X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=net%2Fshadowsocks-libev%2Ffiles%2Fss-rules;h=b0a30606e1300d57f357d61e44d6e2c9da6c44c2;hb=0931d35319940474ae4796c069b8bc44c57fc6d2;hp=8bd7264af1695fbbf76a9cb7f8f20a946c2234ba;hpb=d3732c9bd9fd3f18bf1edc5363e98d667f830482;p=feed%2Fpackages.git diff --git a/net/shadowsocks-libev/files/ss-rules b/net/shadowsocks-libev/files/ss-rules index 8bd7264af1..b0a30606e1 100755 --- a/net/shadowsocks-libev/files/ss-rules +++ b/net/shadowsocks-libev/files/ss-rules @@ -1,260 +1,264 @@ -#!/bin/sh +#!/bin/sh -e # -# Copyright (C) 2014-2017 Jian Chang +# Copyright (C) 2017 Yousong Zhou +# +# The design idea was derived from ss-rules by Jian Chang # # This is free software, licensed under the GNU General Public License v3. # See /LICENSE for more information. # -usage() { - cat <<-EOF - Usage: ss-rules [options] +ss_rules_usage() { + cat >&2 < Local port number of ss-redir with TCP mode + -L Local port number of ss-redir with UDP mode + -s List of ip addresses of remote shadowsocks server + --ifnames Only apply rules on packets from these ifnames + --src-bypass + --src-forward + --src-checkdst + --src-default + Packets will have their src ip checked in order against + bypass, forward, checkdst list and will bypass, forward + through, or continue to have their dst ip checked + respectively on the first match. Otherwise, --src-default + decide the default action + --dst-bypass + --dst-forward + --dst-bypass-file + --dst-forward-file + --dst-default + Same as with their --src-xx equivalent + --dst-forward-recentrst + Forward those packets whose destinations have recently + sent to us multiple tcp-rst packets + --local-default + Default action for local out TCP traffic - Valid options are: +The following ipsets will be created by ss-rules. They are also intended to be +populated by other programs like dnsmasq with ipset support - -s ip address of shadowsocks remote server - -l port number of shadowsocks local server - -S ip address of shadowsocks remote UDP server - -L port number of shadowsocks local UDP server - -B a file whose content is bypassed ip list - -b wan ip of will be bypassed - -W a file whose content is forwarded ip list - -w wan ip of will be forwarded - -I proxy only for the given interface - -d the default target of lan access control - -a lan ip of access control, need a prefix to - define proxy type - -e extra arguments for iptables - -o apply the rules to the OUTPUT chain - -O apply the global rules to the OUTPUT chain - -u enable udprelay mode, TPROXY is required - -U enable udprelay mode, using different IP - and ports for TCP and UDP - -f flush the rules - -h show this help message and exit + ss_rules_src_bypass + ss_rules_src_forward + ss_rules_src_checkdst + ss_rules_dst_bypass + ss_rules_dst_forward EOF - exit $1 } -loger() { - # 1.alert 2.crit 3.err 4.warn 5.notice 6.info 7.debug - logger -st ss-rules[$$] -p$1 $2 -} +o_dst_bypass_=" + 0.0.0.0/8 + 10.0.0.0/8 + 100.64.0.0/10 + 127.0.0.0/8 + 169.254.0.0/16 + 172.16.0.0/12 + 192.0.0.0/24 + 192.0.2.0/24 + 192.31.196.0/24 + 192.52.193.0/24 + 192.88.99.0/24 + 192.168.0.0/16 + 192.175.48.0/24 + 198.18.0.0/15 + 198.51.100.0/24 + 203.0.113.0/24 + 224.0.0.0/4 + 240.0.0.0/4 + 255.255.255.255 +" +o_src_default=bypass +o_dst_default=bypass +o_local_default=bypass -flush_rules() { - iptables-save -c | grep -v "SS_SPEC" | iptables-restore -c - if command -v ip >/dev/null 2>&1; then - ip rule del fwmark 1 lookup 100 2>/dev/null - ip route del local default dev lo table 100 2>/dev/null - fi - for setname in $(ipset -n list | grep "ss_spec"); do - ipset