fix: output rules

Reviewed-on: https://gitea.oyacoi.ru/pyrschtjag/xray-manager/pulls/7

config/xray-manager.example

@@ -19,15 +19,15 @@ config xray-list
 	list ip '1.0.0.1'
 
 config xray-list
-    option name 'pc'
+	option name 'pc'
-    option direction 'force_src'
+	option direction 'force_src'
-    list ip '192.168.2.10'
+	list ip '192.168.2.10'
 
 config xray-list
-    option name 'pc_exclude'
+	option name 'pc_exclude'
-    option direction 'dst'
+	option direction 'dst'
-    option exclude '1'
+	option exclude '1'
-    option parent 'pc'
+	option parent 'pc'
 	list domain 'ifconfig.io'
 
 config xray-list

init.d/xray-manager

@@ -9,9 +9,9 @@ extra_command "update" "Download and refresh remote lists"
 
 start_service() {
     "$XRAYMANAGER_BIN" start
-
     procd_open_instance "main"
-    procd_set_param command /bin/true 
+    procd_set_param command /bin/sh -c "while true; do sleep 3600; done"
+    procd_set_param respawn
     procd_close_instance
 }
 
@@ -20,9 +20,17 @@ stop_service() {
 }
 
 reload_service() {
-    "$XRAYMANAGER_BIN" reload
+    if procd_running "xray-manager" "main"; then
+        "$XRAYMANAGER_BIN" reload
+    else
+        echo "xray-manager is not running"
+    fi
 }
 
 update() {
-    "$XRAYMANAGER_BIN" update
+    if procd_running "xray-manager" "main"; then
-}
+        "$XRAYMANAGER_BIN" update
+    else
+        echo "xray-manager is not running"
+    fi
+}

xray-manager.sh

@@ -4,26 +4,45 @@
 
 readonly LNET_RESERVED="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 100.64.0.0/10 224.0.0.0/4 255.255.255.255/32 0.0.0.0/8"
 readonly LNET_NAME="system_lnet"
-readonly PING_ADDR="1.1.1.1"
+readonly TEST_DOMAIN="github.com"
+readonly PING_ADDR=1.1.1.1
+readonly RT_TABLE=110
+readonly DEBUG=0
+readonly DEBUG_LOG="/tmp/xray-manager.log"
 
 _log() {
-    local msg="$1" level="${2:-info}" to_console="${3:-1}"
+    local msg="$1" 
-    logger -t xray-manager -p "daemon.$level" "$msg"
+    local level="${2:-info}"
-    
+    local to_console="${3:-1}"
+
+    [ "$level" = "debug" ] && [ "$DEBUG" -ne 1 ] && return
+
+    if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
+        echo "$(date '+%Y-%m-%d %H:%M:%S') $msg" >> "$DEBUG_LOG"
+    fi
+
+    local sys_level="info"
+    case "$level" in
+        info)  sys_level="info" ;;
+        crit)  sys_level="crit" ;;
+        err)   sys_level="err" ;;
+        warn)  sys_level="warning" ;;
+        debug) sys_level="debug" ;;
+    esac
+
+    [ "$level" != "debug" ] && logger -t xray-manager -p "daemon.$sys_level" "$msg"
+
     if [ "$to_console" = "1" ]; then
-        echo "$msg"
+        printf "%s\n" "$msg"
     fi
 }
 
-_get_md5() { 
+_get_md5() { echo "$1" | md5sum | cut -d' ' -f1; }
-    echo "$1" | md5sum | cut -d' ' -f1 
-}
 
 _init_vars() {
+    _log "config: loading configuration" "debug"
     config_load xray-manager
-    
     local s="main"
-
     TABLE=$(uci -q get xray-manager.$s.table_name)
     TPROXY_PORT=$(uci -q get xray-manager.$s.tproxy_port)
     TPROXY_MARK=$(uci -q get xray-manager.$s.tproxy_mark)
@@ -39,437 +58,374 @@ _init_vars() {
     config_list_foreach "$s" proxy_ip _get_proxy_list
 
     local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK TIMEOUT IPNET_DIR DNSMASQ_DIR CACHE_DIR ACTIVE_LIST"
-
     for var in $required_vars; do
         eval val=\$$var
         if [ -z "$val" ]; then
-            _log "Variable '$var' is not set in UCI section 'main'!" "err" "1"
+            _log "config: variable '$var' is missing" "crit"
             return 1
         fi
     done
 
+    _log "config: loaded table=$TABLE, port=$TPROXY_PORT, mark=$TPROXY_MARK" "debug"
     mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR" "${ACTIVE_LIST%/*}"
-    return 0
-}
 
