1 #!/bin/sh /etc/rc.common
2 # Copyright 2020-2022 Stan Grishin (stangri@melmac.ca)
3 # shellcheck disable=SC1091,SC2018,SC2019,SC3043,SC3057,SC3060
5 # sysctl net.ipv4.conf.default.rp_filter=1
6 # sysctl net.ipv4.conf.all.rp_filter=1
8 # shellcheck disable=SC2034
10 # shellcheck disable=SC2034
13 if type extra_command
>/dev
/null
2>&1; then
14 extra_command
'status' "Generates output required to troubleshoot routing issues
15 Use '-d' option for more detailed output
16 Use '-p' option to automatically upload data under VPR paste.ee account
17 WARNING: while paste.ee uploads are unlisted, they are still publicly available
18 List domain names after options to include their lookup in report"
19 extra_command
'version' 'Show version information'
20 extra_command
'on_firewall_reload' ' Run service on firewall reload'
21 extra_command
'on_interface_reload' ' Run service on indicated interface reload'
23 # shellcheck disable=SC2034
24 EXTRA_COMMANDS
='on_firewall_reload on_interface_reload status version'
25 # shellcheck disable=SC2034
26 EXTRA_HELP
=" status Generates output required to troubleshoot routing issues
27 Use '-d' option for more detailed output
28 Use '-p' option to automatically upload data under VPR paste.ee account
29 WARNING: while paste.ee uploads are unlisted, they are still publicly available
30 List domain names after options to include their lookup in report"
33 readonly PKG_VERSION
='dev-test'
34 readonly packageName
='pbr'
35 readonly serviceName
="$packageName $PKG_VERSION"
36 readonly serviceTrapSignals
='exit SIGHUP SIGQUIT SIGKILL'
37 readonly packageConfigFile
="/etc/config/${packageName}"
38 readonly packageLockFile
="/var/run/${packageName}.lock"
39 readonly nftTempFile
="/var/run/${packageName}.nft"
40 #readonly nftPermFile="/etc/nftables.d/table-post/30-pbr.nft"
41 readonly dnsmasqFile
="/var/dnsmasq.d/${packageName}"
42 readonly _OK_
='\033[0;32m\xe2\x9c\x93\033[0m'
43 readonly _FAIL_
='\033[0;31m\xe2\x9c\x97\033[0m'
44 readonly __OK__
='\033[0;32m[\xe2\x9c\x93]\033[0m'
45 readonly __FAIL__
='\033[0;31m[\xe2\x9c\x97]\033[0m'
46 readonly _ERROR_
='\033[0;31mERROR\033[0m'
47 readonly _WARNING_
='\033[0;33mWARNING\033[0m'
48 readonly ip_full
='/usr/libexec/ip-full'
49 # shellcheck disable=SC2155
50 readonly ip_bin
="$(command -v ip)"
51 readonly ipTablePrefix
='pbr'
52 # shellcheck disable=SC2155
53 readonly iptables
="$(command -v iptables)"
54 # shellcheck disable=SC2155
55 readonly ip6tables
="$(command -v ip6tables)"
56 # shellcheck disable=SC2155
57 readonly ipset
="$(command -v ipset)"
58 readonly ipsPrefix
='pbr'
59 readonly iptPrefix
='PBR'
60 # shellcheck disable=SC2155
61 readonly agh
="$(command -v AdGuardHome)"
62 readonly aghConfigFile
='/etc/adguardhome.yaml'
63 readonly aghIpsetFile
="/var/run/${packageName}.adguardhome.ipsets"
64 # shellcheck disable=SC2155
65 readonly nft
="$(command -v nft)"
66 readonly nftTable
="fw4"
67 readonly nftPrefix
='pbr'
68 readonly chainsList
='forward input output postrouting prerouting'
70 # package config options
87 wan_ip_rules_priority
=
106 processPolicyWarning
=
107 resolver_set_supported
=
114 errorConfigValidation
) r
="Config ($packageConfigFile) validation failure!";;
115 errorNoIpFull
) r
="ip-full binary cannot be found!";;
116 errorNoIptables
) r
="iptables binary cannot be found!";;
117 errorNoIpset
) r
="Resolver set support (${resolver_set}) requires ipset, but ipset binary cannot be found!";;
118 errorNoNft
) r
="Resolver set support (${resolver_set}) requires nftables, but nft binary cannot be found!";;
119 errorResolverNotSupported
) r
="Resolver set (${resolver_set}) is not supported on this system!";;
120 errorServiceDisabled
) r
="The ${packageName} service is currently disabled!";;
121 errorNoWanGateway
) r
="The ${serviceName} service failed to discover WAN gateway!";;
122 errorIpsetNameTooLong
) r
="The ipset name '%s' is longer than allowed 31 characters!";;
123 errorNftsetNameTooLong
) r
="The nft set name '%s' is longer than allowed 31 characters!";;
124 errorUnexpectedExit
) r
="Unexpected exit or service termination: '%s'!";;
125 errorPolicyNoSrcDest
) r
="Policy '%s' has no source/destination parameters!";;
126 errorPolicyNoInterface
) r
="Policy '%s' has no assigned interface!";;
127 errorPolicyUnknownInterface
) r
="Policy '%s' has an unknown interface!";;
128 errorPolicyProcessCMD
) r
="'%s'!";;
129 errorFailedSetup
) r
="Failed to set up '%s'!";;
130 errorFailedReload
) r
="Failed to reload '%s'!";;
131 errorUserFileNotFound
) r
="Custom user file '%s' not found or empty!";;
132 errorUserFileSyntax
) r
="Syntax error in custom user file '%s'!";;
133 errorUserFileRunning
) r
="Error running custom user file '%s'!";;
134 errorUserFileNoCurl
) r
="Use of 'curl' is detected in custom user file '%s', but 'curl' isn't installed!";;
135 errorNoGateways
) r
="Failed to set up any gateway!";;
136 errorResolver
) r
="Resolver '%s'!";;
137 errorPolicyProcessNoIpv6
) r
="Skipping IPv6 policy '%s' as IPv6 support is disabled!";;
138 errorPolicyProcessUnknownFwmark
) r
="Unknown packet mark for interface '%s'!";;
139 errorPolicyProcessMismatchFamily
) r
="Mismatched IP family between in policy '%s'!";;
140 errorPolicyProcessUnknownProtocol
) r
="Unknown protocol in policy '%s'!";;
141 errorPolicyProcessInsertionFailed
) r
="Insertion failed for both IPv4 and IPv6 for policy '%s'!";;
142 errorPolicyProcessInsertionFailedIpv4
) r
="Insertion failed for IPv4 for policy '%s'!";;
143 errorInterfaceRoutingEmptyValues
) r
="Received empty tid/mark or interface name when setting up routing!";;
144 errorFailedToResolve
) r
="Failed to resolve '%s'!";;
145 warningInvalidOVPNConfig
) r
="Invalid OpenVPN config for '%s' interface.";;
146 warningResolverNotSupported
) r
="Resolver set (${resolver_set}) is not supported on this system.";;
147 warningAGHVersionTooLow
) r
="Installed AdGuardHome ('%s') doesn't support 'ipset_file' option.";;
148 warningPolicyProcessCMD
) r
="'%s'";;
149 warningTorUnsetParams
) r
="Please unset 'src_addr', 'src_port' and 'dest_port' for policy '%s'.";;
150 warningTorUnsetProto
) r
="Please unset 'proto' or set 'proto' to 'all' for policy '%s'.";;
151 warningTorUnsetChainIpt
) r
="Please unset 'chain' or set 'chain' to 'PREROUTING' for policy '%s'.";;
152 warningTorUnsetChainNft
) r
="Please unset 'chain' or set 'chain' to 'prerouting' for policy '%s'.";;
153 warningOutdatedWebUIApp
) r
="The WebUI application is outdated (version %s), please update it.";;
158 version
() { echo "$PKG_VERSION"; }
159 output_ok
() { output
1 "$_OK_"; output
2 "$__OK__\\n"; }
160 output_okn
() { output
1 "$_OK_\\n"; output
2 "$__OK__\\n"; }
161 output_fail
() { s
=1; output
1 "$_FAIL_"; output
2 "$__FAIL__\\n"; }
162 output_failn
() { output
1 "$_FAIL_\\n"; output
2 "$__FAIL__\\n"; }
163 # shellcheck disable=SC2317
164 str_replace
() { printf "%b" "$1" |
sed -e "s/$(printf "%b
" "$2")/$(printf "%b
" "$3")/g"; }
165 str_replace
() { echo "${1//$2/$3}"; }
166 str_contains
() { [ -n "$1" ] && [ -n "$2" ] && [ "${1//$2}" != "$1" ]; }
167 is_greater
() { test "$(printf '%s\n' "$@
" | sort -V | head -n 1)" != "$1"; }
168 is_greater_or_equal
() { test "$(printf '%s\n' "$@
" | sort -V | head -n 1)" = "$2"; }
169 str_contains_word
() { echo "$1" |
grep -q -w "$2"; }
170 str_to_lower
() { echo "$1" |
tr 'A-Z' 'a-z'; }
171 str_to_upper
() { echo "$1" |
tr 'a-z' 'A-Z'; }
172 str_extras_to_underscore
() { echo "$1" |
tr '[\. ~`!@#$%^&*()\+/,<>?//;:]' '_'; }
173 str_extras_to_space
() { echo "$1" |
tr ';{}' ' '; }
174 debug
() { local i j
; for i
in "$@"; do eval "j=\$$i"; echo "${i}: ${j} "; done; }
176 # Can take a single parameter (text) to be output at any verbosity
177 # Or target verbosity level and text to be output at specifc verbosity
178 local msg memmsg logmsg
179 local sharedMemoryOutput="/dev
/shm
/$packageName-output"
180 verbosity="${verbosity:-2}"
181 if [ "$#" -ne 1 ]; then
182 if [ $((verbosity & $1)) -gt 0 ] || [ "$verbosity" = "$1" ]; then shift; else return 0; fi
184 [ -t 1 ] && printf "%b
" "$1"
185 msg="${1//$serviceName /service }";
186 if [ "$
(printf "%b" "$msg" |
wc -l)" -gt 0 ]; then
187 [ -s "$sharedMemoryOutput" ] && memmsg="$
(cat "$sharedMemoryOutput")"
188 logmsg="$
(printf "%b" "${memmsg}${msg}" |
sed 's/\x1b\[[0-9;]*m//g')"
189 logger -t "${packageName:-service}" "$
(printf "%b" "$logmsg")"
190 rm -f "$sharedMemoryOutput"
192 printf "%b
" "$msg" >> "$sharedMemoryOutput"
195 is_present() { command -v "$1" >/dev/null 2>&1; }
196 is_installed() { [ -s "/usr
/lib
/opkg
/info
/${1}.control
" ]; }
197 is_variant_installed() { [ "$
(echo /usr
/lib
/opkg
/info
/"${1}"*.control)" != "/usr/lib/opkg/info/${1}*.control" ]; }
198 is_nft() { [ -x "$nft" ] && ! str_contains "$resolver_set" 'ipset' && "$nft" list chains inet | grep -q "${nftPrefix}_prerouting
"; }
199 _find_firewall_wan_zone() { [ "$
(uci
-q get
"firewall.${1}.name")" = "wan
" ] && firewallWanZone="$1"; }
200 _build_ifaces_all() { ifacesAll="${ifacesAll}${1} "; }
201 _build_ifaces_supported
() { is_supported_interface
"$1" && ! str_contains
"$ifacesSupported" "$1" && ifacesSupported
="${ifacesSupported}${1} "; }
203 local iface i param="$2"
204 [ "$param" = 'wan6' ] || param='wan'
205 "network_find_
${param}" iface
206 is_tunnel "$iface" && unset iface
207 if [ -z "$iface" ]; then
208 for i in $ifacesAll; do
209 if "is_
${param}" "$i"; then break; else unset i; fi
212 eval "$1"='${iface:-$i}'
215 local iface="$2" dev="$3" gw
216 network_get_gateway gw "$iface" true
217 if [ -z "$gw" ] || [ "$gw" = '0.0.0.0' ]; then
218 # gw="$
(ubus call
"network.interface.${iface}" status | jsonfilter
-e "@.route[0].nexthop")"
219 gw="$
($ip_bin -4 a list dev
"$dev" 2>/dev
/null |
grep inet |
awk '{print $2}' |
awk -F "/" '{print $1}')"
224 local iface="$2" dev="$3" gw
225 network_get_gateway6 gw "$iface" true
226 if [ -z "$gw" ] || [ "$gw" = '::/0' ] || [ "$gw" = '::0/0' ] || [ "$gw" = '::' ]; then
227 gw="$
($ip_bin -6 a list dev
"$dev" 2>/dev
/null |
grep inet6 |
grep 'scope global' |
awk '{print $2}')"
231 is_dslite() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:6}" = "dslite
" ]; }
232 is_l2tp() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:4}" = "l2tp
" ]; }
233 is_oc() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:11}" = "openconnect
" ]; }
234 # is_ovpn() { local dev; network_get_device dev "$1"; [ "${dev:0:3}" = "tun" ] || [ "${dev:0:3}" = "tap" ] || [ -f "/sys/devices/virtual/net/${dev}/tun_flags" ]; }
235 is_ovpn
() { local dev
; dev
="$(uci -q get "network.
${1}.device")"; [ -z "$dev" ] && dev="$(uci -q get "network.${1}.dev")"; [ "${dev:0:3}" = "tun" ] || [ "${dev:0:3}" = "tap" ] || [ -f "/sys/devices/virtual/net/${dev}/tun_flags" ]; }
236 is_valid_ovpn
() { local dev_net dev_ovpn
; dev_net
="$(uci -q get "network.
${1}.device")"; [ -z "$dev_net" ] && dev_net="$(uci -q get "network.${1}.dev")"; dev_ovpn="$(uci -q get "openvpn.${1}.dev")"; [ -n "$dev_net" ] && [ -n "$dev_ovpn" ] && [ "$dev_net" = "$dev_ovpn" ]; }
237 is_pptp
() { local proto
; proto
=$
(uci
-q get network.
