net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="ip -4"
   4 IP6="ip -6"
   5 IPS="ipset"
   6 IPT4="iptables -t mangle -w"
   7 IPT6="ip6tables -t mangle -w"
   8 LOG="logger -t mwan3[$$] -p"
   9 CONNTRACK_FILE="/proc/net/nf_conntrack"
  10
  11 MWAN3_STATUS_DIR="/var/run/mwan3track"
  12
  13 # mwan3's MARKing mask (at least 3 bits should be set)
  14 if [ -e "${MWAN3_STATUS_DIR}/mmx_mask" ]; then
  15         MMX_MASK=$(cat "${MWAN3_STATUS_DIR}/mmx_mask")
  16 else
  17         config_load mwan3
  18         config_get MMX_MASK globals mmx_mask '0xff00'
  19         mkdir -p "${MWAN3_STATUS_DIR}"
  20         echo "$MMX_MASK" > "${MWAN3_STATUS_DIR}/mmx_mask"
  21         $LOG notice "Using firewall mask ${MMX_MASK}"
  22 fi
  23
  24 # counts how many bits are set to 1
  25 # n&(n-1) clears the lowest bit set to 1
  26 mwan3_count_one_bits()
  27 {
  28         local count n
  29         count=0
  30         n=$(($1))
  31         while [ "$n" -gt "0" ]; do
  32                 n=$((n&(n-1)))
  33                 count=$((count+1))
  34         done
  35         echo $count
  36 }
  37
  38 # maps the 1st parameter so it only uses the bits allowed by the bitmask (2nd parameter)
  39 # which means spreading the bits of the 1st parameter to only use the bits that are set to 1 in the 2nd parameter
  40 # 0 0 0 0 0 1 0 1 (0x05) 1st parameter
  41 # 1 0 1 0 1 0 1 0 (0xAA) 2nd parameter
  42 #     1   0   1          result
  43 mwan3_id2mask()
  44 {
  45         local bit_msk bit_val result
  46         bit_val=0
  47         result=0
  48         for bit_msk in $(seq 0 31); do
  49                 if [ $((($2>>bit_msk)&1)) = "1" ]; then
  50                         if [ $((($1>>bit_val)&1)) = "1" ]; then
  51                                 result=$((result|(1<<bit_msk)))
  52                         fi
  53                         bit_val=$((bit_val+1))
  54                 fi
  55         done
  56         printf "0x%x" $result
  57 }
  58
  59 # mark mask constants
  60 MM_BIT_CNT=$(mwan3_count_one_bits MMX_MASK)
  61 MM_DEFAULT=$(((1<<MM_BIT_CNT)-1))
  62 MM_BLACKHOLE=$(($MM_DEFAULT-2))
  63 MM_UNREACHABLE=$(($MM_DEFAULT-1))
  64
  65 # MMX_DEFAULT should equal MMX_MASK
  66 MMX_DEFAULT=$(mwan3_id2mask MM_DEFAULT MMX_MASK)
  67 MMX_BLACKHOLE=$(mwan3_id2mask MM_BLACKHOLE MMX_MASK)
  68 MMX_UNREACHABLE=$(mwan3_id2mask MM_UNREACHABLE MMX_MASK)
  69
  70 mwan3_lock() {
  71         lock /var/run/mwan3.lock
  72 }
  73
  74 mwan3_unlock() {
  75         lock -u /var/run/mwan3.lock
  76 }
  77
  78 mwan3_lock_clean() {
  79         rm -rf /var/run/mwan3.lock
  80 }
  81
  82 mwan3_get_iface_id()
  83 {
  84         local _tmp _iface _iface_count
  85
  86         _iface="$2"
  87
  88         mwan3_get_id()
  89         {
  90                 let _iface_count++
  91                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  92         }
  93         config_foreach mwan3_get_id interface
  94         export "$1=$_tmp"
  95 }
  96
  97 mwan3_set_connected_iptables()
  98 {
  99         local connected_network_v4 connected_network_v6
 100
 101         $IPS -! create mwan3_connected_v4 hash:net
 102         $IPS create mwan3_connected_v4_temp hash:net
 103
 104         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 105                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
 106         done
 107
 108         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 109                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
 110         done
 111
 112         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
 113
 114         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
 115         $IPS destroy mwan3_connected_v4_temp
 116
 117         $IPS -! create mwan3_connected_v6 hash:net family inet6
 118         $IPS create mwan3_connected_v6_temp hash:net family inet6
 119
 120         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 121                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
 122         done
 123
 124         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
 125         $IPS destroy mwan3_connected_v6_temp
 126
 127         $IPS -! create mwan3_connected list:set
 128         $IPS -! add mwan3_connected mwan3_connected_v4
 129         $IPS -! add mwan3_connected mwan3_connected_v6
 130 }
 131
 132 mwan3_set_general_rules()
 133 {
 134         local IP
 135
 136         for IP in "$IP4" "$IP6"; do
 137
 138                 RULE_NO=$(($MM_BLACKHOLE+2000))
 139                 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
 140                         $IP rule add pref $RULE_NO fwmark $MMX_BLACKHOLE/$MMX_MASK blackhole
 141                 fi
 142
 143                 RULE_NO=$(($MM_UNREACHABLE+2000))
 144                 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
 145                         $IP rule add pref $RULE_NO fwmark $MMX_UNREACHABLE/$MMX_MASK unreachable
 146                 fi
 147         done
 148 }
 149
 150 mwan3_set_general_iptables()
 151 {
 152         local IPT
 153
 154         for IPT in "$IPT4" "$IPT6"; do
 155
 156                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
 157                         $IPT -N mwan3_ifaces_in
 158                 fi
 159
 160                 if ! $IPT -S mwan3_connected &> /dev/null; then
 161                         $IPT -N mwan3_connected
 162                         $IPS -! create mwan3_connected list:set
 163                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 164                 fi
 165
 166                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
 167                         $IPT -N mwan3_ifaces_out
 168                 fi
 169
 170                 if ! $IPT -S mwan3_rules &> /dev/null; then
