ]; then
 302                 $IP6 route flush table $id
 303         fi
 304 }
 305
 306 mwan3_create_iface_rules()
 307 {
 308         local id family
 309
 310         config_get family $1 family ipv4
 311         mwan3_get_iface_id id $1
 312
 313         [ -n "$id" ] || return 0
 314
 315         if [ "$family" == "ipv4" ]; then
 316
 317                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 318                         $IP4 rule del pref $(($id+1000))
 319                 done
 320
 321                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 322                         $IP4 rule del pref $(($id+2000))
 323                 done
 324
 325                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 326                 $IP4 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 327         fi
 328
 329         if [ "$family" == "ipv6" ]; then
 330
 331                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 332                         $IP6 rule del pref $(($id+1000))
 333                 done
 334
 335                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 336                         $IP6 rule del pref $(($id+2000))
 337                 done
 338
 339                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 340                 $IP6 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 341         fi
 342 }
 343
 344 mwan3_delete_iface_rules()
 345 {
 346         local id family
 347
 348         config_get family $1 family ipv4
 349         mwan3_get_iface_id id $1
 350
 351         [ -n "$id" ] || return 0
 352
 353         if [ "$family" == "ipv4" ]; then
 354
 355                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 356                         $IP4 rule del pref $(($id+1000))
 357                 done
 358
 359                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 360                         $IP4 rule del pref $(($id+2000))
 361                 done
 362         fi
 363
 364         if [ "$family" == "ipv6" ]; then
 365
 366                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 367                         $IP6 rule del pref $(($id+1000))
 368                 done
 369
 370                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 371                         $IP6 rule del pref $(($id+2000))
 372                 done
 373         fi
 374 }
 375
 376 mwan3_delete_iface_ipset_entries()
 377 {
 378         local id setname entry
 379
 380         mwan3_get_iface_id id $1
 381
 382         [ -n "$id" ] || return 0
 383
 384         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 385                 for entry in $(ipset list $setname | grep "$(echo $(($id*256)) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 386                         $IPS del $setname $entry
 387                 done
 388         done
 389 }
 390
 391 mwan3_track()
 392 {
 393         local track_ip track_ips
 394
 395         mwan3_list_track_ips()
 396         {
 397                 track_ips="$1 $track_ips"
 398         }
 399         config_list_foreach $1 track_ip mwan3_list_track_ips
 400
 401         kill $(pgrep -f "mwan3track $1") &> /dev/null
 402         if [ -n "$track_ips" ]; then
 403                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track $1 $2 $track_ips &
 404         fi
 405 }
 406
 407 mwan3_track_signal()
 408 {
 409         local pid
 410
 411         pid="$(pgrep -f "mwan3track $1")"
 412         if [ "${pid}" != "" ]; then
 413                 kill -USR1 "${pid}"
 414         else
 415                 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
 416         fi
 417 }
 418
 419 mwan3_set_policy()
 420 {
 421         local iface_count id iface family metric probability weight
 422
 423         config_get iface $1 interface
 424         config_get metric $1 metric 1
 425         config_get weight $1 weight 1
 426
 427         [ -n "$iface" ] || return 0
 428
 429         mwan3_get_iface_id id $iface
 430
 431         [ -n "$id" ] || return 0
 432
 433         config_get family $iface family ipv4
 434
 435         if [ "$family" == "ipv4" ]; then
 436
 437                 if [ -n "$($IP4 route list table $id)" ]; then
 438                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 439
 440                                 total_weight_v4=$weight
 441                                 $IPT4 -F mwan3_policy_$policy
 442                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 443
 444                                 lowest_metric_v4=$metric
 445
 446                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 447
 448                                 total_weight_v4=$(($total_weight_v4+$weight))
 449                                 probability=$(($weight*1000/$total_weight_v4))
 450
 451                                 if [ "$probability" -lt 10 ]; then
 452                                         probability="0.00$probability"
 453                                 elif [ $probability -lt 100 ]; then
 454                                         probability="0.0$probability"
 455                                 elif [ $probability -lt 1000 ]; then
 456                                         probability="0.$probability"
 457                                 else
 458                                         probability="1"
 459                                 fi
 460
 461                                 probability="-m statistic --mode random --probability $probability"
 462
 463                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(($id*256))/0xff00
 464                         fi
 465                 fi
 466         fi
 467
 468         if [ "$family" == "ipv6" ]; then
 469
 470                 if [ -n "$($IP6 route list table $id)" ]; then
 471                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 472
 473                                 total_weight_v6=$weight
 474                                 $IPT6 -F mwan3_policy_$policy
 475                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 476
 477                                 lowest_metric_v6=$metric
 478
 479                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 480
 481                                 total_weight_v6=$(($total_weight_v6+$weight))
 482                                 probability=$(($weight*1000/$total_weight_v6))
 483
 484                                 if [ "$probability" -lt 10 ]; then
 485                                         probability="0.00$probability"
 486                                 elif [ $probability -lt 100 ]; then
 487                                         probability="0.0$probability"
 488                                 elif [ $probability -lt 1000 ]; then
 489                                         probability="0.$probability"
 490                                 else
 491                                         probability="1"
 492                                 fi
 493
