6 IPT4
="iptables -t mangle -w"
7 IPT6
="ip6tables -t mangle -w"
8 LOG
="logger -t mwan3[$$] -p"
9 CONNTRACK_FILE
="/proc/net/nf_conntrack"
11 MWAN3_STATUS_DIR
="/var/run/mwan3"
12 MWAN3TRACK_STATUS_DIR
="/var/run/mwan3track"
14 [ -d $MWAN3_STATUS_DIR ] || mkdir
-p $MWAN3_STATUS_DIR/iface_state
15 # mwan3's MARKing mask (at least 3 bits should be set)
16 if [ -e "${MWAN3_STATUS_DIR}/mmx_mask" ]; then
17 MMX_MASK
=$
(cat "${MWAN3_STATUS_DIR}/mmx_mask")
20 config_get MMX_MASK globals mmx_mask
'0xff00'
21 echo "$MMX_MASK" > "${MWAN3_STATUS_DIR}/mmx_mask"
22 $LOG notice
"Using firewall mask ${MMX_MASK}"
25 # counts how many bits are set to 1
26 # n&(n-1) clears the lowest bit set to 1
27 mwan3_count_one_bits
()
32 while [ "$n" -gt "0" ]; do
39 # maps the 1st parameter so it only uses the bits allowed by the bitmask (2nd parameter)
40 # which means spreading the bits of the 1st parameter to only use the bits that are set to 1 in the 2nd parameter
41 # 0 0 0 0 0 1 0 1 (0x05) 1st parameter
42 # 1 0 1 0 1 0 1 0 (0xAA) 2nd parameter
46 local bit_msk bit_val result
49 for bit_msk
in $
(seq 0 31); do
50 if [ $
((($2>>bit_msk
)&1)) = "1" ]; then
51 if [ $
((($1>>bit_val
)&1)) = "1" ]; then
52 result
=$
((result|
(1<<bit_msk)))
54 bit_val=$((bit_val+1))
61 MM_BIT_CNT=$(mwan3_count_one_bits MMX_MASK)
62 MM_DEFAULT=$(((1<<MM_BIT_CNT)-1))
63 MM_BLACKHOLE=$(($MM_DEFAULT-2))
64 MM_UNREACHABLE=$(($MM_DEFAULT-1))
66 # MMX_DEFAULT should equal MMX_MASK
67 MMX_DEFAULT=$(mwan3_id2mask MM_DEFAULT MMX_MASK)
68 MMX_BLACKHOLE=$(mwan3_id2mask MM_BLACKHOLE MMX_MASK)
69 MMX_UNREACHABLE=$(mwan3_id2mask MM_UNREACHABLE MMX_MASK)
72 lock /var/run/mwan3.lock
76 lock -u /var/run/mwan3.lock
80 rm -rf /var/run/mwan3.lock
85 local _tmp _iface _iface_count
92 [ "$1" == "$_iface" ] && _tmp=$_iface_count
94 config_foreach mwan3_get_id interface
98 mwan3_set_connected_iptables()
100 local connected_network_v4 connected_network_v6
102 $IPS -! create mwan3_connected_v4 hash:net
103 $IPS create mwan3_connected_v4_temp hash:net
105 for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
106 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
109 for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
110 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
113 $IPS add mwan3_connected_v4_temp 224.0.0.0/3
115 $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
116 $IPS destroy mwan3_connected_v4_temp
118 $IPS -! create mwan3_connected_v6 hash:net family inet6
119 $IPS create mwan3_connected_v6_temp hash:net family inet6
121 for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
122 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
125 $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
126 $IPS destroy mwan3_connected_v6_temp
128 $IPS -! create mwan3_connected list:set
129 $IPS -! add mwan3_connected mwan3_connected_v4
130 $IPS -! add mwan3_connected mwan3_connected_v6
133 mwan3_set_general_rules()
137 for IP in "$IP4" "$IP6"; do
139 RULE_NO=$(($MM_BLACKHOLE+2000))
140 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
141 $IP rule add pref $RULE_NO fwmark $MMX_BLACKHOLE/$MMX_MASK blackhole
144 RULE_NO=$(($MM_UNREACHABLE+2000))
145 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
146 $IP rule add pref $RULE_NO fwmark $MMX_UNREACHABLE/$MMX_MASK unreachable
151 mwan3_set_general_iptables()
155 for IPT in "$IPT4" "$IPT6"; do
157 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
158 $IPT -N mwan3_ifaces_in
161 if ! $IPT -S mwan3_connected &> /dev/null; then
162 $IPT -N mwan3_connected
163 $IPS -! create mwan3_connected list:set
164 $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
167 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
168 $IPT -N mwan3_ifaces_out
171 if ! $IPT -S mwan3_rules &> /dev/null; then
175 if ! $IPT -S mwan3_hook &> /dev/null; then
177 $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
178 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_in
179 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_connected
180 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_out
181 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_rules
182 $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
183 $IPT -A mwan3_hook -m mark ! --mark $MMX_DEFAULT/$MMX_MASK -j mwan3_connected
186 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
187 $IPT -A PREROUTING -j mwan3_hook
190 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
191 $IPT -A OUTPUT -j mwan3_hook
196 mwan3_create_iface_iptables()
198 local id family src_ip src_ipv6
200 config_get family $1 family ipv4
201 mwan3_get_iface_id id $1
203 [ -n "$id" ] || return 0
205 if [ "$family" == "ipv4" ]; then
207 ubus call network.interface.${1}_4 status &>/dev/null
208 if [ "$?" -eq "0" ]; then
209 network_get_ipaddr src_ip ${1}_4
211 network_get_ipaddr src_ip $1
214 $IPS -! create mwan3_connected list:set
216 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
217 $IPT4 -N mwan3_ifaces_in
220 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
221 $IPT4 -N mwan3_ifaces_out
224 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