"$1".proto
); [ "${proto:0:4}" = "pptp" ]; }
238 is_softether
() { local dev
; network_get_device dev
"$1"; [ "${dev:0:4}" = "vpn_" ]; }
239 is_tor
() { [ "$(str_to_lower "$1")" = "tor" ]; }
242 if [ -s "/etc/tor/torrc" ]; then
243 json_load
"$(ubus call service list "{ 'name': 'tor' }")"
244 json_select
'tor'; json_select
'instances'; json_select
'instance1';
245 json_get_var ret
'running'; json_cleanup
247 if [ "$ret" = "0" ]; then return 1; else return 0; fi
249 is_wg
() { local proto
; proto
=$
(uci
-q get network.
"$1".proto
); [ "${proto:0:9}" = "wireguard" ]; }
250 is_tunnel
() { is_dslite
"$1" || is_l2tp
"$1" || is_oc
"$1" || is_ovpn
"$1" || is_pptp
"$1" || is_softether
"$1" || is_tor
"$1" || is_wg
"$1"; }
251 is_wan
() { [ "$1" = "$wanIface4" ] ||
{ [ "${1##wan}" != "$1" ] && [ "${1##wan6}" = "$1" ]; } || [ "${1%%wan}" != "$1" ]; }
252 is_wan6() { [ -n "$wanIface6" ] && [ "$1" = "$wanIface6" ] || [ "${1/#wan6}" != "$1" ] || [ "${1/%wan6}" != "$1" ]; }
253 is_ignored_interface
() { str_contains_word
"$ignored_interface" "$1"; }
254 is_supported_interface
() { str_contains_word
"$supported_interface" "$1" ||
{ ! is_ignored_interface
"$1" && { is_wan
"$1" || is_wan6
"$1" || is_tunnel
"$1"; }; } || is_ignore_target
"$1"; }
255 is_ignore_target
() { [ "$(str_to_lower "$1")" = 'ignore' ]; }
256 is_mac_address
() { expr "$1" : '[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]$' >/dev
/null
; }
257 is_ipv4
() { expr "$1" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev
/null
; }
258 is_ipv6
() { ! is_mac_address
"$1" && str_contains
"$1" ":"; }
259 is_family_mismatch
() { ( is_netmask
"${1//!}" && is_ipv6 "${2//!}" ) || ( is_ipv6 "${1//!}" && is_netmask "${2//!}" ); }
260 is_ipv6_link_local() { [ "${1:0:4}" = "fe80
" ]; }
261 is_ipv6_unique_local() { [ "${1:0:2}" = "fc" ] || [ "${1:0:2}" = "fd" ]; }
262 is_ipv6_global
() { [ "${1:0:4}" = "2001" ]; }
263 # is_ipv6_global() { is_ipv6 "$1" && ! is_ipv6_link_local "$1" && ! is_ipv6_link_local "$1"; }
264 is_list
() { str_contains
"$1" "," || str_contains
"$1" " "; }
265 is_netmask
() { local ip
="${1%/*}"; [ "$ip" != "$1" ] && is_ipv4
"$ip"; }
266 is_domain
() { ! is_ipv6
"$1" && str_contains
"$1" '[a-zA-Z]'; }
267 is_phys_dev
() { [ "${1:0:1}" = "@" ] && ip l show | grep -E -q "^\\d+\\W+${1:1}"; }
268 dnsmasq_kill() { killall -q -s HUP dnsmasq; }
269 dnsmasq_restart() { output 3 'Restarting dnsmasq '; if /etc/init.d/dnsmasq restart >/dev/null 2>&1; then output_okn; else output_failn; fi; }
270 is_default_dev() { [ "$1" = "$
($ip_bin -4 r |
grep -m1 'dev' |
grep -Eso 'dev [^ ]*' |
awk '{print $2}')" ]; }
271 is_supported_iface_dev() { local n dev; for n in $ifacesSupported; do network_get_device dev "$n"; [ "$1" = "$dev" ] && return 0; done; return 1; }
272 is_supported_protocol() { grep -o '^[^#]*' /etc/protocols | grep -w -v '0' | grep . | awk '{print $1}' | grep -q "$1"; }
273 is_service_running_iptables() { [ -x "$iptables" ] && "$iptables" -t mangle -L | grep -q "${iptPrefix}_PREROUTING
" >/dev/null 2>&1; }
274 is_service_running_nft() { [ -x "$nft" ] && [ -n "$
(get_mark_nft_chains
)" ]; }
276 # is_service_running_nft() { [ -x "$nft" ] && [ -s "$nftPermFile" ]; }
277 is_service_running() { if is_nft; then is_service_running_nft; else is_service_running_iptables; fi; }
278 is_netifd_table() { local iface="$1"; [ "$
(uci
-q get
"network.${iface}.ip4table")" = "${packageName}_${iface%6}" ]; }
279 get_rt_tables_id() { local iface="$1"; grep "${ipTablePrefix}_${iface}\$" '/etc/iproute2/rt_tables' | awk '{print $1;}'; }
280 get_rt_tables_next_id() { echo "$(($(sort -r -n '/etc
/iproute
2/rt_tables
' | grep -o -E -m 1 "^[0-9]+")+1))"; }
281 _check_config() { local en; config_get_bool en "$1" 'enabled
' 1; [ "$en" -gt 0 ] && _cfg_enabled=0; }
282 is_config_enabled() {
283 local cfg="$1" _cfg_enabled=1
284 [ -n "$1" ] || return 1
285 config_load "$packageName"
286 config_foreach _check_config "$cfg"
287 return "$_cfg_enabled"
289 # shellcheck disable=SC2016
290 resolveip_to_ipt() { resolveip "$@" | sed -n 'H
;${x;s/\n/,/g;s/^,//;p;};d
'; }
291 resolveip_to_ipt4() { resolveip_to_ipt -4 "$@"; }
292 resolveip_to_ipt6() { [ -n "$ipv6_enabled" ] && resolveip_to_ipt -6 "$@"; }
293 # shellcheck disable=SC2016
294 resolveip_to_nftset() { resolveip "$@" | sed -n 'H
;${x;s/\n/,/g;s/^,//;p;};d
' | tr '\n' ' '; }
295 resolveip_to_nftset4() { resolveip_to_nftset -4 "$@"; }
296 resolveip_to_nftset6() { [ -n "$ipv6_enabled" ] && resolveip_to_nftset -6 "$@"; }
297 # shellcheck disable=SC2016
298 ipv4_leases_to_nftset() { [ -s '/tmp
/dhcp.leases
' ] || return 1; grep "$1" '/tmp
/dhcp.leases
' | awk '{print
$3}' | sed -n 'H
;${x;s/\n/,/g;s/^,//;p;};d
' | tr '\n' ' '; }
299 # shellcheck disable=SC2016
300 ipv6_leases_to_nftset() { [ -s '/tmp
/hosts
/odhcpd
' ] || return 1; grep -v '^\
#' '/tmp/hosts/odhcpd' | grep "$1" | awk '{print $1}' | sed -n 'H;${x;s/\n/,/g;s/^,//;p;};d' | tr '\n' ' '; }
301 # shellcheck disable=SC3037
302 ports_to_nftset
() { echo -ne "$value"; }
303 get_mark_ipt_chains
() { [ -n "$(command -v iptables-save)" ] && iptables-save |
grep ":${iptPrefix}_MARK_" |
awk '{ print $1 }' |
sed 's/://'; }
304 get_mark_nft_chains
() { [ -x "$nft" ] && "$nft" list table inet
"$nftTable" 2>/dev
/null |
grep chain |
grep "${nftPrefix}_mark_" |
awk '{ print $2 }'; }
305 get_ipsets
() { [ -x "$(command -v ipset)" ] && ipset list |
grep "${ipsPrefix}_" |
awk '{ print $2 }'; }
306 get_nft_sets
() { [ -x "$nft" ] && "$nft" list table inet
"$nftTable" 2>/dev
/null |
grep 'set' |
grep "${nftPrefix}_" |
awk '{ print $2 }'; }
307 is_ipset_type_supported
() { ipset
help hash:"$1" >/dev
/null
2>&1; }
308 ubus_get_status
() { ubus call service list
"{ 'name': '$packageName' }" | jsonfilter
-e "@.${packageName}.instances.main.data.status.${1}"; }
309 ubus_get_iface() { ubus call service list "{ 'name': '$packageName' }" | jsonfilter -e "@.
${packageName}.instances.main.data.interfaces[@.name='${1}']${2:+.$2}"; }
310 opkg_get_version
() { grep -m1 -A1 "Package: $1$" '/usr/lib/opkg/status' |
grep -m1 'Version: ' |
sed 's|Version: \(.*\)|\1|'; }
312 load_package_config
() {
313 config_load
"$packageName"
314 config_get boot_timeout
'config' 'boot_timeout' '30'
315 config_get_bool enabled
'config' 'enabled' '0'
316 config_get fw_mask
'config' 'fw_mask' 'ff0000'
317 config_get icmp_interface
'config' 'icmp_interface'
318 config_get ignored_interface
'config' 'ignored_interface'
319 config_get_bool ipv6_enabled
'config' 'ipv6_enabled' '0'
320 config_get nft_user_set_policy
'config' 'nft_user_set_policy' 'memory'
321 config_get_bool nft_user_set_counter
'config' 'nft_user_set_counter' '0'
322 config_get procd_boot_delay
'config' 'procd_boot_delay' '0'
323 config_get resolver_set
'config' 'resolver_set'
324 config_get rule_create_option
'config' 'rule_create_option' 'add'
325 config_get_bool secure_reload
'config' 'secure_reload' '1'
326 config_get_bool strict_enforcement
'config' 'strict_enforcement' '0'
327 config_get supported_interface
'config' 'supported_interface'
328 config_get verbosity
'config' 'verbosity' '2'
329 config_get wan_ip_rules_priority
'config' 'wan_ip_rules_priority' '30000'
330 config_get wan_mark
'config' 'wan_mark' '010000'
331 fw_mask
="0x${fw_mask}"
332 wan_mark
="0x${wan_mark}"
333 [ -n "$ipv6_enabled" ] && [ "$ipv6_enabled" -eq 0 ] && unset ipv6_enabled
334 .
/lib
/functions
/network.sh
335 .