 494                                 probability="-m statistic --mode random --probability $probability"
 495
 496                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(($id*256))/0xff00
 497                         fi
 498                 fi
 499         fi
 500 }
 501
 502 mwan3_create_policies_iptables()
 503 {
 504         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 505
 506         policy="$1"
 507
 508         config_get last_resort $1 last_resort unreachable
 509
 510         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 511                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 512         fi
 513
 514         for IPT in "$IPT4" "$IPT6"; do
 515
 516                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 517                         $IPT -N mwan3_policy_$1
 518                 fi
 519
 520                 $IPT -F mwan3_policy_$1
 521
 522                 case "$last_resort" in
 523                         blackhole)
 524                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "blackhole" -j MARK --set-xmark 0xfd00/0xff00
 525                         ;;
 526                         default)
 527                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 528                         ;;
 529                         *)
 530                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "unreachable" -j MARK --set-xmark 0xfe00/0xff00
 531                         ;;
 532                 esac
 533         done
 534
 535         lowest_metric_v4=256
 536         total_weight_v4=0
 537
 538         lowest_metric_v6=256
 539         total_weight_v6=0
 540
 541         config_list_foreach $1 use_member mwan3_set_policy
 542 }
 543
 544 mwan3_set_policies_iptables()
 545 {
 546         config_foreach mwan3_create_policies_iptables policy
 547 }
 548
 549 mwan3_set_sticky_iptables()
 550 {
 551         local id iface
 552
 553         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 554
 555                 if [ "$iface" == "$1" ]; then
 556
 557                         mwan3_get_iface_id id $1
 558
 559                         [ -n "$id" ] || return 0
 560
 561                         for IPT in "$IPT4" "$IPT6"; do
 562                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 563                                         $IPT -I mwan3_rule_$rule -m mark --mark $(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/0xff00
 564                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/0xff00 -j MARK --set-xmark $(($id*256))/0xff00
 565                                 fi
 566                         done
 567                 fi
 568         done
 569 }
 570
 571 mwan3_set_user_iptables_rule()
 572 {
 573         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 574
 575         rule="$1"
 576
 577         config_get sticky $1 sticky 0
 578         config_get timeout $1 timeout 600
 579         config_get ipset $1 ipset
 580         config_get proto $1 proto all
 581         config_get src_ip $1 src_ip 0.0.0.0/0
 582         config_get src_port $1 src_port 0:65535
 583         config_get dest_ip $1 dest_ip 0.0.0.0/0
 584         config_get dest_port $1 dest_port 0:65535
 585         config_get use_policy $1 use_policy
 586         config_get family $1 family any
 587
 588         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 589                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 590         fi
 591
 592         if [ -n "$ipset" ]; then
 593                 ipset="-m set --match-set $ipset dst"
 594         fi
 595
 596         if [ -n "$use_policy" ]; then
 597                 if [ "$use_policy" == "default" ]; then
 598                         policy="MARK --set-xmark 0xff00/0xff00"
 599                 elif [ "$use_policy" == "unreachable" ]; then
 600                         policy="MARK --set-xmark 0xfe00/0xff00"
 601                 elif [ "$use_policy" == "blackhole" ]; then
 602                         policy="MARK --set-xmark 0xfd00/0xff00"
 603                 else
 604                         if [ "$sticky" -eq 1 ]; then
 605
 606                                 policy="mwan3_policy_$use_policy"
 607
 608                                 for IPT in "$IPT4" "$IPT6"; do
 609                                         if ! $IPT -S $policy &> /dev/null; then
 610                                                 $IPT -N $policy
 611                                         fi
 612
 613                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 614                                                 $IPT -N mwan3_rule_$1
 615                                         fi
 616
 617                                         $IPT -F mwan3_rule_$1
 618                                 done
 619
 620                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask 0xff00 timeout $timeout
 621                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask 0xff00 timeout $timeout family inet6
 622                                 $IPS -! create mwan3_sticky_$rule list:set
 623                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 624                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 625
 626                                 config_foreach mwan3_set_sticky_iptables interface
 627
 628                                 for IPT in "$IPT4" "$IPT6"; do
 629                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/0xff00 -j $policy
 630                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 631                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 632                                 done
 633
 634                                 policy="mwan3_rule_$1"
 635                         else
 636                                 policy="mwan3_policy_$use_policy"
 637
 638                                 for IPT in "$IPT4" "$IPT6"; do
 639                                         if ! $IPT -S $policy &> /dev/null; then
 640                                                 $IPT -N $policy
 641                                         fi
 642                                 done
 643
 644                         fi
 645                 fi
 646
 647                 if [ "$family" == "any" ]; then
 648
 649                         for IPT in "$IPT4" "$IPT6"; do
 650                                 case $proto in
 651                                         tcp|udp)
 652                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 653                                         ;;
 654                                         *)
 655                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 656                                         ;;
 657                                 esac
 658                         done
 659
 660                 elif [ "$family" == "ipv4" ]; then
 661
 662                         case $proto in
 663                                 tcp|udp)
 664                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 665                                 ;;
 666                                 *)