225 $IPT4 -N mwan3_iface_in_$1
228 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
229 $IPT4 -N mwan3_iface_out_$1
232 $IPT4 -F mwan3_iface_in_$1
233 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
234 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
236 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
237 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
239 $IPT4 -F mwan3_iface_out_$1
240 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
242 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
243 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
246 if [ "$family" == "ipv6" ]; then
248 ubus call network.interface.${1}_6 status &>/dev/null
249 if [ "$?" -eq "0" ]; then
250 network_get_ipaddr6 src_ipv6 ${1}_6
252 network_get_ipaddr6 src_ipv6 $1
255 $IPS -! create mwan3_connected_v6 hash:net family inet6
257 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
258 $IPT6 -N mwan3_ifaces_in
261 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
262 $IPT6 -N mwan3_ifaces_out
265 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
266 $IPT6 -N mwan3_iface_in_$1
269 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
270 $IPT6 -N mwan3_iface_out_$1
273 $IPT6 -F mwan3_iface_in_$1
274 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
275 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
277 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
278 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
280 $IPT6 -F mwan3_iface_out_$1
281 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
283 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
284 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
288 mwan3_delete_iface_iptables()
290 config_get family $1 family ipv4
292 if [ "$family" == "ipv4" ]; then
294 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
295 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
296 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
298 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
299 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
300 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
303 if [ "$family" == "ipv6" ]; then
305 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
306 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
307 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
309 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
310 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
311 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
315 mwan3_create_iface_route()
319 config_get family $1 family ipv4
320 mwan3_get_iface_id id $1
322 [ -n "$id" ] || return 0
324 if [ "$family" == "ipv4" ]; then
325 ubus call network.interface.${1}_4 status &>/dev/null
326 if [ "$?" -eq "0" ]; then
327 network_get_gateway route_args ${1}_4
329 network_get_gateway route_args $1
332 route_args="via $route_args dev $2"
334 $IP4 route flush table $id
335 $IP4 route add table $id default $route_args
338 if [ "$family" == "ipv6" ]; then
340 ubus call network.interface.${1}_6 status &>/dev/null
341 if [ "$?" -eq "0" ]; then
342 network_get_gateway6 route_args ${1}_6
344 network_get_gateway6 route_args $1
347 route_args="via $route_args dev $2"
349 $IP6 route flush table $id
350 $IP6 route add table $id default $route_args
354 mwan3_delete_iface_route()
358 config_get family $1 family ipv4
359 mwan3_get_iface_id id $1
361 [ -n "$id" ] || return 0
363 if [ "$family" == "ipv4" ]; then
364 $IP4 route flush table $id
367 if [ "$family" == "ipv6" ]; then
368 $IP6 route flush table $id
372 mwan3_create_iface_rules()
376 config_get family $1 family ipv4
377 mwan3_get_iface_id id $1
379 [ -n "$id" ] || return 0
381 if [ "$family" == "ipv4" ]; then
383 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
384 $IP4 rule del pref $(($id+1000))
387 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
388 $IP4 rule del pref $(($id+2000))
391 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
392 $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
395 if [ "$family" == "ipv6" ]; then
397 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
398 $IP6 rule del pref $(($id+1000))
401 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
402 $IP6 rule del pref $(($id+2000))
405 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
406 $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
410 mwan3_delete_iface_rules()
414 config_get family $1 family ipv4
415 mwan3_get_iface_id id $1
417 [ -n "$id" ] || return 0
419 if [ "$family" == "ipv4" ]; then
421 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
422 $IP4 rule del pref $(($id+1000))
425 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
426 $IP4 rule del pref $(($id+2000))
430 if [ "$family" == "ipv6" ]; then
432 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
433 $IP6 rule del pref $(($id+1000))
436 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
437 $IP6 rule del pref $(($id+2000))
442 mwan3_delete_iface_ipset_entries()
444 local id setname entry
446 mwan3_get_iface_id id $1
448 [ -n "$id" ] || return 0