destroy $setname 2>/dev/null - done - FWI=$(uci get firewall.shadowsocks.path 2>/dev/null) - [ -n "$FWI" ] && echo '# firewall include file' >$FWI - return 0 +__errmsg() { + echo "ss-rules: $*" >&2 } -ipset_init() { - ipset -! restore <<-EOF || return 1 - create ss_spec_src_ac hash:ip hashsize 64 - create ss_spec_src_bp hash:ip hashsize 64 - create ss_spec_src_fw hash:ip hashsize 64 - create ss_spec_dst_sp hash:net hashsize 64 - create ss_spec_dst_bp hash:net hashsize 64 - create ss_spec_dst_fw hash:net hashsize 64 - $(gen_lan_host_ipset_entry) - $(gen_special_purpose_ip | sed -e "s/^/add ss_spec_dst_sp /") - $(sed -e "s/^/add ss_spec_dst_bp /" ${WAN_BP_LIST:=/dev/null} 2>/dev/null) - $(for ip in $WAN_BP_IP; do echo "add ss_spec_dst_bp $ip"; done) - $(sed -e "s/^/add ss_spec_dst_fw /" ${WAN_FW_LIST:=/dev/null} 2>/dev/null) - $(for ip in $WAN_FW_IP; do echo "add ss_spec_dst_fw $ip"; done) -EOF - return 0 -} +ss_rules_parse_args() { + while [ "$#" -gt 0 ]; do + case "$1" in + -h|--help) ss_rules_usage; exit 0;; + -f|--flush) ss_rules_flush; exit 0;; + -l) o_redir_tcp_port="$2"; shift 2;; + -L) o_redir_udp_port="$2"; shift 2;; + -s) o_remote_servers="$2"; shift 2;; + --ifnames) o_ifnames="$2"; shift 2;; + --ipt-extra) o_ipt_extra="$2"; shift 2;; + --src-default) o_src_default="$2"; shift 2;; + --dst-default) o_dst_default="$2"; shift 2;; + --local-default) o_local_default="$2"; shift 2;; + --src-bypass) o_src_bypass="$2"; shift 2;; + --src-forward) o_src_forward="$2"; shift 2;; + --src-checkdst) o_src_checkdst="$2"; shift 2;; + --dst-bypass) o_dst_bypass="$2"; shift 2;; + --dst-forward) o_dst_forward="$2"; shift 2;; + --dst-forward-recentrst) o_dst_forward_recentrst=1; shift 1;; + --dst-bypass-file) o_dst_bypass_file="$2"; shift 2;; + --dst-forward-file) o_dst_forward_file="$2"; shift 2;; + *) __errmsg "unknown option $1"; return 1;; + esac + done -ipt_nat() { - include_ac_rules nat - ipt="iptables -t nat" - $ipt -A SS_SPEC_WAN_FW -p tcp \ - -j REDIRECT --to-ports $local_port || return 1 - if [ -n "$OUTPUT" ]; then - $ipt -N SS_SPEC_WAN_DG - $ipt -A SS_SPEC_WAN_DG -m set --match-set ss_spec_dst_sp dst -j RETURN - $ipt -A SS_SPEC_WAN_DG -p tcp $EXT_ARGS -j $OUTPUT - $ipt -I OUTPUT 1 -p tcp -j SS_SPEC_WAN_DG + if [ -z "$o_redir_tcp_port" -a -z "$o_redir_udp_port" ]; then + __errmsg "Requires at least -l or -L option" + return 1 fi - return $? + if [ -n "$o_dst_forward_recentrst" ] && ! iptables -m recent -h >/dev/null; then + __errmsg "Please install iptables-mod-conntrack-extra with opkg" + return 1 + fi + o_remote_servers="$(for s in $o_remote_servers; do resolveip -4 "$s"; done)" } -ipt_mangle() { - [ -n "$TPROXY" ] || return 0 - if !(lsmod | grep -q TPROXY && command -v ip >/dev/null); then - loger 4 "TPROXY or ip not found." - return 0 - fi - ip rule add fwmark 1 lookup 100 - ip route add local default dev lo table 100 - include_ac_rules mangle - iptables -t mangle -A SS_SPEC_WAN_FW -p udp \ - -j TPROXY --on-port $LOCAL_PORT --tproxy-mark 0x01/0x01 - return $? +ss_rules_flush() { + local setname + + iptables-save --counters | grep -v ss_rules_ | iptables-restore --counters + while ip rule del fwmark 1 lookup 100 2>/dev/null; do true; done + ip route flush table 100 + for setname in $(ipset -n list | grep "ss_rules_"); do + ipset destroy "$setname" 2>/dev/null || true + done } -export_ipt_rules() { - [ -n "$FWI" ] || return 0 - cat <<-CAT >>$FWI - iptables-save -c | grep -v "SS_SPEC" | iptables-restore -c - iptables-restore -n <<-EOF - $(iptables-save | grep -E "SS_SPEC|^\*|^COMMIT" |\ - sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/") +ss_rules_ipset_init() { + ipset --exist restore <<-EOF + create ss_rules_src_bypass hash:net hashsize 64 + create ss_rules_src_forward hash:net hashsize 64 + create ss_rules_src_checkdst hash:net hashsize 64 + create ss_rules_dst_bypass hash:net hashsize 64 + create ss_rules_dst_bypass_ hash:net hashsize 64 + create ss_rules_dst_forward hash:net hashsize 64 + create ss_rules_dst_forward_recentrst_ hash:ip hashsize 64 timeout 3600 + $(ss_rules_ipset_mkadd ss_rules_dst_bypass_ "$o_dst_bypass_ $o_remote_servers") + $(ss_rules_ipset_mkadd ss_rules_src_bypass "$o_src_bypass") + $(ss_rules_ipset_mkadd ss_rules_src_forward "$o_src_forward") + $(ss_rules_ipset_mkadd ss_rules_src_checkdst "$o_src_checkdst") + $(ss_rules_ipset_mkadd ss_rules_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null)") + $(ss_rules_ipset_mkadd ss_rules_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null)") EOF -CAT - return $? } -gen_lan_host_ipset_entry() { - for host in $LAN_HOSTS; do - case "${host:0:1}" in - n|N) - echo add ss_spec_src_ac ${host:2} - ;; - b|B) - echo add ss_spec_src_bp ${host:2} - ;; - g|G) - echo add ss_spec_src_fw ${host:2} - ;; - esac +ss_rules_ipset_mkadd() { + local setname="$1"; shift + local i + + for i in $*; do + echo "add $setname $i" done } -gen_special_purpose_ip() { - cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}" - 0.0.0.0/8 - 10.0.0.0/8 - 100.64.0.0/10 - 127.0.0.0/8 - 169.254.0.0/16 - 172.16.0.0/12 - 192.0.0.0/24 - 192.0.2.0/24 - 192.31.196.0/24 - 192.52.193.0/24 - 192.88.99.0/24 - 192.168.0.0/16 - 192.175.48.0/24 - 198.18.0.0/15 - 198.51.100.0/24 - 203.0.113.0/24 - 224.0.0.0/4 - 240.0.0.0/4 - 255.255.255.255 - $server - $SERVER -EOF +ss_rules_iptchains_init() { + ss_rules_iptchains_init_tcp + ss_rules_iptchains_init_udp } -include_ac_rules() { - local protocol=$([ "$1" = "mangle" ] && echo udp || echo tcp) - iptables-restore -n <<-EOF - *$1 - :SS_SPEC_LAN_DG - [0:0] - :SS_SPEC_LAN_AC - [0:0] - :SS_SPEC_WAN_AC - [0:0] - :SS_SPEC_WAN_FW - [0:0] - -A SS_SPEC_LAN_DG -m set --match-set ss_spec_dst_sp dst -j RETURN - -A SS_SPEC_LAN_DG -p $protocol $EXT_ARGS -j SS_SPEC_LAN_AC - -A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_bp src -j RETURN - -A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_fw src -j SS_SPEC_WAN_FW - -A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_ac src -j SS_SPEC_WAN_AC - -A SS_SPEC_LAN_AC -j ${LAN_TARGET:=SS_SPEC_WAN_AC} - -A SS_SPEC_WAN_AC -m set --match-set ss_spec_dst_fw dst -j SS_SPEC_WAN_FW - -A SS_SPEC_WAN_AC -m set --match-set ss_spec_dst_bp dst -j RETURN - -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW - $(gen_prerouting_rules $protocol) - COMMIT -EOF +ss_rules_iptchains_init_tcp() { + local local_target + + [ -n "$o_redir_tcp_port" ] || return 0 + + ss_rules_iptchains_init_ nat tcp + + case "$o_local_default" in + checkdst) local_target=ss_rules_dst ;; + forward) local_target=ss_rules_forward ;; + bypass|*) return 0;; + esac + + iptables-restore --noflush <<-EOF + *nat + :ss_rules_local_out - + -I OUTPUT 1 -p tcp -j ss_rules_local_out + -A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_ dst -j RETURN + -A ss_rules_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default" + COMMIT + EOF } -gen_prerouting_rules() { - [ -z "$IFNAMES" ] && echo -I PREROUTING 1 -p $1 -j SS_SPEC_LAN_DG - for ifname in $IFNAMES; do - echo -I PREROUTING 1 -i $ifname -p $1 -j SS_SPEC_LAN_DG - done +ss_rules_iptchains_init_udp() { + [ -n "$o_redir_udp_port" ] || return 0 + ss_rules_iptchains_init_ mangle udp } -while getopts ":s:l:S:L:B:b:W:w:I:d:a:e:oOuUfh" arg; do - case "$arg" in - s) - server=$(for ip in $OPTARG; do echo $ip; done) - ;; - l) - local_port=$OPTARG - ;; - S) - SERVER=$(for ip in $OPTARG; do echo $ip; done) - ;; - L) - LOCAL_PORT=$OPTARG - ;; - B) - WAN_BP_LIST=$OPTARG - ;; - b) - WAN_BP_IP=$OPTARG - ;; - W) - WAN_FW_LIST=$OPTARG - ;; - w) - WAN_FW_IP=$OPTARG - ;; - I) - IFNAMES=$OPTARG - ;; - d) - LAN_TARGET=$OPTARG - ;; - a) - LAN_HOSTS=$OPTARG - ;; - e) - EXT_ARGS=$OPTARG - ;; - o) - OUTPUT=SS_SPEC_WAN_AC - ;; - O) - OUTPUT=SS_SPEC_WAN_FW - ;; - u) - TPROXY=1 - ;; - U) - TPROXY=2 - ;; - f) - flush_rules - exit 0 +ss_rules_iptchains_init_() { + local table="$1" + local proto="$2" + local forward_rules + local src_default_target dst_default_target + local recentrst_mangle_rules recentrst_addset_rules + + case "$proto" in + tcp) + forward_rules="-A ss_rules_forward -p tcp -j REDIRECT --to-ports $o_redir_tcp_port" + if [ -n "$o_dst_forward_recentrst" ]; then + recentrst_mangle_rules=" + *mangle + -I PREROUTING 1 -p tcp -m tcp --tcp-flags RST RST -m recent --name ss_rules_recentrst --set --rsource + COMMIT + " + recentrst_addset_rules=" + -A ss_rules_dst -m recent --name ss_rules_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules_dst_forward_recentrst_ dst --exist + -A ss_rules_dst -m set --match-set ss_rules_dst_forward_recentrst_ dst -j ss_rules_forward + " + fi ;; - h) - usage 0 + udp) + ip rule add fwmark 1 lookup 100 + ip route add local default dev lo table 100 + forward_rules="-A ss_rules_forward -p udp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01" ;; esac -done + case "$o_src_default" in + forward) src_default_target=ss_rules_forward ;; + checkdst) src_default_target=ss_rules_dst ;; + bypass|*) src_default_target=RETURN ;; + esac + case "$o_dst_default" in + forward) dst_default_target=ss_rules_forward ;; + bypass|*) dst_default_target=RETURN ;; + esac + sed -e '/^\s*$/d' -e 's/^\s\+//' <<-EOF | iptables-restore --noflush + *$table + :ss_rules_pre_src - + :ss_rules_src - + :ss_rules_dst - + :ss_rules_forward - + $(ss_rules_iptchains_mkprerules "$proto") + -A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_ dst -j RETURN + -A ss_rules_pre_src -p $proto $o_ipt_extra -j ss_rules_src + -A ss_rules_src -m set --match-set ss_rules_src_bypass src -j RETURN + -A ss_rules_src -m set --match-set ss_rules_src_forward src -j ss_rules_forward + -A ss_rules_src -m set --match-set ss_rules_src_checkdst src -j ss_rules_dst + -A ss_rules_src -j $src_default_target -m comment --comment "src_default: $o_src_default" + -A ss_rules_dst -m set --match-set ss_rules_dst_bypass dst -j RETURN + -A ss_rules_dst -m set --match-set ss_rules_dst_forward dst -j ss_rules_forward + $recentrst_addset_rules + -A ss_rules_dst -j $dst_default_target -m comment --comment "dst_default: $o_dst_default" + $forward_rules + COMMIT + $recentrst_mangle_rules + EOF +} -[ -z "$server" -o -z "$local_port" ] && usage 2 +ss_rules_iptchains_mkprerules() { + local proto="$1" -if [ "$TPROXY" = 1 ]; then - unset SERVER - LOCAL_PORT=$local_port -elif [ "$TPROXY" = 2 ]; then - : ${SERVER:?"You must assign an ip for the udp relay server."} - : ${LOCAL_PORT:?"You must assign a port for the udp relay server."} -fi + if [ -z "$o_ifnames" ]; then + echo "-I PREROUTING 1 -p $proto -j ss_rules_pre_src" + else + echo $o_ifnames \ + | tr ' ' '\n' \ + | sed "s/.*/-I PREROUTING 1 -i \\0 -p $proto -j ss_rules_pre_src/" + fi +} -flush_rules && ipset_init && ipt_nat && ipt_mangle && export_ipt_rules -RET=$? -[ "$RET" = 0 ] || loger 3 "Start failed!" -exit $RET +ss_rules_parse_args "$@" +ss_rules_flush +ss_rules_ipset_init +ss_rules_iptchains_init