 171                         $IPT -N mwan3_rules
 172                 fi
 173
 174                 if ! $IPT -S mwan3_hook &> /dev/null; then
 175                         $IPT -N mwan3_hook
 176                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
 177                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_in
 178                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_connected
 179                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_out
 180                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_rules
 181                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
 182                         $IPT -A mwan3_hook -m mark ! --mark $MMX_DEFAULT/$MMX_MASK -j mwan3_connected
 183                 fi
 184
 185                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 186                         $IPT -A PREROUTING -j mwan3_hook
 187                 fi
 188
 189                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 190                         $IPT -A OUTPUT -j mwan3_hook
 191                 fi
 192         done
 193 }
 194
 195 mwan3_create_iface_iptables()
 196 {
 197         local id family src_ip src_ipv6
 198
 199         config_get family $1 family ipv4
 200         mwan3_get_iface_id id $1
 201
 202         [ -n "$id" ] || return 0
 203
 204         if [ "$family" == "ipv4" ]; then
 205
 206                 ubus call network.interface.${1}_4 status &>/dev/null
 207                 if [ "$?" -eq "0" ]; then
 208                         network_get_ipaddr src_ip ${1}_4
 209                 else
 210                         network_get_ipaddr src_ip $1
 211                 fi
 212
 213                 $IPS -! create mwan3_connected list:set
 214
 215                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 216                         $IPT4 -N mwan3_ifaces_in
 217                 fi
 218
 219                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 220                         $IPT4 -N mwan3_ifaces_out
 221                 fi
 222
 223                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 224                         $IPT4 -N mwan3_iface_in_$1
 225                 fi
 226
 227                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 228                         $IPT4 -N mwan3_iface_out_$1
 229                 fi
 230
 231                 $IPT4 -F mwan3_iface_in_$1
 232                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 233                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 234
 235                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 236                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
 237
 238                 $IPT4 -F mwan3_iface_out_$1
 239                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 240
 241                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 242                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
 243         fi
 244
 245         if [ "$family" == "ipv6" ]; then
 246
 247                 ubus call network.interface.${1}_6 status &>/dev/null
 248                 if [ "$?" -eq "0" ]; then
 249                         network_get_ipaddr6 src_ipv6 ${1}_6
 250                 else
 251                         network_get_ipaddr6 src_ipv6 $1
 252                 fi
 253
 254                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 255
 256                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 257                         $IPT6 -N mwan3_ifaces_in
 258                 fi
 259
 260                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 261                         $IPT6 -N mwan3_ifaces_out
 262                 fi
 263
 264                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 265                         $IPT6 -N mwan3_iface_in_$1
 266                 fi
 267
 268                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 269                         $IPT6 -N mwan3_iface_out_$1
 270                 fi
 271
 272                 $IPT6 -F mwan3_iface_in_$1
 273                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 274                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 275
 276                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 277                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
 278
 279                 $IPT6 -F mwan3_iface_out_$1
 280                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 281
 282                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 283                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
 284         fi
 285 }
 286
 287 mwan3_delete_iface_iptables()
 288 {
 289         config_get family $1 family ipv4
 290
 291         if [ "$family" == "ipv4" ]; then
 292
 293                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 294                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 295                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 296
 297                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 298                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 299                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 300         fi
 301
 302         if [ "$family" == "ipv6" ]; then
 303
 304                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 305                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 306                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 307
 308                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 309                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 310                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 311         fi