 667                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 668                                 ;;
 669                         esac
 670
 671                 elif [ "$family" == "ipv6" ]; then
 672
 673                         case $proto in
 674                                 tcp|udp)
 675                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 676                                 ;;
 677                                 *)
 678                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 679                                 ;;
 680                         esac
 681                 fi
 682         fi
 683 }
 684
 685 mwan3_set_user_rules()
 686 {
 687         local IPT
 688
 689         for IPT in "$IPT4" "$IPT6"; do
 690
 691                 if ! $IPT -S mwan3_rules &> /dev/null; then
 692                         $IPT -N mwan3_rules
 693                 fi
 694
 695                 $IPT -F mwan3_rules
 696         done
 697
 698         config_foreach mwan3_set_user_iptables_rule rule
 699 }
 700
 701 mwan3_report_iface_status()
 702 {
 703         local device result track_ips tracking IP IPT
 704
 705         mwan3_get_iface_id id $1
 706         network_get_device device $1
 707         config_get enabled "$1" enabled 0
 708         config_get family "$1" family ipv4
 709
 710         if [ "$family" == "ipv4" ]; then
 711                 IP="$IP4"
 712                 IPT="$IPT4"
 713         fi
 714
 715         if [ "$family" == "ipv6" ]; then
 716                 IP="$IP6"
 717                 IPT="$IPT6"
 718         fi
 719
 720         if [ -z "$id" -o -z "$device" ]; then
 721                 result="unknown"
 722         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 723                 result="online"
 724         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 725                 result="error"
 726         else
 727                 if [ "$enabled" == "1" ]; then
 728                         result="offline"
 729                 else
 730                         result="disabled"
 731                 fi
 732         fi
 733
 734         mwan3_list_track_ips()
 735         {
 736                 track_ips="$1 $track_ips"
 737         }
 738         config_list_foreach $1 track_ip mwan3_list_track_ips
 739
 740         if [ -n "$track_ips" ]; then
 741                 if [ -n "$(pgrep -f "mwan3track $1")" ]; then
 742                         tracking="active"
 743                 else
 744                         tracking="down"
 745                 fi
 746         else
 747                 tracking="not enabled"
 748         fi
 749
 750         echo " interface $1 is $result and tracking is $tracking"
 751 }
 752
 753 mwan3_report_policies_v4()
 754 {
 755         local percent policy share total_weight weight iface
 756
 757         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 758                 echo "$policy:" | sed 's/mwan3_policy_//'
 759
 760                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 761
 762                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 763                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 764                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 765                                 percent=$(($weight*100/$total_weight))
 766                                 echo " $iface ($percent%)"
 767                         done
 768                 else
 769                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 770                 fi
 771
 772                 unset total_weight
 773
 774                 echo -e
 775         done
 776 }
 777
 778 mwan3_report_policies_v6()
 779 {
 780         local percent policy share total_weight weight iface
 781
 782         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 783                 echo "$policy:" | sed 's/mwan3_policy_//'
 784
 785                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 786
 787                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 788                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 789                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 790                                 percent=$(($weight*100/$total_weight))
 791                                 echo " $iface ($percent%)"
 792                         done
 793                 else
 794                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 795                 fi
 796
 797                 unset total_weight
 798
 799                 echo -e
 800         done
 801 }
 802
 803 mwan3_report_connected_v4()
 804 {
 805         local address
 806
 807         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 808                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 809                         echo " $address"
 810                 done
 811         fi
 812 }
 813
 814 mwan3_report_connected_v6()
 815 {
 816         local address
 817
 818         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 819                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 820                         echo " $address"
 821                 done
 822         fi
 823 }
 824
 825 mwan3_report_rules_v4()
 826 {
 827         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 828                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 829         fi
 830 }
 831
 832 mwan3_report_rules_v6()
 833 {
 834         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 835                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 836         fi
 837 }
 838
 839 mwan3_flush_conntrack()
 840 {
 841         local flush_conntrack
 842
 843         config_get flush_conntrack $1 flush_conntrack never
 844
 845         if [ -e "$CONNTRACK_FILE" ]; then
 846                 case $flush_conntrack in
 847                         ifup)
 848                                 [ "$3" = "ifup" ] && {
 849                                         echo f > ${CONNTRACK_FILE}
 850                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 851                                 }
 852                                 ;;
 853                         ifdown)
 854                                 [ "$3" = "ifdown" ] && {
 855                                         echo f > ${CONNTRACK_FILE}
 856                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 857                                 }
 858                                 ;;
 859                         always)
 860                                 echo f > ${CONNTRACK_FILE}
 861                                 $LOG info "connection tracking flushed on interface $1 ($2) $3"
 862                                 ;;
 863                         never)
 864                                 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
 865                                 ;;
 866                 esac
 867         else
 868                 $LOG warning "connection tracking not enabled"
 869         fi
 870 }