/usr
/share
/libubox
/jshn.sh
336 mkdir
-p "${dnsmasqFile%/*}"
338 fw_maskXor
="$(printf '%#x' "$
((fw_mask ^
0xffffffff))")"
339 fw_maskXor
="${fw_maskXor:-0xff00ffff}"
340 if [ "$nft_user_set_counter" -eq '0' ]; then
341 unset nft_user_set_counter
344 case $rule_create_option in
345 insert|
-i|
-I) rule_create_option
='-I';;
346 add|
-a|
-A|
*) rule_create_option
='-A';;
352 local param
="$1" validation_result
="$2"
356 if [ -n "$validation_result" ] && [ "$validation_result" != '0' ]; then
357 output
"${_ERROR_}: The $packageName config validation failed!\\n"
358 output
"Please check if the '$packageConfigFile' contains correct values for config options.\\n"
359 state add
'errorSummary' 'errorConfigValidation'
362 if [ "$enabled" -eq 0 ]; then
363 state add
'errorSummary' 'errorServiceDisabled'
366 if [ ! -x "$ip_bin" ]; then
367 state add
'errorSummary' 'errorNoIpFull'
371 if [ -z "$iptables" ] ||
[ ! -x "$iptables" ]; then
372 state add
'errorSummary' 'errorNoIptables'
376 rm -f "$packageLockFile"
377 resolver
'check_support'
380 touch "$packageLockFile"
383 load_network
"$param"
388 config_load
'network'
389 [ -z "$ifacesAll" ] && config_foreach _build_ifaces_all
'interface'
390 if [ -z "$ifacesSupported" ]; then
391 config_load
'firewall'
392 config_foreach _find_firewall_wan_zone
'zone'
393 for i
in $
(uci
-q get
"firewall.${firewallWanZone}.network"); do
394 is_supported_interface
"$i" && ! str_contains
"$ifacesSupported" "$1" && ifacesSupported
="${ifacesSupported}${i} "
396 config_load
'network'
397 config_foreach _build_ifaces_supported
'interface'
399 pbr_find_iface wanIface4
'wan'
400 [ -n "$ipv6_enabled" ] && pbr_find_iface wanIface6
'wan6'
401 [ -n "$wanIface4" ] && network_get_gateway wanGW4
"$wanIface4"
402 [ -n "$wanIface6" ] && network_get_gateway6 wanGW6
"$wanIface6"
403 wanGW
="${wanGW4:-$wanGW6}"
409 while [ -z "$wanGW" ] ; do
411 if [ $
((sleepCount
)) -gt $
((boot_timeout
)) ] ||
[ -n "$wanGW" ]; then break; fi
412 output
"$serviceName waiting for wan gateway...\\n"
415 sleepCount
=$
((sleepCount
+1))
417 if [ -n "$wanGW" ]; then
420 state add
'errorSummary' 'errorNoWanGateway'
425 # shellcheck disable=SC2086
428 [ -x "$iptables" ] ||
return 1
429 for d
in "${*//-A/-D}" "${*//-I/-D}" "${*//-N/-F}" "${*//-N/-X}"; do
430 [ "$d" != "$*" ] && "$iptables" $d >/dev
/null
2>&1
432 d
="$*"; "$iptables" $d >/dev
/null
2>&1
435 # shellcheck disable=SC2086
438 [ -n "$ipv6_enabled" ] ||
return 0
439 [ -x "$ip6tables" ] ||
return 1
440 for d
in "${*//-A/-D}" "${*//-I/-D}" "${*//-N/-F}" "${*//-N/-X}"; do
441 [ "$d" != "$*" ] && "$ip6tables" $d >/dev
/null
2>&1
444 "$ip6tables" $d >/dev
/null
2>&1
447 # shellcheck disable=SC2086
449 local d failFlagIpv4
=1 failFlagIpv6
=1
450 [ -x "$iptables" ] ||
return 1
451 for d
in "${*//-A/-D}" "${*//-I/-D}" "${*//-N/-F}" "${*//-N/-X}"; do
452 if [ "$d" != "$*" ]; then
453 "$iptables" $d >/dev
/null
2>&1
454 [ -x "$ip6tables" ] && "$ip6tables" $d >/dev
/null
2>&1
457 d
="$*"; "$iptables" $d >/dev
/null
2>&1 && failFlagIpv4
=0;
458 if [ -n "$ipv6_enabled" ] && [ -x "$ip6tables" ]; then
459 "$ip6tables" $d >/dev
/null
2>&1 && failFlagIpv6
=0
461 [ "$failFlagIpv4" -eq 0 ] ||
[ "$failFlagIpv6" -eq 0 ]
464 # shellcheck disable=SC2086
465 ips4
() { [ -x "$ipset" ] && "$ipset" "$@" >/dev
/null
2>&1; }
466 ips6
() { [ -x "$ipset" ] && { if [ -n "$ipv6_enabled" ] && [ -n "$*" ]; then "$ipset" "$@" >/dev
/null
2>&1; else return 1; fi; }; }
468 local command="$1" iface
="$2" target
="${3:-dst}" type="${4:-ip}" uid
="$5" comment
="$6" param
="$7" mark
="$7"
469 local ipset4 ipset6 i
470 local ipv4_error
=1 ipv6_error
=1
471 ipset4
="${ipsPrefix}${iface:+_$iface}_4${target:+_$target}${type:+_$type}${uid:+_$uid}"
472 ipset6
="${ipsPrefix}${iface:+_$iface}_6${target:+_$target}${type:+_$type}${uid:+_$uid}"
474 [ -x "$ipset" ] ||
return 1
476 if [ "${#ipset4}" -gt 31 ]; then
477 state add
'errorSummary' 'errorIpsetNameTooLong' "$ipset4"
483 ips4
-q -! add
"$ipset4" ["$param"] comment
"$comment" && ipv4_error
=0
484 ips6
-q -! add
"$ipset6" ["$param"] comment
"$comment" && ipv6_error
=0
487 [ -n "$ipv6_enabled" ] ||
unset ipset6
488 echo "${param}/${ipset4}${ipset6:+,$ipset6}" >> "$aghIpsetFile" && ipv4_error
=0
491 [ -n "$ipv6_enabled" ] ||
unset ipset6
492 echo "ipset=/${param}/${ipset4}${ipset6:+,$ipset6} # $comment" >> "$dnsmasqFile" && ipv4_error
=0
495 ips4
-q -! create
"$ipset4" "hash:$type" comment
&& ipv4_error
=0
496 ips6
-q -! create
"$ipset6" "hash:$type" comment family inet6
&& ipv6_error
=0
499 ips4
-q -! create
"$ipset4" "hash:$type" comment
&& ipv4_error
=0
500 ips6
-q -! create
"$ipset6" "hash:$type" comment family inet6
&& ipv6_error
=0
503 ips4
-q -! create
"$ipset4" "hash:$type" comment
&& ipv4_error
=0
504 ips6
-q -! create
"$ipset6" "hash:$type" comment family inet6
&& ipv6_error
=0
509 ips4
-q -! create
"$ipset4" "hash:$type" comment
&& ipv4_error
=0
510 ips6
-q -! create
"$ipset6" "hash:$type" comment family inet6
&& ipv6_error
=0
513 ipt4
-t mangle
-A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" dst -g "${iptPrefix}_MARK_${mark}" && ipv4_error
=0
514 ipt6
-t mangle
-A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" dst -g "${iptPrefix}_MARK_${mark}" && ipv6_error
=0
517 ipt4
-t mangle
-A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error
=0
518 ipt6
-t mangle
-A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error
=0
523 ips4
-q -! create
"$ipset4" "hash:$type" comment
&& ipv4_error
=0
524 ips6
-q -! create
"$ipset6" "hash:$type" comment family inet6
&& ipv4_error
=0
525 ipt4
-t mangle
-A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error
=0
526 ipt6
-t mangle
-A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error
=0
531 ips4
-q -! destroy
"$ipset4" && ipv4_error
=0
532 ips6
-q -! destroy
"$ipset6" && ipv6_error
=0
535 ips4
-q -! destroy
"$ipset4" && ipv4_error
=0
536 ips6
-q -! destroy
"$ipset6" family inet6
&& ipv6_error
=0
541 ipt4
-t mangle
-D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" dst -g "${iptPrefix}_MARK_${mark}" && ipv4_error
=0
542 ipt6
-t mangle
-D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" dst -g "${iptPrefix}_MARK_${mark}" && ipv6_error
=0
545 ipt4
-t mangle
-D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error
=0
546 ipt6
-t mangle
-D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error
=0
551 ipt4
-t mangle
-D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error
=0
552 ipt6
-t mangle
-D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error
=0
556 flush|flush_user_set
)
557 ips4
-q -! flush
"$ipset4" && ipv4_error
=0
558 ips6
-q -! flush
"$ipset6" && ipv6_error
=0
561 if [ "$ipv4_error" -eq '0' ] ||
[ "$ipv6_error" -eq '0' ]; then
569 #nfta() { echo "$@" >> "$nftTempFile"; }
570 #nfta4() { echo "$@" >> "$nftTempFile"; }
571 #nfta6() { [ -z "$ipv6_enabled" ] || echo "$@" >> "$nftTempFile"; }
572 #nft() { nfta "$@"; [ -x "$nft" ] && "$nft" "$@" >/dev/null 2>&1; }
573 #nft4() { nfta "$@"; [ -x "$nft" ] && "$nft" "$@" >/dev/null 2>&1; }
574 #nft6() { nfta "$@"; [ -n "$ipv6_enabled" ] || return 0; [ -x "$nft" ] && [ -n "$*" ] && "$nft" "$@" >/dev/null 2>&1; }
575 nft
() { [ -x "$nft" ] && "$nft" "$@" >/dev
/null
2>&1; }
576 nft4
() { [ -x "$nft" ] && "$nft" "$@" >/dev
/null
2>&1; }
577 nft6
() { [ -n "$ipv6_enabled" ] ||
return 0; [ -x "$nft" ] && [ -n "$*" ] && "$nft" "$@" >/dev
/null
2>&1; }
579 local command="$1" iface
="$2" target
="${3:-dst}" type="${4:-ip}" uid
="$5" comment
="$6" param
="$7" mark
="$7"
580 local nftset4 nftset6 i param4 param6
581 local ipv4_error
=1 ipv6_error
=1
582 nftset4
="${nftPrefix}${iface:+_$iface}_4${target:+_$target}${type:+_$type}${uid:+_$uid}"
583 nftset6
="${nftPrefix}${iface:+_$iface}_6${target:+_$target}${type:+_$type}${uid:+_$uid}"
585 [ -x "$nft" ] ||
return 1
587 if [ "${#nftset4}" -gt 255 ]; then
588 state add
'errorSummary' 'errorNftsetNameTooLong' "$nftset4"
594 if is_netmask
"$param" || is_ipv4
"$param" || is_ipv6
"$param" \
595 || is_mac_address
"$param" || is_list
"$param"; then
596 nft4 add element inet
"$nftTable" "$nftset4" "{ $param }" && ipv4_error
=0
597 nft6 add element inet
"$nftTable" "$nftset6" "{ $param }" && ipv6_error
=0
599 if [ "$target" = 'src' ]; then
600 param4
="$(ipv4_leases_to_nftset "$param")"
601 param6
="$(ipv6_leases_to_nftset "$param")"
603 [ -z "$param4" ] && param4
="$(resolveip_to_nftset4 "$param")"
604 [ -z "$param6" ] && param6
="$(resolveip_to_nftset6 "$param")"
605 if [ -z "$param4" ] && [ -z "$param6" ]; then
606 state add
'errorSummary' 'errorFailedToResolve' "$param"
608 nft4 add element inet
"$nftTable" "$nftset4" "{ $param4 }" && ipv4_error
=0
609 nft6 add element inet
"$nftTable" "$nftset6" "{ $param6 }" && ipv6_error
=0
614 [ -n "$ipv6_enabled" ] ||
unset nftset6
615 echo "nftset=/${param}/4#inet#${nftTable}#${nftset4}${nftset6:+,6#inet#${nftTable}#$nftset6} # $comment" >> "$dnsmasqFile" && ipv4_error
=0
620 nft4 add
set inet
"$nftTable" "$nftset4" "{ type ipv4_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv4_error
=0
621 nft6 add
set inet
"$nftTable" "$nftset6" "{ type ipv6_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv6_error
=0
624 nft4 add
set inet
"$nftTable" "$nftset4" "{ type ether_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv4_error
=0
625 nft6 add
set inet
"$nftTable" "$nftset6" "{ type ether_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv6_error
=0
630 nft4 add
set inet
"$nftTable" "$nftset4" "{ type ipv4_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv4_error
=0
631 nft6 add
set inet
"$nftTable" "$nftset6" "{ type ipv6_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv6_error
=0
636 nft4 add
set inet
"$nftTable" "$nftset4" "{ type ipv4_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv4_error
=0
637 nft6 add
set inet
"$nftTable" "$nftset6" "{ type ipv6_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv6_error
=0
640 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error
=0
641 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error
=0
644 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error
=0
645 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error
=0
650 nft4 add
set inet
"$nftTable" "$nftset4" "{ type ether_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv4_error
=0
651 nft6 add
set inet
"$nftTable" "$nftset6" "{ type ether_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv6_error
=0
652 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error
=0
653 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error
=0
658 nft delete
set inet
"$nftTable" "$nftset4" && ipv4_error
=0
659 nft delete
set inet
"$nftTable" "$nftset6" && ipv6_error
=0
662 nft delete
set inet
"$nftTable" "$nftset4" && ipv4_error
=0
663 nft delete
set inet
"$nftTable" "$nftset6" && ipv6_error
=0
668 nft delete rule inet
"$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error
=0
669 nft delete rule inet
"$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error
=0
672 nft delete rule inet
"$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error
=0
673 nft delete rule inet
"$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error
=0
678 nft delete rule inet
"$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error
=0
679 nft delete rule inet
"$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error
=0
683 flush|flush_user_set
)
684 nft flush
set inet
"$nftTable" "$nftset4" && ipv4_error
=0
685 nft flush
set inet
"$nftTable" "$nftset6" && ipv6_error
=0
688 # nft6 returns true if IPv6 support is not enabled
689 [ -z "$ipv6_enabled" ] && ipv6_error
='1'
690 if [ "$ipv4_error" -eq '0' ] ||
[ "$ipv6_error" -eq '0' ]; then
697 cleanup_rt_tables
() { sed -i '/pbr_/d' '/etc/iproute2/rt_tables'; sync
; }
698 cleanup_dnsmasq
() { [ -s "$dnsmasqFile" ] && resolverStoredHash
="$(md5sum $dnsmasqFile | awk '{ print $1; }')" && rm "$dnsmasqFile" >/dev
/null
2>&1; }
700 cleanup_main_chains
() {
702 for i
in $chainsList; do
703 i
="$(str_to_lower "$i")"
704 nft flush chain inet
"$nftTable" "${nftPrefix}_${i}"
706 for i
in $chainsList; do
707 i
="$(str_to_upper "$i")"
708 ipt
-t mangle
-D "${i}" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
709 ipt
-t mangle
-F "${iptPrefix}_${i}"
710 ipt
-t mangle
-X "${iptPrefix}_${i}"
714 cleanup_marking_chains
() {
716 for i
in $
(get_mark_nft_chains
); do
717 nft flush chain inet
"$nftTable" "$i"
718 nft delete chain inet
"$nftTable" "$i"
720 for i
in $
(get_mark_ipt_chains
); do
721 ipt
-t mangle
-F "$i"
722 ipt