 312 }
 313
 314 mwan3_create_iface_route()
 315 {
 316         local id route_args
 317
 318         config_get family $1 family ipv4
 319         mwan3_get_iface_id id $1
 320
 321         [ -n "$id" ] || return 0
 322
 323         if [ "$family" == "ipv4" ]; then
 324                 ubus call network.interface.${1}_4 status &>/dev/null
 325                 if [ "$?" -eq "0" ]; then
 326                         network_get_gateway route_args ${1}_4
 327                 else
 328                         network_get_gateway route_args $1
 329                 fi
 330
 331                 route_args="via $route_args dev $2"
 332
 333                 $IP4 route flush table $id
 334                 $IP4 route add table $id default $route_args
 335         fi
 336
 337         if [ "$family" == "ipv6" ]; then
 338
 339                 ubus call network.interface.${1}_6 status &>/dev/null
 340                 if [ "$?" -eq "0" ]; then
 341                         network_get_gateway6 route_args ${1}_6
 342                 else
 343                         network_get_gateway6 route_args $1
 344                 fi
 345
 346                 route_args="via $route_args dev $2"
 347
 348                 $IP6 route flush table $id
 349                 $IP6 route add table $id default $route_args
 350         fi
 351 }
 352
 353 mwan3_delete_iface_route()
 354 {
 355         local id
 356
 357         config_get family $1 family ipv4
 358         mwan3_get_iface_id id $1
 359
 360         [ -n "$id" ] || return 0
 361
 362         if [ "$family" == "ipv4" ]; then
 363                 $IP4 route flush table $id
 364         fi
 365
 366         if [ "$family" == "ipv6" ]; then
 367                 $IP6 route flush table $id
 368         fi
 369 }
 370
 371 mwan3_create_iface_rules()
 372 {
 373         local id family
 374
 375         config_get family $1 family ipv4
 376         mwan3_get_iface_id id $1
 377
 378         [ -n "$id" ] || return 0
 379
 380         if [ "$family" == "ipv4" ]; then
 381
 382                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 383                         $IP4 rule del pref $(($id+1000))
 384                 done
 385
 386                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 387                         $IP4 rule del pref $(($id+2000))
 388                 done
 389
 390                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 391                 $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
 392         fi
 393
 394         if [ "$family" == "ipv6" ]; then
 395
 396                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 397                         $IP6 rule del pref $(($id+1000))
 398                 done
 399
 400                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 401                         $IP6 rule del pref $(($id+2000))
 402                 done
 403
 404                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 405                 $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
 406         fi
 407 }
 408
 409 mwan3_delete_iface_rules()
 410 {
 411         local id family
 412
 413         config_get family $1 family ipv4
 414         mwan3_get_iface_id id $1
 415
 416         [ -n "$id" ] || return 0
 417
 418         if [ "$family" == "ipv4" ]; then
 419
 420                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 421                         $IP4 rule del pref $(($id+1000))
 422                 done
 423
 424                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 425                         $IP4 rule del pref $(($id+2000))
 426                 done
 427         fi
 428
 429         if [ "$family" == "ipv6" ]; then
 430
 431                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 432                         $IP6 rule del pref $(($id+1000))
 433                 done
 434
 435                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 436                         $IP6 rule del pref $(($id+2000))
 437                 done
 438         fi
 439 }
 440
 441 mwan3_delete_iface_ipset_entries()
 442 {
 443         local id setname entry
 444
 445         mwan3_get_iface_id id $1
 446
 447         [ -n "$id" ] || return 0
 448
 449         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 450                 for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 451                         $IPS del $setname $entry
 452                 done
 453         done
 454 }
 455
 456 mwan3_track()
 457 {
 458         local track_ip track_ips
 459
 460         mwan3_list_track_ips()
 461         {
 462                 track_ips="$1 $track_ips"
 463         }
 464         config_list_foreach $1 track_ip mwan3_list_track_ips
 465
 466         kill $(pgrep -f "mwan3track $1 $2") &> /dev/null
 467         if [ -n "$track_ips" ]; then
 468                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track "$1" "$2" "$3" "$4" $track_ips &
 469         fi
 470 }
 471
 472 mwan3_track_signal()
 473 {
 474         local pid
 475
 476         pid="$(pgrep -f "mwan3track $1 $2")"
 477         if [ "${pid}" != "" ]; then
 478                 kill -USR1 "${pid}"
 479         else
 480                 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
 481         fi
 482 }
 483
 484 mwan3_set_policy()
 485 {
 486         local iface_count id iface family metric probability weight
 487
 488         config_get iface $1 interface
 489         config_get metric $1 metric 1
 490         config_get weight $1 weight 1
 491
 492         [ -n "$iface" ] || return 0
 493
 494         mwan3_get_iface_id id $iface
 495
 496         [ -n "$id" ] || return 0
 497
 498         config_get family $iface family ipv4
 499