450 for setname in $(ipset -n list | grep ^mwan3_sticky_); do
451 for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
452 $IPS del $setname $entry
459 local track_ip track_ips
461 mwan3_list_track_ips()
463 track_ips="$1 $track_ips"
465 config_list_foreach $1 track_ip mwan3_list_track_ips
467 kill $(pgrep -f "mwan3track $1 $2") &> /dev/null
468 if [ -n "$track_ips" ]; then
469 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track "$1" "$2" "$3" "$4" $track_ips &
477 pid="$(pgrep -f "mwan3track $1 $2")"
478 if [ "${pid}" != "" ]; then
481 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
487 local iface_count id iface family metric probability weight
489 config_get iface $1 interface
490 config_get metric $1 metric 1
491 config_get weight $1 weight 1
493 [ -n "$iface" ] || return 0
495 mwan3_get_iface_id id $iface
497 [ -n "$id" ] || return 0
499 config_get family $iface family ipv4
501 if [ "$family" == "ipv4" ]; then
503 if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
504 if [ "$metric" -lt "$lowest_metric_v4" ]; then
506 total_weight_v4=$weight
507 $IPT4 -F mwan3_policy_$policy
508 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
510 lowest_metric_v4=$metric
512 elif [ "$metric" -eq "$lowest_metric_v4" ]; then
514 total_weight_v4=$(($total_weight_v4+$weight))
515 probability=$(($weight*1000/$total_weight_v4))
517 if [ "$probability" -lt 10 ]; then
518 probability="0.00$probability"
519 elif [ $probability -lt 100 ]; then
520 probability="0.0$probability"
521 elif [ $probability -lt 1000 ]; then
522 probability="0.$probability"
527 probability="-m statistic --mode random --probability $probability"
529 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
534 if [ "$family" == "ipv6" ]; then
536 if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
537 if [ "$metric" -lt "$lowest_metric_v6" ]; then
539 total_weight_v6=$weight
540 $IPT6 -F mwan3_policy_$policy
541 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
543 lowest_metric_v6=$metric
545 elif [ "$metric" -eq "$lowest_metric_v6" ]; then
547 total_weight_v6=$(($total_weight_v6+$weight))
548 probability=$(($weight*1000/$total_weight_v6))
550 if [ "$probability" -lt 10 ]; then
551 probability="0.00$probability"
552 elif [ $probability -lt 100 ]; then
553 probability="0.0$probability"
554 elif [ $probability -lt 1000 ]; then
555 probability="0.$probability"
560 probability="-m statistic --mode random --probability $probability"
562 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
568 mwan3_create_policies_iptables()
570 local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
574 config_get last_resort $1 last_resort unreachable
576 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
577 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
580 for IPT in "$IPT4" "$IPT6"; do
582 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
583 $IPT -N mwan3_policy_$1
586 $IPT -F mwan3_policy_$1
588 case "$last_resort" in
590 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "blackhole" -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
593 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
596 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "unreachable" -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
607 config_list_foreach $1 use_member mwan3_set_policy
610 mwan3_set_policies_iptables()
612 config_foreach mwan3_create_policies_iptables policy
615 mwan3_set_sticky_iptables()
619 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
621 if [ "$iface" == "$1" ]; then
623 mwan3_get_iface_id id $1
625 [ -n "$id" ] || return 0
627 for IPT in "$IPT4" "$IPT6"; do
628 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
629 $IPT -I mwan3_rule_$rule -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/$MMX_MASK
630 $IPT -I mwan3_rule_$rule -m mark --mark 0/$MMX_MASK -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
637 mwan3_set_user_iptables_rule()
639 local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
643 config_get sticky $1 sticky 0
644 config_get timeout $1 timeout 600
645 config_get ipset $1 ipset
646 config_get proto $1 proto all
647 config_get src_ip $1 src_ip 0.0.0.0/0
648 config_get src_port $1 src_port 0:65535
649 config_get dest_ip $1 dest_ip 0.0.0.0/0
650 config_get dest_port $1 dest_port 0:65535
651 config_get use_policy $1 use_policy
652 config_get family $1 family any
654 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
655 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
658 if [ -n "$ipset" ]; then
659 ipset="-m set --match-set $ipset dst"
662 if [ -n "$use_policy" ]; then
663 if [ "$use_policy" == "default" ]; then
664 policy="MARK --set-xmark $MMX_DEFAULT/$MMX_MASK"
665 elif [ "$use_policy" == "unreachable" ]; then
666 policy="MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK"
667 elif [ "$use_policy" == "blackhole" ]; then
668 policy="MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK"
670 if [ "$sticky" -eq 1 ]; then
672 policy="mwan3_policy_$use_policy"
674 for IPT in "$IPT4" "$IPT6"; do