-t mangle
-X "$i"
728 for i
in $
(get_nft_sets
); do
729 nft flush
set inet
"$nftTable" "$i"
730 nft delete
set inet
"$nftTable" "$i"
732 for i
in $
(get_ipsets
); do
733 ipset
-q -! flush
"$i" >/dev
/null
2>&1
734 ipset
-q -! destroy
"$i" >/dev
/null
2>&1
739 local action
="$1" param
="$2" value
="${3//#/_}"
741 # shellcheck disable=SC2124
743 local line error_id error_extra label
746 line
="$(eval echo "\$
$param")"
747 eval "$param"='${line:+$line#}${value}${extras:+ $extras}'
751 json_add_object
"$packageName"
754 json_add_array
'errors';;
756 json_add_array
'warnings';;
758 if [ -n "$(eval echo "\$
$param")" ]; then
759 while read -r line
; do
760 if str_contains
"$line" ' '; then
761 error_id
="${line% *}"
762 error_extra
="${line#* }"
767 json_add_string
'id' "$error_id"
768 json_add_string
'extra' "$error_extra"
771 $(eval echo "\$$param" | tr \# \\n)
779 [ -z "$(eval echo "\$
$param")" ] && return 0
782 label
="${_ERROR_}:";;
784 label
="${_WARNING_}:";;
786 while read -r line
; do
787 if str_contains
"$line" ' '; then
788 error_id
="${line% *}"
789 error_extra
="${line#* }"
790 printf "%b $(get_text "$error_id")\\n" "$label" "$error_extra"
793 printf "%b $(get_text "$error_id")\\n" "$label"
796 $(eval echo "\$$param" | tr \# \\n)
800 eval "$param"='${value}${extras:+ $extras}'
810 if [ "$param" = 'cleanup_all' ]; then
811 sed -i "/ipset_file: ${aghIpsetFile}/d" "$aghConfigFile" >/dev
/null
2>&1
812 rm -f "$aghIpsetFile"
817 case "$resolver_set" in
820 add_resolver_element
) return 1;;
821 create_resolver_set
) return 1;;
822 check_support
) return 0;;
824 configure
) return 0;;
830 compare_hash
) return 0;;
831 store_hash
) return 0;;
836 add_resolver_element
)
837 [ -n "$resolver_set_supported" ] && ips
'add_agh_element' "$@";;
839 [ -n "$resolver_set_supported" ] && ips
'create_agh_set' "$@";;
841 if [ ! -x "$ipset" ]; then
842 state add
'errorSummary' 'errorNoIpset'
845 if [ -n "$agh" ] && [ -s "$aghConfigFile" ]; then
846 agh_version
="$($agh --version | sed 's|AdGuard Home, version v\(.*\)|\1|' | sed 's|-.*||')"
847 if is_greater_or_equal
"$agh_version" '0.107.13'; then
848 resolver_set_supported
='true'
851 state add
'warningSummary' 'warningAGHVersionTooLow' "$agh_version"
855 state add
'warningSummary' 'warningResolverNotSupported'
860 [ -z "$resolver_set_supported" ] && return 0
861 rm -f "$aghIpsetFile"
862 sed -i "/ipset_file: ${aghIpsetFile}/d" "$aghConfigFile" >/dev
/null
2>&1
865 [ -z "$resolver_set_supported" ] && return 1
866 mkdir
-p "${aghIpsetFile%/*}"
867 touch "$aghIpsetFile"
868 sed -i '/ipset_file/d' "$aghConfigFile" >/dev
/null
2>&1
869 sed -i "/ ipset:/a \ \ ipset_file: $aghIpsetFile" "$aghConfigFile"
874 [ -n "$resolver_set_supported" ] && [ -n "$agh" ] && killall
-q -s HUP
"$agh";;
876 [ -z "$resolver_set_supported" ] && return 1
877 output
3 'Reloading adguardhome '
878 if /etc
/init.d
/adguardhome reload
>/dev
/null
2>&1; then
887 [ -z "$resolver_set_supported" ] && return 1
888 output
3 'Restarting adguardhome '
889 if /etc
/init.d
/adguardhome restart
>/dev
/null
2>&1; then
898 [ -z "$resolver_set_supported" ] && return 1
899 local resolverNewHash
900 if [ -s "$aghIpsetFile" ]; then
901 resolverNewHash
="$(md5sum $aghIpsetFile | awk '{ print $1; }')"
903 [ "$resolverNewHash" != "$resolverStoredHash" ]
906 [ -s "$aghIpsetFile" ] && resolverStoredHash
="$(md5sum $aghIpsetFile | awk '{ print $1; }')";;
911 add_resolver_element
)
912 [ -n "$resolver_set_supported" ] && ips
'add_dnsmasq_element' "$@";;
914 [ -n "$resolver_set_supported" ] && ips
'create_dnsmasq_set' "$@";;
916 if [ ! -x "$ipset" ]; then
917 state add
'errorSummary' 'errorNoIpset'
920 if ! dnsmasq
-v 2>/dev
/null |
grep -q 'no-ipset' && dnsmasq
-v 2>/dev
/null |
grep -q 'ipset'; then
921 resolver_set_supported
='true'
924 state add
'warningSummary' 'warningResolverNotSupported'
929 [ -n "$resolver_set_supported" ] && rm -f "$dnsmasqFile";;
931 [ -n "$resolver_set_supported" ] && mkdir
-p "${dnsmasqFile%/*}";;
935 [ -n "$resolver_set_supported" ] && killall
-q -s HUP dnsmasq
;;
937 [ -z "$resolver_set_supported" ] && return 1
938 output
3 'Reloading dnsmasq '
939 if /etc
/init.d
/dnsmasq reload
>/dev
/null
2>&1; then
948 [ -z "$resolver_set_supported" ] && return 1
949 output
3 'Restarting dnsmasq '
950 if /etc
/init.d
/dnsmasq restart
>/dev
/null
2>&1; then
959 [ -z "$resolver_set_supported" ] && return 1
960 local resolverNewHash
961 if [ -s "$dnsmasqFile" ]; then
962 resolverNewHash
="$(md5sum $dnsmasqFile | awk '{ print $1; }')"
964 [ "$resolverNewHash" != "$resolverStoredHash" ]
967 [ -s "$dnsmasqFile" ] && resolverStoredHash
="$(md5sum $dnsmasqFile | awk '{ print $1; }')";;
972 add_resolver_element
)
973 [ -n "$resolver_set_supported" ] && nftset
'add_dnsmasq_element' "$@";;
975 [ -n "$resolver_set_supported" ] && nftset
'create_dnsmasq_set' "$@";;
977 if [ ! -x "$nft" ]; then
978 state add
'errorSummary' 'errorNoNft'
981 if ! dnsmasq
-v 2>/dev
/null |
grep -q 'no-nftset' && dnsmasq
-v 2>/dev
/null |
grep -q 'nftset'; then
982 resolver_set_supported
='true'
985 state add
'warningSummary' 'warningResolverNotSupported'
990 [ -n "$resolver_set_supported" ] && rm -f "$dnsmasqFile";;
992 [ -n "$resolver_set_supported" ] && mkdir
-p "${dnsmasqFile%/*}";;
996 [ -n "$resolver_set_supported" ] && killall
-q -s HUP dnsmasq
;;
998 [ -z "$resolver_set_supported" ] && return 1
999 output
3 'Reloading dnsmasq '
1000 if /etc
/init.d
/dnsmasq reload
>/dev
/null
2>&1; then
1009 [ -z "$resolver_set_supported" ] && return 1
1010 output
3 'Restarting dnsmasq '
1011 if /etc
/init.d
/dnsmasq restart
>/dev
/null
2>&1; then
1020 [ -z "$resolver_set_supported" ] && return 1
1021 local resolverNewHash
1022 if [ -s "$dnsmasqFile" ]; then
1023 resolverNewHash
="$(md5sum $dnsmasqFile | awk '{ print $1; }')"
1025 [ "$resolverNewHash" != "$resolverStoredHash" ]
1028 [ -s "$dnsmasqFile" ] && resolverStoredHash
="$(md5sum $dnsmasqFile | awk '{ print $1; }')";;
1033 add_resolver_element
) :;;
1034 create_resolver_set
) :;;
1049 add_resolver_element
) :;;
1050 create_resolver_set
) :;;
1068 output
"Unexpected exit or service termination: '${1}'!\\n"
1069 state add
'errorSummary' 'errorUnexpectedExit' "$1"
1070 traffic_killswitch
'remove'
1073 traffic_killswitch
() {
1077 local lan_subnet wan_device
1078 [ "$secure_reload" -ne 0 ] ||
return 0
1079 for i
in $serviceTrapSignals; do
1080 # shellcheck disable=SC2064
1081 trap "trap_process $i" "$i"
1083 output
3 'Activating traffic killswitch '
1084 network_get_subnet lan_subnet
'lan'
1085 network_get_physdev wan_device
'wan'
1087 nft add chain inet
"$nftTable" "${nftPrefix}_killswitch" '{ type filter hook forward priority 0; policy accept; }' || s
=1
1088 nft add rule inet
"$nftTable" "${nftPrefix}_killswitch" oifname
"$wan_device" ip saddr
"$lan_subnet" counter reject || s
=1
1090 ipt
-N "${iptPrefix}_KILLSWITCH" || s
=1
1091 ipt
-A "${iptPrefix}_KILLSWITCH" -s "$lan_subnet" -o "$wan_device" -j REJECT || s
=1
1092 ipt
-I FORWARD
-j "${iptPrefix}_KILLSWITCH" || s
=1
1094 if [ "$s" -eq 0 ]; then
1101 if [ "$secure_reload" -ne 0 ]; then
1102 output
3 'Deactivating traffic killswitch '
1105 nft flush chain inet
"$nftTable" "${nftPrefix}_killswitch" || s
=1
1106 nft delete chain inet
"$nftTable" "${nftPrefix}_killswitch" || s
=1
1108 ipt
-D FORWARD
-j "${iptPrefix}_KILLSWITCH" || s
=1
1109 ipt
-F "${iptPrefix}_KILLSWITCH" || s
=1
1110 ipt
-X "${iptPrefix}_KILLSWITCH" || s
=1
1112 if [ "$secure_reload" -ne 0 ]; then
1113 if [ "$s" -eq 0 ]; then
1119 # shellcheck disable=SC2086
1120 trap - $serviceTrapSignals
1125 policy_routing_tor
() { if is_nft
; then policy_routing_tor_nft
"$@"; else policy_routing_tor_iptables
"$@"; fi; }
1126 policy_routing_tor_iptables
() {
1127 local comment
="$1" iface
="$2" src_addr
="$3" src_port
="$4" dest_addr
="$5" dest_port
="$6" proto chain uid
="$9"
1128 proto
="$(str_to_lower "$7")"
1129 chain
="$(str_to_upper "$8")"
1130 chain
="${chain:-PREROUTING}"
1131 if [ -n "${src_addr}${src_port}${dest_port}" ]; then
1132 state add
'warningSummary' 'warningTorUnsetParams' "$comment"
1134 if [ -n "$proto" ] && [ "$proto" != "all" ]; then
1135 state add
'warningSummary' 'warningTorUnsetProto' "$comment"
1137 if [ "$chain" != "PREROUTING" ]; then
1138 state add
'warningSummary' 'warningTorUnsetChainIpt' "$comment"
1140 if ! resolver
'add_resolver_element' "$iface" 'dst' 'ip' '' "${comment}: $dest_addr" "$dest_addr"; then
1141 processPolicyError
='true'
1142 state add
'errorSummary' 'errorResolver' "'add_resolver_element' '$iface' 'dst' 'ip' '${comment}: $dest_addr' '$dest_addr'"
1147 policy_routing_tor_nft
() {
1148 local comment
="$1" iface
="$2" src_addr
="$3" src_port
="$4" dest_addr
="$5" dest_port
="$6" proto chain uid
="$9"
1149 proto
="$(str_to_lower "$7")"
1150 chain
="$(str_to_lower "$8")"
1151 chain
="${chain:-prerouting}"
1152 if [ -n "${src_addr}${src_port}${dest_port}" ]; then
1153 state add
'warningSummary' 'warningTorUnsetParams' "$comment"
1155 if [ -n "$proto" ] && [ "$proto" != "all" ]; then
1156 state add
'warningSummary' 'warningTorUnsetProto' "$comment"
1158 if [ "$chain" != "prerouting" ]; then
1159 state add
'warningSummary' 'warningTorUnsetChainNft' "$comment"
1161 if ! resolver
'add_resolver_element' "$iface" 'dst' 'ip' '' "${comment}: $dest_addr" "$dest_addr"; then
1162 processPolicyError
='true'
1163 state add
'errorSummary' 'errorResolver' "'add_resolver_element' '$iface' 'dst' 'ip' '${comment}: $dest_addr' '$dest_addr'"
1169 policy_routing
() { if is_nft
; then policy_routing_nft
"$@"; else policy_routing_iptables
"$@"; fi; }
1170 policy_routing_iptables
() {
1171 local mark param4 param6 i negation value dest ipInsertOption
="-A"
1172 local ip4error
='1' ip6error
='1'
1173 local name
="$1" iface
="$2" laddr
="$3" lport
="$4" raddr
="$5" rport
="$6" proto chain uid
="$9"
1174 proto
="$(str_to_lower "$7")"
1175 chain
="$(str_to_upper "$8")"
1176 chain
="${chain:-PREROUTING}"
1177 mark
=$
(eval echo "\$mark_${iface//-/_}")
1179 if [ -n "$ipv6_enabled" ] && { is_ipv6
"$laddr" || is_ipv6
"$raddr"; }; then
1180 processPolicyError
='true'
1181 state add
'errorSummary' 'errorPolicyProcessNoIpv6' "$name"
1185 if [ -n "$mark" ]; then
1186 dest
="-g ${iptPrefix}_MARK_${mark}"
1187 elif [ "$iface" = "ignore" ]; then
1190 processPolicyError
='true'
1191 state add
'errorSummary' 'errorPolicyProcessUnknownFwmark' "$iface"
1195 if is_family_mismatch
"$laddr" "$raddr"; then
1196 processPolicyError
='true'
1197 state add
'errorSummary' 'errorPolicyProcessMismatchFamily' "${name}: '$laddr' '$raddr'"
1201 if [ -z "$proto" ]; then
1202 if [ -n "${lport}${rport}" ]; then
1210 if [ "$i" = 'all' ]; then
1211 param4
="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest"
1212 param6
="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest"
1213 elif ! is_supported_protocol
"$i"; then
1214 processPolicyError
='true'
1215 state add
'errorSummary' 'errorPolicyProcessUnknownProtocol' "${name}: '$i'"
1218 param4
="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest -p $i"
1219 param6
="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest -p $i"
1222 if [ -n "$laddr" ]; then
1223 if [ "${laddr:0:1}" = "!" ]; then
1224 negation
='!'; value
="${laddr:1}"
1226 unset negation
; value
="$laddr";
1228 if is_phys_dev
"$value"; then
1229 param4
="$param4 $negation -m physdev --physdev-in ${value:1}"
1230 param6
="$param6 $negation -m physdev --physdev-in ${value:1}"
1231 elif is_netmask
"$value"; then
1232 local target
='src' type='net'
1233 if ips
'create' "$iface" "$target" "$type" "$uid" "${name}: $laddr" && \
1234 ips
'add' "$iface" "$target" "$type" "$uid" "${name}: $laddr" "$value"; then
1235 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1236 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1238 param4
="$param4 $negation -s $value"
1239 param6
="$param6 $negation -s $value"
1241 elif is_mac_address
"$value"; then
1242 local target
='src' type='mac'
1243 if ips
'create' "$iface" "$target" "$type" "$uid" "${name}: $laddr" && \
1244 ips
'add' "$iface" "$target" "$type" "$uid" "${name}: $laddr" "$value"; then
1245 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1246 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1248 param4
="$param4 -m mac $negation --mac-source $value"
1249 param6
="$param6 -m mac $negation --mac-source $value"
1252 local target
='src' type='ip'
1253 if ips
'create' "$iface" "$target" "$type" "$uid" "${name}: $laddr" && \
1254 ips
'add' "$iface" "$target" "$type" "$uid" "${name}: $laddr" "$value"; then