 500         if [ "$family" == "ipv4" ]; then
 501
 502                 if [ -n "$($IP4 route list table $id)" ]; then
 503                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 504
 505                                 total_weight_v4=$weight
 506                                 $IPT4 -F mwan3_policy_$policy
 507                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 508
 509                                 lowest_metric_v4=$metric
 510
 511                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 512
 513                                 total_weight_v4=$(($total_weight_v4+$weight))
 514                                 probability=$(($weight*1000/$total_weight_v4))
 515
 516                                 if [ "$probability" -lt 10 ]; then
 517                                         probability="0.00$probability"
 518                                 elif [ $probability -lt 100 ]; then
 519                                         probability="0.0$probability"
 520                                 elif [ $probability -lt 1000 ]; then
 521                                         probability="0.$probability"
 522                                 else
 523                                         probability="1"
 524                                 fi
 525
 526                                 probability="-m statistic --mode random --probability $probability"
 527
 528                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 529                         fi
 530                 fi
 531         fi
 532
 533         if [ "$family" == "ipv6" ]; then
 534
 535                 if [ -n "$($IP6 route list table $id)" ]; then
 536                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 537
 538                                 total_weight_v6=$weight
 539                                 $IPT6 -F mwan3_policy_$policy
 540                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 541
 542                                 lowest_metric_v6=$metric
 543
 544                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 545
 546                                 total_weight_v6=$(($total_weight_v6+$weight))
 547                                 probability=$(($weight*1000/$total_weight_v6))
 548
 549                                 if [ "$probability" -lt 10 ]; then
 550                                         probability="0.00$probability"
 551                                 elif [ $probability -lt 100 ]; then
 552                                         probability="0.0$probability"
 553                                 elif [ $probability -lt 1000 ]; then
 554                                         probability="0.$probability"
 555                                 else
 556                                         probability="1"
 557                                 fi
 558
 559                                 probability="-m statistic --mode random --probability $probability"
 560
 561                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 562                         fi
 563                 fi
 564         fi
 565 }
 566
 567 mwan3_create_policies_iptables()
 568 {
 569         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 570
 571         policy="$1"
 572
 573         config_get last_resort $1 last_resort unreachable
 574
 575         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 576                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 577         fi
 578
 579         for IPT in "$IPT4" "$IPT6"; do
 580
 581                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 582                         $IPT -N mwan3_policy_$1
 583                 fi
 584
 585                 $IPT -F mwan3_policy_$1
 586
 587                 case "$last_resort" in
 588                         blackhole)
 589                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "blackhole" -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
 590                         ;;
 591                         default)
 592                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 593                         ;;
 594                         *)
 595                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "unreachable" -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
 596                         ;;
 597                 esac
 598         done
 599
 600         lowest_metric_v4=256
 601         total_weight_v4=0
 602
 603         lowest_metric_v6=256
 604         total_weight_v6=0
 605
 606         config_list_foreach $1 use_member mwan3_set_policy
 607 }
 608
 609 mwan3_set_policies_iptables()
 610 {
 611         config_foreach mwan3_create_policies_iptables policy
 612 }
 613
 614 mwan3_set_sticky_iptables()
 615 {
 616         local id iface
 617
 618         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 619
 620                 if [ "$iface" == "$1" ]; then
 621
 622                         mwan3_get_iface_id id $1
 623
 624                         [ -n "$id" ] || return 0
 625
 626                         for IPT in "$IPT4" "$IPT6"; do
 627                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 628                                         $IPT -I mwan3_rule_$rule -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/$MMX_MASK
 629                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/$MMX_MASK -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 630                                 fi
 631                         done
 632                 fi
 633         done
 634 }
 635
 636 mwan3_set_user_iptables_rule()
 637 {
 638         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 639
 640         rule="$1"
 641
 642         config_get sticky $1 sticky 0