-_check_marks() {
+    if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
-    local m_dec=$(printf "%d" "$CLIENT_MARK" 2>/dev/null)
+        : > "$DEBUG_LOG" 2>/dev/null
-    local m_hex=$(printf "%x" "$m_dec" 2>/dev/null)
-    local m_pattern="($m_dec|0x0*$m_hex)"
-
-    if nft list ruleset 2>/dev/null | sed "/table ip $TABLE/,/^}/d" | grep -iqE "mark.*$m_pattern"; then
-        _log "Mark 0x$m_hex is busy in another table!" "err" "1"
-        return 1
     fi
+
     return 0
 }
 
-_check_dnsmasq() {
+_validate_config() {
-    local current_dns_dir=$(uci -q get dhcp.@dnsmasq[0].confdir | awk '{print $1}')
+    _log "config: validating uci syntax" "debug"
-
+    
-    if [ -z "$current_dns_dir" ]; then
+    if [ -f "/etc/config/xray-manager" ]; then
-        _log "dnsmasq.confdir is empty. Setting to $DNSMASQ_DIR" "info" "1"
+        sed -i 's/^  \+/	/g' /etc/config/xray-manager
-        uci add_list dhcp.@dnsmasq[0].confdir="$DNSMASQ_DIR"
-        uci commit dhcp
-        DNS_CHANGES=1
-    elif [ "$current_dns_dir" != "$DNSMASQ_DIR" ]; then
-        _log "dnsmasq.confdir mismatch: $current_dns_dir" "err" "1"
-        _log "Expected $DNSMASQ_DIR. Check your DHCP config." "err" "1"
-        return 1
     fi
-    return 0
-}
 
-_load_config_full() {
+    local dns_confdir
-    _init_vars || return 1
+    dns_confdir=$(uci -q get dhcp.@dnsmasq[0].confdir)
-    _check_marks || return 1
+    if [ -z "$dns_confdir" ] || ! echo "$dns_confdir" | grep -q "$DNSMASQ_DIR"; then
-    _check_dnsmasq || return 1
+        _log "config: $DNSMASQ_DIR is not set in dnsmasq" "warn"
-    return 0
+    fi
+
+    local allowed_opts="name direction exclude parent ip domain url_ip url_domain"
+
+    validate_list_section() {
+        local s="$1" name direction
+        config_get name "$s" name
+        config_get direction "$s" direction "dst"
+
+        if [ -z "$name" ]; then
+            _log "config: section $s is missing name" "crit"
+            exit 1
+        fi
+
+        local current_opt
+        for current_opt in $(uci show xray-manager."$s" | cut -d'.' -f3 | cut -d'=' -f1 | sort -u); do
+            case "$current_opt" in
+                .*) continue ;;
+            esac
+            
+            if ! echo "$allowed_opts" | grep -qw "$current_opt"; then
+                _log "$name: unknown option: '$current_opt'" "err"
+                exit 1
+            fi
+        done
+
+        case "$direction" in
+            src|dst|out|force_src) ;;
+            *) _log "$name: invalid direction: $direction" "err"; exit 1 ;;
+        esac
+    }
+    config_foreach validate_list_section "xray-list"
+    _log "config: validation complete" "info"
 }
 
 _nft_init() {
-    [ -z "$TABLE" ] && return 1
+    _log "$TABLE: initializing nft table" "info"
-    _log "Initializing NFT table: $TABLE"
     nft add table ip "$TABLE" 2>/dev/null
-
+    
+    _log "$TABLE: setting up base chains" "debug"
     nft add chain ip "$TABLE" prerouting { type filter hook prerouting priority mangle \; policy accept \; } 2>/dev/null
     nft flush chain ip "$TABLE" prerouting
     nft add rule ip "$TABLE" prerouting fib daddr type local accept
-
+    
     nft add chain ip "$TABLE" output { type route hook output priority -150 \; policy accept \; } 2>/dev/null
     nft flush chain ip "$TABLE" output
     nft add rule ip "$TABLE" output fib daddr type local accept
 
     local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
-    ip route show table 110 | grep -q "local default" || ip route add local default dev lo table 110
+    _log "route: configuring table $RT_TABLE, mark $mark_hex" "debug"
-    ip rule show | grep -q "fwmark $mark_hex lookup 110" || ip rule add fwmark "$TPROXY_MARK" table 110
+    ip route show table $RT_TABLE 2>/dev/null | grep -q "local default" || ip route add local default dev lo table $RT_TABLE
+    ip rule show | grep -q "fwmark $mark_hex lookup $RT_TABLE" || ip rule add fwmark "$TPROXY_MARK" table $RT_TABLE
 }
 