1255 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1256 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1258 local resolvedIP4 resolvedIP6
1259 resolvedIP4
="$(resolveip_to_ipt4 "$value")"
1260 resolvedIP6
="$(resolveip_to_ipt6 "$value")"
1261 if [ -z "$resolvedIP4" ] && [ -z "$resolvedIP6" ]; then
1262 state add
'errorSummary' 'errorFailedToResolve' "$value"
1264 param4
="$param4 $negation -s $resolvedIP4"
1265 param6
="$param6 $negation -s $resolvedIP6"
1270 if [ -n "$lport" ]; then
1271 if [ "${lport:0:1}" = "!" ]; then
1272 negation
='!'; value
="${lport:1}"
1274 unset negation
; value
="$lport";
1276 param4
="$param4 -m multiport $negation --sport ${value//-/:}"
1277 param6
="$param6 -m multiport $negation --sport ${value//-/:}"
1280 if [ -n "$raddr" ]; then
1281 if [ "${raddr:0:1}" = "!" ]; then
1282 negation
='!'; value
="${raddr:1}"
1284 unset negation
; value
="$raddr";
1286 if is_netmask
"$value"; then
1287 local target
='dst' type='net'
1288 if ips
'create' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
1289 ips
'add' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
1290 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1291 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1293 param4
="$param4 $negation -d $value"
1294 param6
="$param6 $negation -d $value"
1296 elif is_domain
"$value"; then
1297 local target
='dst' type='ip'
1298 if resolver
'create_resolver_set' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
1299 resolver
'add_resolver_element' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
1300 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1301 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1302 elif ips
'create' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
1303 ips
'add' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
1304 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1305 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1307 local resolvedIP4 resolvedIP6
1308 resolvedIP4
="$(resolveip_to_ipt4 "$value")"
1309 resolvedIP6
="$(resolveip_to_ipt6 "$value")"
1310 if [ -z "$resolvedIP4" ] && [ -z "$resolvedIP6" ]; then
1311 state add
'errorSummary' 'errorFailedToResolve' "$value"
1313 param4
="$param4 $negation -d $resolvedIP4"
1314 param6
="$param6 $negation -d $resolvedIP6"
1317 local target
='dst' type='ip'
1318 if ips
'create' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
1319 ips
'add' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
1320 param4
="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
1321 param6
="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
1323 param4
="$param4 $negation -d $value"
1324 param6
="$param6 $negation -d $value"
1329 if [ -n "$rport" ]; then
1330 if [ "${rport:0:1}" = "!" ]; then
1331 negation
='!'; value
="${rport:1}"
1333 unset negation
; value
="$rport";
1335 param4
="$param4 -m multiport $negation --dport ${value//-/:}"
1336 param6
="$param6 -m multiport $negation --dport ${value//-/:}"
1339 if [ -n "$name" ]; then
1340 param4
="$param4 -m comment --comment $(str_extras_to_underscore "$name")"
1341 param6
="$param6 -m comment --comment $(str_extras_to_underscore "$name")"
1344 local ipv4_error
='0' ipv6_error
='0'
1345 if [ "$param4" = "$param6" ]; then
1346 ipt4
"$param4" || ipv4_error
='1'
1348 ipt4
"$param4" || ipv4_error
='1'
1349 ipt6
"$param6" || ipv6_error
='1'
1352 if [ -n "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ] && [ "$ipv6_error" -eq '1' ]; then
1353 processPolicyError
='true'
1354 state add
'errorSummary' 'errorPolicyProcessInsertionFailed' "$name"
1355 state add
'errorSummary' 'errorPolicyProcessCMD' "iptables $param4"
1356 state add
'errorSummary' 'errorPolicyProcessCMD' "iptables $param6"
1357 logger
-t "$packageName" "ERROR: iptables $param4"
1358 logger
-t "$packageName" "ERROR: iptables $param6"
1359 elif [ -z "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ]; then
1360 processPolicyError
='true'
1361 state add
'errorSummary' 'errorPolicyProcessInsertionFailedIpv4' "$name"
1362 state add
'errorSummary' 'errorPolicyProcessCMD' "iptables $param4"
1363 logger
-t "$packageName" "ERROR: iptables $param4"
1368 policy_routing_nft
() {
1369 local mark i nftInsertOption
='add'
1370 local param4 param6 proto_i negation value dest
1371 local ip4Flag
='ip' ip6Flag
='ip6'
1372 local name
="$1" iface
="$2" laddr
="$3" lport
="$4" raddr
="$5" rport
="$6" proto chain uid
="$9"
1373 proto
="$(str_to_lower "$7")"
1374 chain
="$(str_to_lower "$8")"
1375 chain
="${chain:-prerouting}"
1376 mark
=$
(eval echo "\$mark_${iface//-/_}")
1378 if [ -z "$ipv6_enabled" ] && { is_ipv6
"$src_addr" || is_ipv6
"$dest_addr"; }; then
1379 processPolicyError
='true'
1380 state add
'errorSummary' 'errorPolicyProcessNoIpv6' "$name"
1384 if [ -n "$mark" ]; then
1385 dest
="goto ${nftPrefix}_mark_${mark}"
1386 elif [ "$iface" = "ignore" ]; then
1389 processPolicyError
='true'
1390 state add
'errorSummary' 'errorPolicyProcessUnknownFwmark' "$iface"
1394 if is_family_mismatch
"$src_addr" "$dest_addr"; then
1395 processPolicyError
='true'
1396 state add
'errorSummary' 'errorPolicyProcessMismatchFamily' "${name}: '$laddr' '$raddr'"
1400 if [ -z "$proto" ]; then
1401 if [ -n "${src_port}${dest_port}" ]; then
1408 for proto_i
in $proto; do
1411 if [ "$proto_i" = 'all' ]; then
1413 elif ! is_supported_protocol
"$proto_i"; then
1414 processPolicyError
='true'
1415 state add
'errorSummary' 'errorPolicyProcessUnknownProtocol' "${name}: '$proto_i'"
1419 if [ -n "$src_addr" ]; then
1420 if [ "${src_addr:0:1}" = "!" ]; then
1421 negation
='!='; value
="${src_addr:1}"
1423 unset negation
; value
="$src_addr";
1425 if is_phys_dev
"$value"; then
1426 param4
="$param4 iifname $negation ${value:1}"
1427 param6
="$param6 iifname $negation ${value:1}"
1428 elif is_mac_address
"$value"; then
1429 local target
='src' type='mac'
1430 if nftset
'create' "$iface" "$target" "$type" "$uid" "$name" && \
1431 nftset
'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
1432 param4
="$param4 ether saddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
1433 param6
="$param6 ether saddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
1435 param4
="$param4 ether saddr $negation $value"
1436 param6
="$param6 ether saddr $negation $value"
1439 local target
='src' type='ip'
1440 if nftset
'create' "$iface" "$target" "$type" "$uid" "$name" && \
1441 nftset
'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
1442 param4
="$param4 $ip4Flag saddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
1443 param6
="$param6 $ip6Flag saddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
1445 param4
="$param4 $ip4Flag saddr $negation $value"
1446 param6
="$param6 $ip6Flag saddr $negation $value"
1451 if [ -n "$dest_addr" ]; then
1452 if [ "${dest_addr:0:1}" = "!" ]; then
1453 negation
='!='; value
="${dest_addr:1}"
1455 unset negation
; value
="$dest_addr";
1457 if is_phys_dev
"$value"; then
1458 param4
="$param4 oifname $negation ${value:1}"
1459 param6
="$param6 oifname $negation ${value:1}"
1460 elif is_domain
"$value"; then
1461 local target
='dst' type='ip'
1462 if resolver
'create_resolver_set' "$iface" "$target" "$type" "$uid" "$name" && \
1463 resolver
'add_resolver_element' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
1464 param4
="$param4 $ip4Flag daddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
1465 param6
="$param6 $ip6Flag daddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
1466 elif nftset
'create' "$iface" "$target" "$type" "$uid" "$name" && \
1467 nftset
'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
1468 param4
="$param4 $ip4Flag daddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
1469 param6
="$param6 $ip6Flag daddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
1471 local resolvedIP4 resolvedIP6
1472 resolvedIP4
="$(resolveip_to_nftset4 "$value")"
1473 resolvedIP6
="$(resolveip_to_nftset6 "$value")"
1474 if [ -z "$resolvedIP4" ] && [ -z "$resolvedIP6" ]; then
1475 state add
'errorSummary' 'errorFailedToResolve' "$value"
1477 param4
="$param4 $ip4Flag daddr $negation { $resolvedIP4 }"
1478 param6
="$param6 $ip6Flag daddr $negation { $resolvedIP6 }"
1481 local target
='dst' type='ip'
1482 if nftset
'create' "$iface" "$target" "$type" "$uid" "$name" && \
1483 nftset
'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
1484 param4
="$param4 $ip4Flag daddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
1485 param6
="$param6 $ip6Flag daddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
1487 param4
="$param4 $ip4Flag daddr $negation $value"
1488 param6
="$param6 $ip6Flag daddr $negation $value"
1493 if [ -n "$src_port" ]; then
1494 if [ "${src_port:0:1}" = "!" ]; then
1495 negation
='!='; value
="${src_port:1}"
1497 unset negation
; value
="$src_port";
1499 param4
="$param4 ${proto_i:+$proto_i }sport $negation {$(ports_to_nftset "$value")}"
1500 param6
="$param6 ${proto_i:+$proto_i }sport $negation {$(ports_to_nftset "$value")}"
1503 if [ -n "$dest_port" ]; then
1504 if [ "${dest_port:0:1}" = "!" ]; then
1505 negation
='!='; value
="${dest_port:1}"
1507 unset negation
; value
="$dest_port";
1509 param4
="$param4 ${proto_i:+$proto_i }dport $negation {$(ports_to_nftset "$value")}"
1510 param6
="$param6 ${proto_i:+$proto_i }dport $negation {$(ports_to_nftset "$value")}"
1513 param4
="$nftInsertOption rule inet $nftTable ${nftPrefix}_${chain} $param4 $dest comment \"$name\""
1514 param6
="$nftInsertOption rule inet $nftTable ${nftPrefix}_${chain} $param6 $dest comment \"$name\""
1516 local ipv4_error
='0' ipv6_error
='0'
1517 if [ "$nftPrevParam4" != "$param4" ]; then
1518 nft4
"$param4" || ipv4_error
='1'
1519 nftPrevParam4
="$param4"
1521 if [ "$nftPrevParam6" != "$param6" ]; then
1522 nft6
"$param6" || ipv6_error
='1'
1523 nftPrevParam6
="$param6"
1526 if [ -n "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ] && [ "$ipv6_error" -eq '1' ]; then
1527 processPolicyError
='true'
1528 state add
'errorSummary' 'errorPolicyProcessInsertionFailed' "$name"
1529 state add
'errorSummary' 'errorPolicyProcessCMD' "nft $param4"
1530 state add
'errorSummary' 'errorPolicyProcessCMD' "nft $param6"
1531 logger
-t "$packageName" "ERROR: nft $param4"
1532 logger
-t "$packageName" "ERROR: nft $param6"
1533 elif [ -z "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ]; then
1534 processPolicyError
='true'
1535 state add
'errorSummary' 'errorPolicyProcessInsertionFailedIpv4' "$name"
1536 state add
'errorSummary' 'errorPolicyProcessCMD' "nft $param4"
1537 logger
-t "$packageName" "ERROR: nft $param4"
1545 if [ -z "$uid" ]; then # first non-recursive call
1546 [ "$enabled" -gt 0 ] ||
return 0
1547 unset processPolicyError
1550 chain
="$(str_to_lower "$chain")"
1552 chain
="$(str_to_upper "$chain")"
1554 proto
="$(str_to_lower "$proto")"
1555 [ "$proto" = 'auto' ] && unset proto
1556 [ "$proto" = 'all' ] && unset proto
1557 output
2 "Routing '$name' via $interface "
1558 if [ -z "${src_addr}${src_port}${dest_addr}${dest_port}" ]; then
1559 state add
'errorSummary' 'errorPolicyNoSrcDest' "$name"
1560 output_fail
; return 1;
1562 if [ -z "$interface" ]; then
1563 state add
'errorSummary' 'errorPolicyNoInterface' "$name"
1564 output_fail
; return 1;
1566 if ! is_supported_interface
"$interface"; then
1567 state add
'errorSummary' 'errorPolicyUnknownInterface' "$name"
1568 output_fail
; return 1;
1570 src_port
="${src_port// / }"; src_port="${src_port// /,}"; src_port="${src_port//,\!/ !}";
1571 dest_port
="${dest_port// / }"; dest_port="${dest_port// /,}"; dest_port="${dest_port//,\!/ !}";
1573 # nftset 'flush' "$interface" "dst" "ip" "$uid"
1574 # nftset 'flush' "$interface" "src" "ip" "$uid"
1575 # nftset 'flush' "$interface" "src" "mac" "$uid"
1577 # ips 'flush' "$interface" "dst" "ip" "$uid"
1578 # ips 'flush' "$interface" "src" "ip" "$uid"
1579 # ips 'flush' "$interface" "src" "mac" "$uid"
1581 policy_process
"$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"
1582 if [ -n "$processPolicyError" ]; then
1587 else # recursive call, get options from passed variables
1588 local name
="$1" interface
="$2" src_addr
="$3" src_port
="$4" dest_addr
="$5" dest_port
="$6" proto
="$7" chain
="$8"
1589 if str_contains
"$src_addr" '[ ;\{\}]'; then
1590 for i
in $
(str_extras_to_space
"$src_addr"); do [ -n "$i" ] && policy_process
"$name" "$interface" "$i" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"; done
1591 elif str_contains
"$src_port" '[ ;\{\}]'; then
