net/vpnbypass/files/vpnbypass.init

   1 #!/bin/sh /etc/rc.common
   2 PKG_VERSION=
   3
   4 START=94
   5 USE_PROCD=1
   6
   7 readonly __ok__='\033[0;32m[\xe2\x9c\x93]\033[0m'
   8 readonly __fail__='\033[0;31m[\xe2\x9c\x97]\033[0m'
   9 readonly __pass__='\033[0;33m[-]\033[0m'
  10 readonly __error__='\033[0;31mERROR\033[0m'
  11
  12 output() { local msg=$(echo -n "${1/$p_name /service }" | sed 's|\\033\[[0-9]\?;\?[0-9]\?[0-9]\?m||g'); [ -n "$2" ] && [ ! $(($verbosity & $2)) -gt 0 ] && return 0; [ -t 1 ] && echo -e -n "$1"; [ $(echo -e -n "$msg" | wc -l) -gt 0 ] && logger -t "${PKG_NAME:-service} [$$]" "$(echo -e -n ${logmsg}${msg})" && logmsg='' || logmsg=${logmsg}${msg}; }
  13 PKG_NAME="${PKG_NAME:-vpnbypass}"; p_name="${PKG_NAME} ${PKG_VERSION}"
  14
  15 is_enabled() {
  16         local c=1 enabled
  17         config_load $PKG_NAME
  18         config_get_bool enabled 'config' 'enabled' 1
  19         config_get verbosity    'config' 'verbosity' '2'
  20         config_get TID          'config' 'table_number' '200'
  21         config_get IPSET        'config' 'ipset'  'vpnbypass'
  22         config_get FW_MARK      'config' 'fw_mark' '0x010000'
  23         config_get FW_MASK      'config' 'fw_mask' '0xff0000'
  24         source /lib/functions/network.sh
  25         [ "$enabled" -gt 0 ] || { output "$__error__: $p_name is not enabled.\n"; return 1; }
  26         source  /lib/functions/network.sh
  27         while : ; do
  28                 network_find_wan wan_if4
  29                 [ -n "$wan_if4" ] && network_get_gateway wan_gw $wan_if4
  30                 [ "$c" -ge 25 -o -n "$wan_gw" ] && break
  31                 output "$p_name waiting for wan gateway...\n"
  32                 sleep 2; network_flush_cache; let "c+=1";
  33         done
  34         [ -n "$wan_gw" ] && return 0 || { output "$__error__: $p_name failed to discover WAN gateway.\n"; return 1; }
  35 }
  36
  37 ipt() {
  38     local d=$(echo $* | sed s/-A/-D/g)
  39     [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  40     d=$(echo $* | sed s/-I/-D/g)
  41     [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  42                 d=$(echo $* | sed s/-N/-F/g)
  43     [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  44                 d=$(echo $* | sed s/-N/-X/g)
  45     [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  46
  47                 iptables $* >/dev/null 2>&1
  48 }
  49
  50 start_service() {
  51         local ll
  52   is_enabled || return 1
  53   config_get lports   'config' 'localport'
  54   config_get rports   'config' 'remoteport'
  55   config_get routes   'config' 'remotesubnet'
  56   config_get ranges   'config' 'localsubnet'
  57   config_get domains  'config' 'domain'
  58
  59         procd_open_instance
  60         procd_set_param stdout 1
  61         procd_set_param stderr 1
  62         procd_close_instance
  63
  64         ipt -t mangle -N VPNBYPASS; ipt -t mangle -A PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS;
  65         ipt -t mangle -A VPNBYPASS -m set --match-set $IPSET dst -j MARK --set-mark ${FW_MARK}/${FW_MASK}
  66         ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET";
  67         ip route flush table "$TID"; ip route flush cache;
  68         ip route add default via "$wan_gw" table "$TID"; ip route flush cache;
  69         ipset -q -exist create "$IPSET" hash:ip; ipset -q flush "$IPSET"
  70         ip rule add fwmark "$FW_MARK" table "$TID"
  71         { modprobe xt_set; modprobe ip_set; modprobe ip_set_hash_ip; } >/dev/null 2>&1
  72         for ll in ${ranges}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -s "$ll"; done
  73         for ll in ${lports}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -p tcp -m multiport --sport "${ll//-/:}"; done
  74         for ll in ${routes}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -d "$ll"; done
  75         for ll in ${rports}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -p tcp -m multiport --dport "${ll//-/:}"; done
  76         output "$p_name started with TID: $TID; FW_MARK: $FW_MARK\n"
  77 }
  78
  79 stop_service() {
  80   is_enabled || return 1
  81
  82         ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET";
  83         ip route flush table "$TID"; ip route flush cache;
  84         ipt -t mangle -D PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS
  85         ipt -t mangle -F VPNBYPASS; ipt -t mangle -X VPNBYPASS;
  86         output "$p_name stopped\n"
  87 }
  88
  89 reload_service(){
  90         start_service
  91 }
  92
  93 st_load_interfaces(){ local d; config_get d $1 ifname; [ "$1" == "$wan_if4" -o "$d" != "${d/tun}" -o "$d" != "${d/tap}" ] && ifaces=" ${1} ${ifaces}"; }
  94 service_triggers() {
  95                 local ifaces n
  96                 procd_add_reload_trigger 'vpnbypass'
  97                 procd_open_trigger
  98                 procd_add_config_trigger "config.change" "vpnbypass" /etc/init.d/vpnbypass reload
  99                 for n in $ifaces; do procd_add_interface_trigger "interface.*" "$n" /etc/init.d/openvpn-policy-routing reload; done;
 100                 procd_close_trigger
 101 }