 643         config_get timeout $1 timeout 600
 644         config_get ipset $1 ipset
 645         config_get proto $1 proto all
 646         config_get src_ip $1 src_ip 0.0.0.0/0
 647         config_get src_port $1 src_port 0:65535
 648         config_get dest_ip $1 dest_ip 0.0.0.0/0
 649         config_get dest_port $1 dest_port 0:65535
 650         config_get use_policy $1 use_policy
 651         config_get family $1 family any
 652
 653         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 654                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 655         fi
 656
 657         if [ -n "$ipset" ]; then
 658                 ipset="-m set --match-set $ipset dst"
 659         fi
 660
 661         if [ -n "$use_policy" ]; then
 662                 if [ "$use_policy" == "default" ]; then
 663                         policy="MARK --set-xmark $MMX_DEFAULT/$MMX_MASK"
 664                 elif [ "$use_policy" == "unreachable" ]; then
 665                         policy="MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK"
 666                 elif [ "$use_policy" == "blackhole" ]; then
 667                         policy="MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK"
 668                 else
 669                         if [ "$sticky" -eq 1 ]; then
 670
 671                                 policy="mwan3_policy_$use_policy"
 672
 673                                 for IPT in "$IPT4" "$IPT6"; do
 674                                         if ! $IPT -S $policy &> /dev/null; then
 675                                                 $IPT -N $policy
 676                                         fi
 677
 678                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 679                                                 $IPT -N mwan3_rule_$1
 680                                         fi
 681
 682                                         $IPT -F mwan3_rule_$1
 683                                 done
 684
 685                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout
 686                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout family inet6
 687                                 $IPS -! create mwan3_sticky_$rule list:set
 688                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 689                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 690
 691                                 config_foreach mwan3_set_sticky_iptables interface
 692
 693                                 for IPT in "$IPT4" "$IPT6"; do
 694                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/$MMX_MASK -j $policy
 695                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 696                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 697                                 done
 698
 699                                 policy="mwan3_rule_$1"
 700                         else
 701                                 policy="mwan3_policy_$use_policy"
 702
 703                                 for IPT in "$IPT4" "$IPT6"; do
 704                                         if ! $IPT -S $policy &> /dev/null; then
 705                                                 $IPT -N $policy
 706                                         fi
 707                                 done
 708
 709                         fi
 710                 fi
 711
 712                 if [ "$family" == "any" ]; then
 713
 714                         for IPT in "$IPT4" "$IPT6"; do
 715                                 case $proto in
 716                                         tcp|udp)
 717                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 718                                         ;;
 719                                         *)
 720                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 721                                         ;;
 722                                 esac
 723                         done
 724
 725                 elif [ "$family" == "ipv4" ]; then
 726
 727                         case $proto in
 728                                 tcp|udp)
 729                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 730                                 ;;
 731                                 *)
 732                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 733                                 ;;
 734                         esac
 735
 736                 elif [ "$family" == "ipv6" ]; then
 737
 738                         case $proto in
 739                                 tcp|udp)
 740                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 741                                 ;;
 742                                 *)
 743                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 744                                 ;;
 745                         esac
 746                 fi
 747         fi
 748 }
 749
 750 mwan3_set_user_rules()
 751 {
 752         local IPT
 753
 754         for IPT in "$IPT4" "$IPT6"; do
 755
 756                 if ! $IPT -S mwan3_rules &> /dev/null; then
 757                         $IPT -N mwan3_rules
 758                 fi
 759
 760                 $IPT -F mwan3_rules
 761         done
 762
 763         config_foreach mwan3_set_user_iptables_rule rule
 764 }
 765
 766 mwan3_report_iface_status()
 767 {
 768         local device result track_ips tracking IP IPT
 769
 770         mwan3_get_iface_id id $1
 771         network_get_device device $1
 772         config_get enabled "$1" enabled 0
 773         config_get family "$1" family ipv4
 774
 775         if [ "$family" == "ipv4" ]; then
 776                 IP="$IP4"
 777                 IPT="$IPT4"
 778         fi
 779
 780         if [ "$family" == "ipv6" ]; then
 781                 IP="$IP6"
 782                 IPT="$IPT6"