1592 for i
in $
(str_extras_to_space
"$src_port"); do [ -n "$i" ] && policy_process
"$name" "$interface" "$src_addr" "$i" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"; done
1593 elif str_contains
"$dest_addr" '[ ;\{\}]'; then
1594 for i
in $
(str_extras_to_space
"$dest_addr"); do [ -n "$i" ] && policy_process
"$name" "$interface" "$src_addr" "$src_port" "$i" "$dest_port" "$proto" "$chain" "$uid"; done
1595 elif str_contains
"$dest_port" '[ ;\{\}]'; then
1596 for i
in $
(str_extras_to_space
"$dest_port"); do [ -n "$i" ] && policy_process
"$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$i" "$proto" "$chain" "$uid"; done
1597 elif str_contains
"$proto" '[ ;\{\}]'; then
1598 for i
in $
(str_extras_to_space
"$proto"); do [ -n "$i" ] && policy_process
"$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$i" "$chain" "$uid"; done
1600 if is_tor
"$interface"; then
1601 policy_routing_tor
"$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"
1603 policy_routing
"$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"
1609 interface_process_tor
() { if is_nft
; then interface_process_tor_nft
"$@"; else interface_process_tor_iptables
"$@"; fi; }
1610 interface_process_tor_iptables
() {
1611 local s
=0 iface
="$1" action
="$2"
1612 local displayText set_name4 set_name6
1613 local dnsPort trafficPort
1616 displayText
="${iface}/53->${dnsPort}/80,443->${trafficPort}"
1617 gatewaySummary
="${gatewaySummary}${displayText}\\n"
1620 for i
in $chainsList; do
1621 i
="$(str_to_upper "$i")"
1622 ipt
-t nat
-D "${i}" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
1623 ipt
-t nat
-F "${iptPrefix}_${i}"; ipt -t nat -X "${iptPrefix}_${i}";
1627 output
2 "Creating TOR redirects "
1628 dnsPort
="$(grep -m1 DNSPort /etc/tor/torrc | awk -F: '{print $2}')"
1629 trafficPort
="$(grep -m1 TransPort /etc/tor/torrc | awk -F: '{print $2}')"
1630 dnsPort
="${dnsPort:-9053}"; trafficPort
="${trafficPort:-9040}";
1631 for i
in $chainsList; do
1632 i
="$(str_to_upper "$i")"
1633 ipt
-t nat
-N "${iptPrefix}_${i}"
1634 ipt
-t nat
-A "$i" -m mark
--mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
1636 if resolver
'create_resolver_set' "$iface" 'dst' 'ip' && ips
'flush' "$iface" 'dst' 'ip'; then
1637 set_name4
="${ipsPrefix}_${iface}_4_dst_ip"
1638 for i
in $chainsList; do
1639 i
="$(str_to_upper "$i")"
1640 ipt
-t nat
-I "${iptPrefix}_${i}" -p udp -m udp --dport 53 -m set --match-set "${set_name4}" dst
-j REDIRECT
--to-ports "$dnsPort" -m comment
--comment "TorDNS-UDP" || s
=1
1641 ipt
-t nat
-I "${iptPrefix}_${i}" -p tcp -m tcp --dport 80 -m set --match-set "${set_name4}" dst
-j REDIRECT
--to-ports "$trafficPort" -m comment
--comment "TorHTTP-TCP" || s
=1
1642 ipt
-t nat
-I "${iptPrefix}_${i}" -p udp -m udp --dport 80 -m set --match-set "${set_name4}" dst
-j REDIRECT
--to-ports "$trafficPort" -m comment
--comment "TorHTTP-UDP" || s
=1
1643 ipt
-t nat
-I "${iptPrefix}_${i}" -p tcp -m tcp --dport 443 -m set --match-set "${set_name4}" dst
-j REDIRECT
--to-ports "$trafficPort" -m comment
--comment "TorHTTPS-TCP" || s
=1
1644 ipt
-t nat
-I "${iptPrefix}_${i}" -p udp -m udp --dport 443 -m set --match-set "${set_name4}" dst
-j REDIRECT
--to-ports "$trafficPort" -m comment
--comment "TorHTTPS-UDP" || s
=1
1649 displayText
="${iface}/53->${dnsPort}/80,443->${trafficPort}"
1650 if [ "$s" -eq 0 ]; then
1651 gatewaySummary
="${gatewaySummary}${displayText}\\n"
1654 state add
'errorSummary' 'errorFailedSetup' "$displayText"
1661 interface_process_tor_nft
() {
1662 local s
=0 iface
="$1" action
="$2"
1663 local displayText set_name4 set_name6
1664 local dnsPort trafficPort
1667 displayText
="${iface}/53->${dnsPort}/80,443->${trafficPort}"
1668 gatewaySummary
="${gatewaySummary}${displayText}\\n"
1673 output
2 "Creating TOR redirects "
1674 dnsPort
="$(grep -m1 DNSPort /etc/tor/torrc | awk -F: '{print $2}')"
1675 trafficPort
="$(grep -m1 TransPort /etc/tor/torrc | awk -F: '{print $2}')"
1676 dnsPort
="${dnsPort:-9053}"; trafficPort
="${trafficPort:-9040}";
1677 if resolver
'create_resolver_set' "$iface" 'dst' 'ip' && nftset
'flush' "$iface" 'dst' 'ip'; then
1678 set_name4
="${nftPrefix}_${iface}_4_dst_ip"
1679 set_name6
="${nftPrefix}_${iface}_6_dst_ip"
1680 nft add rule inet
"$nftTable" dstnat meta nfproto ipv4 ip daddr
"@${set_name4}" udp dport
53 counter redirect to
:"$dnsPort" comment
"Tor-DNS-UDP-ipv4" || s
=1
1681 nft add rule inet
"$nftTable" dstnat meta nfproto ipv4 ip daddr
"@${set_name4}" tcp dport
80 counter redirect to
:"$trafficPort" comment
"Tor-HTTP-TCP-ipv4" || s
=1
1682 nft add rule inet
"$nftTable" dstnat meta nfproto ipv4 ip daddr
"@${set_name4}" udp dport
80 counter redirect to
:"$trafficPort" comment
"Tor-HTTP-UDP-ipv4" || s
=1
1683 nft add rule inet
"$nftTable" dstnat meta nfproto ipv4 ip daddr
"@${set_name4}" tcp dport
443 counter redirect to
:"$trafficPort" comment
"Tor-HTTPS-TCP-ipv4" || s
=1
1684 nft add rule inet
"$nftTable" dstnat meta nfproto ipv4 ip daddr
"@${set_name4}" udp dport
443 counter redirect to
:"$trafficPort" comment
"Tor-HTTPS-UDP-ipv4" || s
=1
1685 nft6 add rule inet
"$nftTable" dstnat meta nfproto ipv6 ip6 daddr
"@${set_name6}" udp dport
53 counter redirect to
:"$dnsPort" comment
"Tor-DNS-UDP-ipv6" || s
=1
1686 nft6 add rule inet
"$nftTable" dstnat meta nfproto ipv6 ip6 daddr
"@${set_name6}" tcp dport
80 counter redirect to
:"$trafficPort" comment
"Tor-HTTP-TCP-ipv6" || s
=1
1687 nft6 add rule inet
"$nftTable" dstnat meta nfproto ipv6 ip6 daddr
"@${set_name6}" udp dport
80 counter redirect to
:"$trafficPort" comment
"Tor-HTTP-UDP-ipv6" || s
=1
1688 nft6 add rule inet
"$nftTable" dstnat meta nfproto ipv6 ip6 daddr
"@${set_name6}" tcp dport
443 counter redirect to
:"$trafficPort" comment
"Tor-HTTPS-TCP-ipv6" || s
=1
1689 nft6 add rule inet
"$nftTable" dstnat meta nfproto ipv6 ip6 daddr
"@${set_name6}" udp dport
443 counter redirect to
:"$trafficPort" comment
"Tor-HTTPS-UDP-ipv6" || s
=1
1693 displayText
="${iface}/53->${dnsPort}/80,443->${trafficPort}"
1694 if [ "$s" -eq 0 ]; then
1695 gatewaySummary
="${gatewaySummary}${displayText}\\n"
1698 state add
'errorSummary' 'errorFailedSetup' "$displayText"
1706 interface_routing
() {
1707 local action
="$1" tid
="$2" mark
="$3" iface
="$4" gw4
="$5" dev
="$6" gw6
="$7" dev6
="$8" priority
="$9"
1708 local dscp s
=0 i ipv4_error
=1 ipv6_error
=1
1709 if [ -z "$tid" ] ||
[ -z "$mark" ] ||
[ -z "$iface" ]; then
1710 state add
'errorSummary' 'errorInterfaceRoutingEmptyValues'
1715 if is_netifd_table
"$iface"; then
1717 $ip_bin rule del table
"$tid" >/dev
/null
2>&1
1718 $ip_bin -4 rule add fwmark
"${mark}/${fw_mask}" table
"$tid" priority
"$priority" || ipv4_error
=1
1720 nft add chain inet
"$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error
=1
1721 nft add rule inet
"$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error
=1
1722 nft add rule inet
"$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error
=1
1724 ipt
-t mangle
-N "${iptPrefix}_MARK_${mark}" || ipv4_error
=1
1725 ipt
-t mangle
-A "${iptPrefix}_MARK_${mark}" -j MARK --set-xmark "${mark}/${fw_mask}" || ipv4_error
=1
1726 ipt
-t mangle
-A "${iptPrefix}_MARK_${mark}" -j RETURN || ipv4_error
=1
1728 if [ -n "$ipv6_enabled" ]; then
1730 $ip_bin -6 rule add fwmark
"${mark}/${fw_mask}" table
"$tid" priority
"$priority" || ipv6_error
=1
1733 if ! grep -q "$tid ${ipTablePrefix}_${iface}" '/etc/iproute2/rt_tables'; then
1734 sed -i "/${ipTablePrefix}_${iface}/d" '/etc/iproute2/rt_tables'
1736 echo "$tid ${ipTablePrefix}_${iface}" >> '/etc/iproute2/rt_tables'
1739 $ip_bin rule del table
"$tid" >/dev
/null
2>&1
1740 $ip_bin route flush table
"$tid" >/dev
/null
2>&1
1741 if [ -n "$gw4" ] ||
[ "$strict_enforcement" -ne 0 ]; then
1743 if [ -z "$gw4" ]; then
1744 $ip_bin -4 route add unreachable default table
"$tid" >/dev
/null
2>&1 || ipv4_error
=1
1746 $ip_bin -4 route add default via
"$gw4" dev
"$dev" table
"$tid" >/dev
/null
2>&1 || ipv4_error
=1
1748 # shellcheck disable=SC2086
1750 i
="$(echo "$i" | sed 's/ linkdown$//')"
1751 i
="$(echo "$i" | sed 's/ onlink$//')"
1752 idev
="$(echo "$i" | grep -Eso 'dev [^ ]*' | awk '{print $2}')"
1753 if ! is_supported_iface_dev
"$idev"; then
1754 $ip_bin -4 route add
$i table
"$tid" >/dev
/null
2>&1 || ipv4_error
=1
1757 $($ip_bin -4 route list table main)
1759 $ip_bin -4 rule add fwmark
"${mark}/${fw_mask}" table
"$tid" priority
"$priority" || ipv4_error
=1
1761 nft add chain inet
"$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error
=1
1762 nft add rule inet
"$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error
=1
1763 nft add rule inet
"$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error
=1
1765 ipt
-t mangle
-N "${iptPrefix}_MARK_${mark}" || ipv4_error
=1
1766 ipt
-t mangle
-A "${iptPrefix}_MARK_${mark}" -j MARK --set-xmark "${mark}/${fw_mask}" || ipv4_error
=1
1767 ipt
-t mangle
-A "${iptPrefix}_MARK_${mark}" -j RETURN || ipv4_error
=1
1770 if [ -n "$ipv6_enabled" ]; then
1772 if { [ -n "$gw6" ] && [ "$gw6" != "::/0" ]; } ||
[ "$strict_enforcement" -ne 0 ]; then
1773 if [ -z "$gw6" ] ||
[ "$gw6" = "::/0" ]; then
1774 $ip_bin -6 route add unreachable default table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1775 elif $ip_bin -6 route list table main |
grep -q " dev $dev6 "; then
1777 i
="$(echo "$i" | sed 's/ linkdown$//')"
1778 i
="$(echo "$i" | sed 's/ onlink$//')"
1779 # shellcheck disable=SC2086
1780 $ip_bin -6 route add
$i table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1782 $($ip_bin -6 route list table main | grep " dev $dev6 ")
1785 $ip_bin -6 route add
"$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev
"$dev6" table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1786 $ip_bin -6 route add default dev
"$dev6" table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1789 $ip_bin -6 rule add fwmark
"${mark}/${fw_mask}" table
"$tid" priority
"$priority" >/dev
/null
2>&1 || ipv6_error
=1
1792 if [ "$ipv4_error" -eq 0 ] ||
[ "$ipv6_error" -eq 0 ]; then
1793 dscp
="$(uci -q get "${packageName}".config."${iface}"_dscp)"
1795 if [ "${dscp:-0}" -ge 1 ] && [ "${dscp:-0}" -le 63 ]; then
1796 nft add rule inet
"$nftTable" "${nftPrefix}_prerouting ip dscp ${dscp} goto ${nftPrefix}_mark_${mark}" || s
=1
1798 if [ "$iface" = "$icmp_interface" ]; then
1799 nft add rule inet
"$nftTable" "${nftPrefix}_output ip protocol icmp goto ${nftPrefix}_mark_${mark}" || s
=1
1802 if [ "${dscp:-0}" -ge 1 ] && [ "${dscp:-0}" -le 63 ]; then
1803 ipt
-t mangle
-I "${iptPrefix}_PREROUTING" -m dscp --dscp "${dscp}" -g "${iptPrefix}_MARK_${mark}" || s
=1
1805 if [ "$iface" = "$icmp_interface" ]; then
1806 ipt
-t mangle
-I "${iptPrefix}_OUTPUT" -p icmp -g "${iptPrefix}_MARK_${mark}" || s
=1
1816 nftset
'create_user_set' "$iface" 'dst' 'ip' 'user' '' "$mark" || s
=1
1817 nftset
'create_user_set' "$iface" 'src' 'ip' 'user' '' "$mark" || s
=1
1818 nftset
'create_user_set' "$iface" 'src' 'mac' 'user' '' "$mark" || s
=1
1820 ips
'create_user_set' "$iface" 'dst' 'ip' 'user' '' "$mark" || s
=1
1821 ips
'create_user_set' "$iface" 'src' 'ip' 'user' '' "$mark" || s
=1
1822 ips
'create_user_set' "$iface" 'dst' 'net' 'user' '' "$mark" || s
=1
1823 ips
'create_user_set' "$iface" 'src' 'net' 'user' '' "$mark" || s
=1
1824 ips
'create_user_set' "$iface" 'src' 'mac' 'user' '' "$mark" || s
=1
1829 $ip_bin rule del table
"$tid" >/dev
/null
2>&1
1830 if ! is_netifd_table
"$iface"; then
1831 $ip_bin route flush table
"$tid" >/dev
/null
2>&1
1832 sed -i "/${ipTablePrefix}_${iface}\$/d" '/etc/iproute2/rt_tables'
1838 is_netifd_table
"$iface" && return 0;
1840 $ip_bin rule del table
"$tid" >/dev
/null
2>&1
1841 if ! is_netifd_table
"$iface"; then
1842 $ip_bin route flush table
"$tid" >/dev
/null
2>&1
1844 if [ -n "$gw4" ] ||
[ "$strict_enforcement" -ne 0 ]; then
1845 if [ -z "$gw4" ]; then
1846 $ip_bin -4 route add unreachable default table
"$tid" >/dev
/null
2>&1 || ipv4_error
=1
1848 $ip_bin -4 route add default via
"$gw4" dev
"$dev" table
"$tid" >/dev
/null
2>&1 || ipv4_error
=1
1850 $ip_bin rule add fwmark
"${mark}/${fw_mask}" table
"$tid" priority
"$priority" || ipv4_error
=1
1852 if [ -n "$ipv6_enabled" ]; then
1854 if { [ -n "$gw6" ] && [ "$gw6" != "::/0" ]; } ||
[ "$strict_enforcement" -ne 0 ]; then
1855 if [ -z "$gw6" ] ||
[ "$gw6" = "::/0" ]; then
1856 $ip_bin -6 route add unreachable default table
"$tid" || ipv6_error
=1
1857 elif $ip_bin -6 route list table main |
grep -q " dev $dev6 "; then
1859 # shellcheck disable=SC2086
1860 $ip_bin -6 route add