675 if ! $IPT -S $policy &> /dev/null; then
679 if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
680 $IPT -N mwan3_rule_$1
683 $IPT -F mwan3_rule_$1
686 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout
687 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout family inet6
688 $IPS -! create mwan3_sticky_$rule list:set
689 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
690 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
692 config_foreach mwan3_set_sticky_iptables interface
694 for IPT in "$IPT4" "$IPT6"; do
695 $IPT -A mwan3_rule_$1 -m mark --mark 0/$MMX_MASK -j $policy
696 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
697 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
700 policy="mwan3_rule_$1"
702 policy="mwan3_policy_$use_policy"
704 for IPT in "$IPT4" "$IPT6"; do
705 if ! $IPT -S $policy &> /dev/null; then
713 if [ "$family" == "any" ]; then
715 for IPT in "$IPT4" "$IPT6"; do
718 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
721 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
726 elif [ "$family" == "ipv4" ]; then
730 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
733 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
737 elif [ "$family" == "ipv6" ]; then
741 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
744 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
751 mwan3_set_user_rules()
755 for IPT in "$IPT4" "$IPT6"; do
757 if ! $IPT -S mwan3_rules &> /dev/null; then
764 config_foreach mwan3_set_user_iptables_rule rule
767 mwan3_set_iface_hotplug_state() {
771 echo -n $state > $MWAN3_STATUS_DIR/iface_state/$iface
774 mwan3_get_iface_hotplug_state() {
777 cat $MWAN3_STATUS_DIR/iface_state/$iface 2>/dev/null || echo "unknown"
780 mwan3_report_iface_status()
782 local device result track_ips tracking IP IPT
784 mwan3_get_iface_id id $1
785 network_get_device device $1
786 config_get enabled "$1" enabled 0
787 config_get family "$1" family ipv4
789 if [ "$family" == "ipv4" ]; then
794 if [ "$family" == "ipv6" ]; then
799 if [ -z "$id" -o -z "$device" ]; then
801 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
802 result="$(mwan3_get_iface_hotplug_state $1)"
803 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
805 elif [ "$enabled" == "1" ]; then
811 mwan3_list_track_ips()
813 track_ips="$1 $track_ips"
815 config_list_foreach $1 track_ip mwan3_list_track_ips
817 if [ -n "$track_ips" ]; then
818 if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
824 tracking="not enabled"
827 echo " interface $1 is $result and tracking is $tracking"
830 mwan3_report_policies_v4()
832 local percent policy share total_weight weight iface
834 for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
835 echo "$policy:" | sed 's/mwan3_policy_//'
837 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
839 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
840 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
841 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
842 percent=$(($weight*100/$total_weight))
843 echo " $iface ($percent%)"
846 echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
855 mwan3_report_policies_v6()
857 local percent policy share total_weight weight iface
859 for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
860 echo "$policy:" | sed 's/mwan3_policy_//'
862 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
864 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
865 for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
866 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
867 percent=$(($weight*100/$total_weight))
868 echo " $iface ($percent%)"
871 echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
880 mwan3_report_connected_v4()
884 if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
885 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
891 mwan3_report_connected_v6()
895 if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
896 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
902 mwan3_report_rules_v4()
904 if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
905 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
909 mwan3_report_rules_v6()
911 if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
912 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
916 mwan3_flush_conntrack()
918 local flush_conntrack
920 config_get flush_conntrack $1 flush_conntrack never
922 if [ -e "$CONNTRACK_FILE" ]; then
923 case $flush_conntrack in
925 [ "$3" = "ifup" ] && {
926 echo f > ${CONNTRACK_FILE}
927 $LOG info "connection tracking flushed on interface $1 ($2) $3"
931 [ "$3" = "ifdown" ] && {
932 echo f > ${CONNTRACK_FILE}
933 $LOG info "connection tracking flushed on interface $1 ($2) $3"
937 echo f > ${CONNTRACK_FILE}
938 $LOG info "connection tracking flushed on interface $1 ($2) $3"
941 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
945 $LOG warning "connection tracking not enabled"
951 rm -rf "$MWAN3_STATUS_DIR/${1}" &> /dev/null
952 [ -d "$MWAN3_STATUS_DIR" ] && {
953 if [ -z "$(ls -A "$MWAN3_STATUS_DIR")" ]; then
954 rm -rf "$MWAN3_STATUS_DIR"