 783         fi
 784
 785         if [ -z "$id" -o -z "$device" ]; then
 786                 result="unknown"
 787         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 788                 result="online"
 789         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 790                 result="error"
 791         else
 792                 if [ "$enabled" == "1" ]; then
 793                         result="offline"
 794                 else
 795                         result="disabled"
 796                 fi
 797         fi
 798
 799         mwan3_list_track_ips()
 800         {
 801                 track_ips="$1 $track_ips"
 802         }
 803         config_list_foreach $1 track_ip mwan3_list_track_ips
 804
 805         if [ -n "$track_ips" ]; then
 806                 if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
 807                         tracking="active"
 808                 else
 809                         tracking="down"
 810                 fi
 811         else
 812                 tracking="not enabled"
 813         fi
 814
 815         echo " interface $1 is $result and tracking is $tracking"
 816 }
 817
 818 mwan3_report_policies_v4()
 819 {
 820         local percent policy share total_weight weight iface
 821
 822         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 823                 echo "$policy:" | sed 's/mwan3_policy_//'
 824
 825                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 826
 827                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 828                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 829                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 830                                 percent=$(($weight*100/$total_weight))
 831                                 echo " $iface ($percent%)"
 832                         done
 833                 else
 834                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 835                 fi
 836
 837                 unset total_weight
 838
 839                 echo -e
 840         done
 841 }
 842
 843 mwan3_report_policies_v6()
 844 {
 845         local percent policy share total_weight weight iface
 846
 847         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 848                 echo "$policy:" | sed 's/mwan3_policy_//'
 849
 850                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 851
 852                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 853                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 854                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 855                                 percent=$(($weight*100/$total_weight))
 856                                 echo " $iface ($percent%)"
 857                         done
 858                 else
 859                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 860                 fi
 861
 862                 unset total_weight
 863
 864                 echo -e
 865         done
 866 }
 867
 868 mwan3_report_connected_v4()
 869 {
 870         local address
 871
 872         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 873                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 874                         echo " $address"
 875                 done
 876         fi
 877 }
 878
 879 mwan3_report_connected_v6()
 880 {
 881         local address
 882
 883         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 884                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 885                         echo " $address"
 886                 done
 887         fi
 888 }
 889
 890 mwan3_report_rules_v4()
 891 {
 892         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 893                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 894         fi
 895 }
 896
 897 mwan3_report_rules_v6()
 898 {
 899         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 900                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 901         fi
 902 }
 903
 904 mwan3_flush_conntrack()
 905 {
 906         local flush_conntrack
 907
 908         config_get flush_conntrack $1 flush_conntrack never
 909
 910         if [ -e "$CONNTRACK_FILE" ]; then
 911                 case $flush_conntrack in
 912                         ifup)
 913                                 [ "$3" = "ifup" ] && {
 914                                         echo f > ${CONNTRACK_FILE}
 915                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 916                                 }
 917                                 ;;
 918                         ifdown)
 919                                 [ "$3" = "ifdown" ] && {
 920                                         echo f > ${CONNTRACK_FILE}
 921                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 922                                 }
 923                                 ;;
 924                         always)
 925                                 echo f > ${CONNTRACK_FILE}
 926                                 $LOG info "connection tracking flushed on interface $1 ($2) $3"
 927                                 ;;
 928                         never)
 929                                 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
 930                                 ;;
 931                 esac
 932         else
 933                 $LOG warning "connection tracking not enabled"
 934         fi
 935 }
 936
 937 mwan3_track_clean()
 938 {
 939         rm -rf "$MWAN3_STATUS_DIR/${1}" &> /dev/null
 940         [ -d "$MWAN3_STATUS_DIR" ] && {
 941                 if [ -z "$(ls -A "$MWAN3_STATUS_DIR")" ]; then
 942                         rm -rf "$MWAN3_STATUS_DIR"
 943                 fi
 944         }
 945 }