$i table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1862 $($ip_bin -6 route list table main | grep " dev $dev6 ")
1865 $ip_bin -6 route add
"$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev
"$dev6" table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1866 $ip_bin -6 route add default dev
"$dev6" table
"$tid" >/dev
/null
2>&1 || ipv6_error
=1
1869 $ip_bin -6 rule add fwmark
"${mark}/${fw_mask}" table
"$tid" priority
"$priority" || ipv6_error
=1
1871 if [ "$ipv4_error" -eq 0 ] ||
[ "$ipv6_error" -eq 0 ]; then
1881 json_add_gateway
() {
1882 local action
="$1" tid
="$2" mark
="$3" iface
="$4" gw4
="$5" dev4
="$6" gw6
="$7" dev6
="$8" priority
="$9" default
="${10}"
1884 json_add_string name
"$iface"
1885 json_add_string device_ipv4
"$dev4"
1886 json_add_string gateway_ipv4
"$gw4"
1887 json_add_string device_ipv6
"$dev6"
1888 json_add_string gateway_ipv6
"$gw6"
1889 if [ -n "$default" ]; then
1890 json_add_boolean default true
1892 json_add_boolean default false
1894 json_add_string action
"$action"
1895 json_add_string table_id
"$tid"
1896 json_add_string mark
"$mark"
1897 json_add_string priority
"$priority"
1901 interface_process
() {
1902 local gw4 gw6 dev dev6 s
=0 dscp iface
="$1" action
="$2" reloadedIface
="$3"
1903 local displayText dispDev dispGw4 dispGw6 dispStatus
1905 if [ "$iface" = 'all' ] && [ "$action" = 'prepare' ]; then
1906 config_load
'network'
1907 ifaceMark
="$(printf '0x%06x' "$wan_mark")"
1908 ifacePriority
="$wan_ip_rules_priority"
1912 is_supported_interface
"$iface" ||
return 0
1913 is_wan6
"$iface" && return 0
1914 [ $
((ifaceMark
)) -gt $
((fw_mask
)) ] && return 1
1916 if is_ovpn
"$iface" && ! is_valid_ovpn
"$iface"; then
1917 : || state add
'warningSummary' 'warningInvalidOVPNConfig' "$iface"
1920 network_get_device dev
"$iface"
1921 [ -z "$dev" ] && network_get_physdev dev
"$iface"
1922 if is_wan
"$iface" && [ -n "$wanIface6" ] && str_contains
"$wanIface6" "$iface"; then
1923 network_get_device dev6
"$wanIface6"
1924 [ -z "$dev6" ] && network_get_physdev dev6
"$wanIface6"
1927 [ -z "$dev6" ] && dev6
="$dev"
1928 [ -z "$ifaceMark" ] && ifaceMark
="$(printf '0x%06x' "$wan_mark")"
1929 [ -z "$ifacePriority" ] && ifacePriority
="$wan_ip_rules_priority"
1931 ifaceTableID
="$(get_rt_tables_id "$iface")"
1932 [ -z "$ifaceTableID" ] && ifaceTableID
="$(get_rt_tables_next_id)"
1933 eval "mark_${iface//-/_}"='$ifaceMark'
1934 eval "tid_${iface//-/_}"='$ifaceTableID'
1935 pbr_get_gateway gw4
"$iface" "$dev"
1936 pbr_get_gateway6 gw6
"$iface" "$dev6"
1937 dispGw4
="${gw4:-0.0.0.0}"
1938 dispGw6
="${gw6:-::/0}"
1939 [ "$iface" != "$dev" ] && dispDev
="$dev"
1940 is_default_dev
"$dev" && dispStatus
="${__OK__}"
1941 displayText
="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
1945 output
2 "Setting up routing for '$displayText' "
1946 if interface_routing
'create' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"; then
1947 json_add_gateway
'create' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority" "$dispStatus"
1948 gatewaySummary
="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
1951 state add
'errorSummary' 'errorFailedSetup' "$displayText"
1956 interface_routing
'create_user_set' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"
1959 displayText
="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
1960 output
2 "Removing routing for '$displayText' "
1961 interface_routing
'destroy' "${ifaceTableID}" "${ifaceMark}" "${iface}"
1965 gatewaySummary
="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
1968 if [ "$iface" = "$reloadedIface" ]; then
1969 output
2 "Reloading routing for '$displayText' "
1970 if interface_routing
'reload_interface' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"; then
1971 json_add_gateway
'reload_interface' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority" "$dispStatus"
1972 gatewaySummary
="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
1975 state add
'errorSummary' 'errorFailedReload' "$displayText"
1979 gatewaySummary
="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
1983 # ifaceTableID="$((ifaceTableID + 1))"
1984 ifaceMark
="$(printf '0x%06x' $((ifaceMark + wan_mark)))"
1985 ifacePriority
="$((ifacePriority + 1))"
1989 user_file_process
() {
1990 local shellBin
="${SHELL:-/bin/ash}"
1991 [ "$enabled" -gt 0 ] ||
return 0
1992 if [ ! -s "$path" ]; then
1993 state add
'errorSummary' 'errorUserFileNotFound' "$path"
1997 if ! $shellBin -n "$path"; then
1998 state add
'errorSummary' 'errorUserFileSyntax' "$path"
2002 output
2 "Running $path "
2003 # shellcheck disable=SC1090
2004 if ! .
"$path"; then
2005 state add
'errorSummary' 'errorUserFileRunning' "$path"
2006 if grep -q -w 'curl' "$path" && ! is_present
'curl'; then
2007 state add
'errorSummary' 'errorUserFileNoCurl' "$path"
2018 ubus
-t 30 wait_for network.interface
2>/dev
/null
2019 rc_procd start_service
'on_boot'
2022 on_firewall_reload
() {
2023 if [ -e "$packageLockFile" ]; then # service is stopped, do not start it on firewall reload
2024 logger
-t "$packageName" "Reload on firewall action aborted: service is stopped."
2027 rc_procd start_service
'on_firewall_reload' "$1"
2030 on_interface_reload
() {
2031 if [ -e "$packageLockFile" ]; then # service is stopped, do not start it on interface change
2032 logger
-t "$packageName" "Reload on interface change aborted: service is stopped."
2035 rc_procd start_service
'on_interface_reload' "$1"
2040 local resolverStoredHash resolverNewHash i param
="$1" reloadedIface
2042 load_environment
'on_start' "$(load_validate_config)" ||
return 1
2043 is_wan_up ||
return 1
2044 rm -f "$nftTempFile"
2048 serviceStartTrigger
='on_start'
2051 serviceStartTrigger
='on_start'
2053 on_interface_reload
)
2055 if is_ovpn
"$reloadedIface"; then
2056 logger
-t "$packageName" "Updated interface is an OpenVPN tunnel, restarting."
2057 serviceStartTrigger
='on_start'
2060 serviceStartTrigger
='on_interface_reload'
2064 serviceStartTrigger
='on_reload'
2067 serviceStartTrigger
='on_start'
2071 if [ -n "$reloadedIface" ] && ! is_supported_interface
"$reloadedIface"; then
2075 if [ -n "$(ubus_get_status error)" ] ||
[ -n "$(ubus_get_status warning)" ]; then
2076 serviceStartTrigger
='on_start'
2078 elif ! is_service_running
; then
2079 serviceStartTrigger
='on_start'
2081 elif [ -z "$(ubus_get_status gateway)" ]; then
2082 serviceStartTrigger
='on_start'
2084 elif [ "$serviceStartTrigger" = 'on_interface_reload' ] && \
2085 [ -z "$(ubus_get_interface "$reloadedIface" 'gateway_4')" ] && \
2086 [ -z "$(ubus_get_interface "$reloadedIface" 'gateway_6')" ]; then
2087 serviceStartTrigger
='on_start'
2090 serviceStartTrigger
="${serviceStartTrigger:-on_start}"
2093 procd_open_instance
"main"
2094 procd_set_param
command /bin
/true
2095 procd_set_param stdout
1
2096 procd_set_param stderr
1
2099 case $serviceStartTrigger in
2100 on_interface_reload
)
2101 output
1 "Reloading Interface: $reloadedIface "
2102 json_add_array
'gateways'
2103 interface_process
'all' 'prepare'
2104 config_foreach interface_process
'interface' 'reload_interface' "$reloadedIface"
2109 traffic_killswitch
'insert'
2110 resolver
'store_hash'
2111 resolver
'cleanup_all'
2112 resolver
'configure'
2117 for i
in $chainsList; do
2118 i
="$(str_to_upper "$i")"
2119 ipt
-t mangle
-N "${iptPrefix}_${i}"
2120 ipt
-t mangle
"$rule_create_option" "$i" -m mark
--mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
2123 json_add_array
'gateways'
2124 interface_process
'all' 'prepare'
2125 config_foreach interface_process
'interface' 'reload'
2126 interface_process_tor
'tor' 'destroy'
2127 is_tor_running
&& interface_process_tor
'tor' 'reload'
2129 if is_config_enabled
'policy'; then
2130 output
1 'Processing policies '
2131 config_load
"$packageName"
2132 config_foreach load_validate_policy
'policy' policy_process
2135 if is_config_enabled
'include'; then
2136 interface_process
'all' 'prepare'
2137 config_foreach interface_process
'interface' 'create_user_set'
2138 output
1 'Processing user file(s) '
2139 config_load
"$packageName"
2140 config_foreach load_validate_include
'include' user_file_process
2144 resolver
'compare_hash' && resolver
'restart'
2145 traffic_killswitch
'remove'
2148 traffic_killswitch
'insert'
2149 resolver
'store_hash'
2150 resolver
'cleanup_all'
2151 resolver
'configure'
2155 cleanup_marking_chains
2158 for i
in $chainsList; do
2159 i
="$(str_to_upper "$i")"
2160 ipt
-t mangle
-N "${iptPrefix}_${i}"
2161 ipt
-t mangle
"$rule_create_option" "$i" -m mark
--mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
2164 output
1 'Processing interfaces '
2165 json_add_array
'gateways'
2166 interface_process
'all' 'prepare'
2167 config_foreach interface_process
'interface' 'create'
2168 interface_process_tor
'tor' 'destroy'
2169 is_tor_running
&& interface_process_tor
'tor' 'create'
2171 ip route flush cache
2173 if is_config_enabled
'policy'; then
2174 output
1 'Processing policies '
2175 config_load
"$packageName"
2176 config_foreach load_validate_policy
'policy' policy_process
2179 if is_config_enabled
'include'; then
2180 interface_process
'all' 'prepare'
2181 config_foreach interface_process
'interface' 'create_user_set'
2182 output
1 'Processing user file(s) '
2183 config_load
"$packageName"
2184 config_foreach load_validate_include
'include' user_file_process
2188 resolver
'compare_hash' && resolver
'restart'
2189 traffic_killswitch
'remove'
2193 if [ -z "$gatewaySummary" ]; then
2194 state add
'errorSummary' 'errorNoGateways'
2196 json_add_object
'status'
2197 [ -n "$gatewaySummary" ] && json_add_string
'gateways' "$gatewaySummary"
2198 [ -n "$errorSummary" ] && json_add_string
'errors' "$errorSummary"
2199 [ -n "$warningSummary" ] && json_add_string
'warnings' "$warningSummary"
2200 if [ "$strict_enforcement" -ne 0 ] && str_contains
"$gatewaySummary" '0.0.0.0'; then
2201 json_add_string
'mode' "strict"
2205 procd_close_instance
2210 [ -n "$gatewaySummary" ] && output
"$serviceName (nft) started with gateways:\\n${gatewaySummary}"
2212 [ -n "$gatewaySummary" ] && output
"$serviceName (iptables) started with gateways:\\n${gatewaySummary}"
2214 state print
'errorSummary'
2215 state print
'warningSummary'
2216 if [ -n "$errorSummary" ]; then
2218 elif [ -n "$warningSummary" ]; then
2225 service_triggers
() {
2227 load_environment
'on_triggers'
2228 # shellcheck disable=SC2034
2229 PROCD_RELOAD_DELAY
=$
(( procd_reload_delay
* 1000 ))
2231 load_validate_config
2232 load_validate_policy
2233 load_validate_include
2234 procd_close_validate
2236 procd_add_reload_trigger
'openvpn'
2237 procd_add_config_trigger
"config.change" "${packageName}" /etc
/init.d
/${packageName} reload
2238 for n
in $ifacesSupported; do
2239 procd_add_interface_trigger
"interface.*" "$n" /etc
/init.d
/${packageName} on_interface_reload
"$n"
2242 if [ "$serviceStartTrigger" = 'on_start' ]; then
2243 output
3 "$serviceName monitoring interfaces: ${ifacesSupported}\\n"
2249 load_environment
'on_stop'
2250 is_service_running ||
return 0
2251 traffic_killswitch
'insert'
2254 cleanup_marking_chains
2255 output
1 'Resetting interfaces '
2256 config_load
'network'
2257 config_foreach interface_process
'interface' 'destroy'
2258 interface_process_tor
'tor' 'destroy'
2261 ip route flush cache
2264 resolver
'store_hash'
2265 resolver
'cleanup_all'
2266 resolver
'compare_hash' && resolver
'restart'
2267 traffic_killswitch
'remove'
2268 if [ "$enabled" -ne 0 ]; then
2270 output
"$serviceName (nft) stopped "; output_okn
;
2272 output
"$serviceName (iptables) stopped "; output_okn
;
2278 local _SEPARATOR_
='============================================================'
2279 load_environment
'on_status'
2281 status_service_nft
"$@"
2283 status_service_iptables
"$@"
2287 status_service_nft
() {
2288 local i dev dev6 wan_tid
2290 json_load
"$(ubus call system board)"; json_select release
; json_get_var dist distribution
; json_get_var vers version
2291 if [ -n "$wanIface4" ]; then
2292 network_get_gateway wanGW4
"$wanIface4"
2293 network_get_device dev
"$wanIface4"
2295 if [ -n "$wanIface6" ]; then
2296 network_get_device dev6
"$wanIface6"
2297 wanGW6
=$
($ip_bin -6 route show |
grep -m1 " dev $dev6 " |
awk '{print $1}')
2298 [ "$wanGW6" = "default" ] && wanGW6
=$
($ip_bin -6 route show |
grep -m1 " dev $dev6 " |
awk '{print $3}')
2300 while [ "${1:0:1}" = "-" ]; do param
="${1//-/}"; eval "set_$param=1"; shift; done
2301 [ -e "/var/${packageName}-support" ] && rm -f "/var/${packageName}-support"
2302 status
="$serviceName running on $dist $vers."
