packages/net/shadowsocks-libev/files/ss-rules, branch master

shadowsocks-libev: drop the package

2024-07-10T05:16:46Z

The upstream project is declared as bugfix-only and received no update for about 2 years. The developement focus there has shifted. It does not compile with current openwrt main branch. Signed-off-by: Yousong Zhou

shadowsocks-libev: add remote server ips to dst bypass ipset

2024-03-12T16:03:27Z

To align with old iptables-based ss-rules implementation. Supersedes openwrt/packages#20239 Link: https://github.com/openwrt/packages/pull/20239 Signed-off-by: Luis Liou [minor fixup on commit title, version bump, etc.] Signed-off-by: Yousong Zhou

shadowsocks-libev: ss-rules: Add 'auto-merge' flag to avoid conflicts

2023-01-28T08:47:44Z

Link: https://github.com/openwrt/packages/pull/19872 Signed-off-by: Li Xin (squash commits) Signed-off-by: Yousong Zhou

shadowsocks-libev: ss-rules: setup policy rules for udp/ip6

2022-08-11T01:54:18Z

Supersedes: https://github.com/openwrt/packages/pull/18852 Fixes: https://github.com/openwrt/packages/issues/18850 Signed-off-by: Yousong Zhou

shadowsocks-libev: add nft_tcp_extra/nft_udp_extra options

2022-03-07T02:09:56Z

To add extra statement to tcp/udp forward rule, example: ``` config ss_rules 'ss_rules' ... option nft_tcp_extra 'tcp dport { 80, 443 }' # tcp only forward connections with dport 80 or 443 option nft_udp_extra 'udp dport { 53 }' # udp only forward connections with dport 53 ``` This somewhat restores the old ipt_args functionality. Signed-off-by: Zhong Jianxin Signed-off-by: Yousong Zhou (Amend README.md a bit)

shadowsocks-libev: convert to using nft

2022-03-01T02:06:48Z

It will be mostly implemented with ucode templates installed at /usr/share/ss-rules and called from init script. The generated nftables rules will be stored at /etc/nftables.d/ Incompatible changes were introduced as described in the README.md file - Netfilter ipset was replaced with nftables sets - UCI options ipt_args and dst_forward_recentrst of section ss_rules are now deprecated. The former does not apply to nftables. The later not yet implemented with nftables. Signed-off-by: Yousong Zhou

shadowsocks-libev: ignore error from flushing route table

2020-05-06T13:38:53Z

Linux kernel and iproute2 together now implement strict checking of the existence of route tables. Previously kernel does not support filtering by table id, now it does and will error with nlmsgerr "ipv4: FIB table does not exist". Previously iproute2 dump all routes and filter by table id in userspace, now this has changed with iproute2 commit c7e6371bc4af ("ip route: Add protocol, table id and device to dump request") Error scene root@OpenWrt:/# ip route flush table 100 Error: ipv4: FIB table does not exist. Flush terminated root@OpenWrt:/# echo $? 2 Fixes: https://github.com/openwrt/packages/issues/12095 Ref: https://lists.openwall.net/netdev/2019/05/02/105 Signed-off-by: Yousong Zhou

shadowsocks-libev: ss-rules: tweak for readability

2019-02-12T11:49:40Z

- quash errors on detection of ipv6 nat - remove unnecessary rule args "--comment ..." and "-p ..." Signed-off-by: Yousong Zhou

shadowsocks-libev: ss-rules: simplify grep_af

2019-01-22T07:52:42Z

Signed-off-by: Yousong Zhou

shadowsocks-libev: ss-rules: add ipv6 support

2019-01-21T07:19:32Z

It will require support from ip6tables-mod-nat. The added functionality will be skipped otherwise. For $o_dst_bypass6_, include only address blocks in link [1] whose "Globally Reachable" field are explicitly "False" Closes openwrt/packages#7508 [1] IANA IPv6 Special-Purpose Address Registry, https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml Signed-off-by: Yousong Zhou