2303 [ -n "$wanIface4" ] && status
="$status WAN (IPv4): ${wanIface4}/${dev}/${wanGW4:-0.0.0.0}."
2304 [ -n "$wanIface6" ] && status
="$status WAN (IPv6): ${wanIface6}/${dev6}/${wanGW6:-::/0}."
2307 echo "$packageName - environment"
2310 dnsmasq
--version 2>/dev
/null |
sed '/^$/,$d'
2312 echo "$packageName chains - policies"
2313 for i
in forward input output prerouting postrouting
; do
2314 "$nft" -a list table inet
"$nftTable" |
sed -n "/chain ${nftPrefix}_${i} {/,/\t}/p"
2317 echo "$packageName chains - marking"
2318 for i
in $
(get_mark_nft_chains
); do
2319 "$nft" -a list table inet
"$nftTable" |
sed -n "/chain ${i} {/,/\t}/p"
2322 echo "$packageName nft sets"
2323 for i
in $
(get_nft_sets
); do
2324 "$nft" -a list table inet
"$nftTable" |
sed -n "/set ${i} {/,/\t}/p"
2326 if [ -s "$dnsmasqFile" ]; then
2331 # echo "$_SEPARATOR_"
2332 # ip rule list | grep "${packageName}_"
2334 tableCount
="$(grep -c "${packageName}_
" /etc/iproute2/rt_tables)" || tableCount
=0
2335 wan_tid
=$
(($
(get_rt_tables_next_id
)-tableCount))
2336 i
=0; while [ $i -lt "$tableCount" ]; do
2337 echo "IPv4 table $((wan_tid + i)) route: $($ip_bin -4 route show table $((wan_tid + i)) | grep default)"
2338 echo "IPv4 table $((wan_tid + i)) rule(s):"
2339 $ip_bin -4 rule list table
"$((wan_tid + i))"
2340 if [ -n "$ipv6_enabled" ]; then
2341 echo "IPv6 table $((wan_tid + i)) route: $($ip_bin -6 route show table $((wan_tid + i)) | grep default)"
2342 echo "IPv6 table $((wan_tid + i)) rule(s):"
2343 $ip_bin -6 route show table $
((wan_tid
+ i
))
2349 status_service_iptables
() {
2350 local dist vers out id s param status set_d set_p tableCount i
=0 dev dev6 j wan_tid
2352 json_load
"$(ubus call system board)"; json_select release
; json_get_var dist distribution
; json_get_var vers version
2353 if [ -n "$wanIface4" ]; then
2354 network_get_gateway wanGW4
"$wanIface4"
2355 network_get_device dev
"$wanIface4"
2357 if [ -n "$wanIface6" ]; then
2358 network_get_device dev6
"$wanIface6"
2359 wanGW6
=$
($ip_bin -6 route show |
grep -m1 " dev $dev6 " |
awk '{print $1}')
2360 [ "$wanGW6" = "default" ] && wanGW6
=$
($ip_bin -6 route show |
grep -m1 " dev $dev6 " |
awk '{print $3}')
2362 while [ "${1:0:1}" = "-" ]; do param
="${1//-/}"; eval "set_$param=1"; shift; done
2363 [ -e "/var/${packageName}-support" ] && rm -f "/var/${packageName}-support"
2364 status
="$serviceName running on $dist $vers."
2365 [ -n "$wanIface4" ] && status
="$status WAN (IPv4): ${wanIface4}/${dev}/${wanGW4:-0.0.0.0}."
2366 [ -n "$wanIface6" ] && status
="$status WAN (IPv6): ${wanIface6}/${dev6}/${wanGW6:-::/0}."
2370 dnsmasq
--version 2>/dev
/null |
sed '/^$/,$d'
2371 if [ -n "$1" ]; then
2373 echo "Resolving domains"
2375 echo "$i: $(resolveip "$i" | tr '\n' ' ')"
2380 echo "Routes/IP Rules"
2381 tableCount
="$(grep -c "${packageName}_
" /etc/iproute2/rt_tables)" || tableCount
=0
2382 if [ -n "$set_d" ]; then route
; else route |
grep '^default'; fi
2383 if [ -n "$set_d" ]; then ip rule list
; fi
2384 wan_tid
=$
(($
(get_rt_tables_next_id
)-tableCount))
2385 i
=0; while [ $i -lt "$tableCount" ]; do
2386 echo "IPv4 table $((wan_tid + i)) route: $($ip_bin -4 route show table $((wan_tid + i)) | grep default)"
2387 echo "IPv4 table $((wan_tid + i)) rule(s):"
2388 $ip_bin -4 rule list table
"$((wan_tid + i))"
2392 if [ -n "$ipv6_enabled" ]; then
2393 i
=0; while [ $i -lt "$tableCount" ]; do
2394 $ip_bin -6 route show table $
((wan_tid
+ i
)) |
while read -r param
; do
2395 echo "IPv6 Table $((wan_tid + i)): $param"
2401 for j
in Mangle NAT
; do
2402 if [ -z "$set_d" ]; then
2403 for i
in $chainsList; do
2404 i
="$(str_to_upper "$i")"
2405 if iptables
-v -t "$(str_to_lower $j)" -S "${iptPrefix}_${i}" >/dev
/null
2>&1; then
2407 echo "$j IP Table: $i"
2408 iptables
-v -t "$(str_to_lower $j)" -S "${iptPrefix}_${i}"
2409 if [ -n "$ipv6_enabled" ]; then
2411 echo "$j IPv6 Table: $i"
2412 iptables
-v -t "$(str_to_lower $j)" -S "${iptPrefix}_${i}"
2419 iptables
-L -t "$(str_to_lower $j)"
2420 if [ -n "$ipv6_enabled" ]; then
2422 echo "$j IPv6 Table"
2423 iptables
-L -t "$(str_to_lower $j)"
2426 i
=0; ifaceMark
="$wan_mark";
2427 while [ $i -lt "$tableCount" ]; do
2428 if iptables
-v -t "$(str_to_lower $j)" -S "${iptPrefix}_MARK_${ifaceMark}" >/dev
/null
2>&1; then
2430 echo "$j IP Table MARK Chain: ${iptPrefix}_MARK_${ifaceMark}"
2431 iptables
-v -t "$(str_to_lower $j)" -S "${iptPrefix}_MARK_${ifaceMark}"
2432 ifaceMark
="$(printf '0x%06x' $((ifaceMark + wan_mark)))";
2439 echo "Current ipsets"
2441 if [ -s "$dnsmasqFile" ]; then
2446 if [ -s "$aghIpsetFile" ]; then
2448 echo "AdGuardHome sets"
2452 } |
tee -a /var
/${packageName}-support
2453 if [ -n "$set_p" ]; then
2454 printf "%b" "Pasting to paste.ee... "
2455 if is_present
'curl' && is_variant_installed
'libopenssl' && is_installed
'ca-bundle'; then
2456 json_init
; json_add_string
"description" "${packageName}-support"
2457 json_add_array
"sections"; json_add_object
'0'
2458 json_add_string
"name" "$(uci -q get system.@system[0].hostname)"
2459 json_add_string
"contents" "$(cat /var/${packageName}-support)"
2460 json_close_object
; json_close_array
; payload
=$
(json_dump
)
2461 out
=$
(curl
-s -k "https://api.paste.ee/v1/pastes" -X "POST" -H "Content-Type: application/json" -H "X-Auth-Token:uVOJt6pNqjcEWu7qiuUuuxWQafpHhwMvNEBviRV2B" -d "$payload")
2462 json_load
"$out"; json_get_var id id
; json_get_var s success
2463 [ "$s" = "1" ] && printf "%b" "https://paste.ee/p/$id $__OK__\\n" ||
printf "%b" "$__FAIL__\\n"
2464 [ -e "/var/${packageName}-support" ] && rm -f "/var/${packageName}-support"
2466 printf "%b" "${__FAIL__}\\n"
2467 printf "%b" "${_ERROR_}: The curl, libopenssl or ca-bundle packages were not found!\\nRun 'opkg update; opkg install curl libopenssl ca-bundle' to install them.\\n"
2470 printf "%b" "Your support details have been logged to '/var/${packageName}-support'. $__OK__\\n"
2474 # shellcheck disable=SC2120
2475 load_validate_config
() {
2476 uci_load_validate
"$packageName" "$packageName" "$1" "${2}${3:+ $3}" \
2478 'procd_boot_delay:integer:0' \
2479 'strict_enforcement:bool:1' \
2480 'secure_reload:bool:0' \
2481 'ipv6_enabled:bool:0' \
2482 'resolver_set:or("", "none", "dnsmasq.ipset", "dnsmasq.nftset")' \
2483 'verbosity:range(0,2):1' \
2484 "wan_mark:regex('0x[A-Fa-f0-9]{8}'):0x010000" \
2485 "fw_mask:regex('0x[A-Fa-f0-9]{8}'):0xff0000" \
2486 'icmp_interface:or("", "tor", uci("network", "@interface"))' \
2487 'ignored_interface:list(or("tor", uci("network", "@interface")))' \
2488 'supported_interface:list(or("tor", uci("network", "@interface")))' \
2489 'boot_timeout:integer:30' \
2490 'wan_ip_rules_priority:uinteger:30000' \
2491 'rule_create_option:or("", "add", "insert"):add' \
2492 'procd_reload_delay:integer:0' \
2493 'webui_supported_protocol:list(string)' \
2494 'nft_user_set_policy:or("", "memory", "performance")'\
2495 'nft_user_set_counter:bool:0'
2498 # shellcheck disable=SC2120
2499 load_validate_policy
() {
2509 uci_load_validate
"$packageName" 'policy' "$1" "${2}${3:+ $3}" \
2510 'name:string:Untitled' \
2512 'interface:or("ignore", "tor", uci("network", "@interface")):wan' \
2513 'proto:or(string)' \
2514 'chain:or("", "forward", "input", "output", "prerouting", "postrouting", "FORWARD", "INPUT", "OUTPUT", "PREROUTING", "POSTROUTING"):prerouting' \
2515 'src_addr:list(neg(or(host,network,macaddr,string)))' \
2516 'src_port:list(neg(or(portrange,string)))' \
2517 'dest_addr:list(neg(or(host,network,string)))' \
2518 'dest_port:list(neg(or(portrange,string)))'
2521 # shellcheck disable=SC2120
2522 load_validate_include
() {
2525 uci_load_validate
"$packageName" 'include' "$1" "${2}${3:+ $3}" \