-_nft_batch_insert() {
+_nft_prepare_data() {
-    local table="$1" sname="$2" file="$3"
+    local id="$1" file="$2" type="$3" changed="$4" dir="$5"
-    {
+    local sname="s_$id"
-        printf "add element ip %s %s { " "$table" "$sname"
+    local set_params="type ipv4_addr; flags interval; auto-merge;"
-        awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
-            { val = ($1 ~ /\//) ? $1 : $1 "/32"
-              printf "%s%s", (count++ ? ", " : ""), val }' "$file"
-        echo " }"
-    } | nft -f -
-}
-
-_nft_apply_data() {
-    local sname="$1" file="$2" exc="$3" dir="$4" type="$5" changed="$6" parent="$7"
-    [ -z "$TABLE" ] && return 1
-
-    local nft_sname="s_$sname"
-    local flags="interval"
-    local set_params="type ipv4_addr; flags $flags; auto-merge;"
     
-    if [ "$type" = "dom" ] || [ "$type" = "udom" ]; then
+    [[ "$type" == *dom ]] && set_params="type ipv4_addr; flags interval,timeout; timeout $TIMEOUT; auto-merge;"
-        flags="interval,timeout"
-        set_params="type ipv4_addr; flags $flags; timeout $TIMEOUT; auto-merge;"
-    fi
     
-    nft add set ip "$TABLE" "$nft_sname" { $set_params } 2>/dev/null
+    _log "$sname: creating nft set" "debug"
+    nft add set ip "$TABLE" "$sname" { $set_params } 2>/dev/null
 
-    if [ "$changed" = "1" ] && [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
+    if [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
-        _log "  -> Syncing '$nft_sname' to NFT ruleset..." "info" "1"
+        if [ "$changed" = "1" ] || [ "$FULL_LOAD" = "1" ]; then
-        nft flush set ip "$TABLE" "$nft_sname"
+            _log "$sname: flushing and loading elements" "debug"
-        _nft_batch_insert "$TABLE" "$nft_sname" "$file"
+            nft flush set ip "$TABLE" "$sname"
+            { 
+                printf "add element ip %s %s { " "$TABLE" "$sname"
+                awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { addr = ($1 ~ /\// ? $1 : $1"/32"); printf "%s%s", (count++ ? ", " : ""), addr }' "$file"
+                printf " }\n" 
+            } | nft -f -
+        fi
     fi
 
     if [ "$dir" = "force_src" ]; then
-        local chain_name="f_$sname"
+        local cn="f_$id"
-        nft add chain ip "$TABLE" "$chain_name" 2>/dev/null
+        _log "$cn: creating force-chain" "debug"
-        nft flush chain ip "$TABLE" "$chain_name"
+        nft add chain ip "$TABLE" "$cn" 2>/dev/null
-        nft add rule ip "$TABLE" "$chain_name" meta l4proto "{ tcp, udp }" \
+        nft flush chain ip "$TABLE" "$cn"
-            tproxy to 127.0.0.1:"$TPROXY_PORT" \
+        nft add rule ip "$TABLE" "$cn" meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
-            ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
-        return
-    fi
-    
-    local has_parent=0
-    if [ "$exc" = "1" ] && [ -n "$parent" ]; then
-        local p_chain="f_${parent}_ip"
-        if nft list chain ip "$TABLE" "$p_chain" >/dev/null 2>&1; then
-            _log "  -> Adding personal exception '$sname' to chain '$p_chain'" "info" "0"
-            nft insert rule ip "$TABLE" "$p_chain" ip daddr "@$nft_sname" accept 2>/dev/null
-            has_parent=1
-        fi
-    fi
-
-    if [ "$exc" = "1" ]; then
-        [ "$has_parent" = "1" ] && return 0
-        local sel="ip daddr"; [ "$dir" = "src" ] && sel="ip saddr"
-        
-        if [ "$sname" = "$LNET_NAME" ] && [ "$dir" = "dst" ]; then
-            local extra_chains=$(nft list table ip "$TABLE" | grep "chain f_" | awk '{print $2}')
-            for c in $extra_chains; do
-                nft insert rule ip "$TABLE" "$c" "$sel" "@$nft_sname" accept 2>/dev/null
-            done
-        fi
-
-        if [ "$dir" = "dst" ] || [ "$dir" = "src" ]; then
-            nft insert rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
-        elif [ "$dir" = "out" ]; then
-            nft insert rule ip "$TABLE" output "$sel" "@$nft_sname" accept 2>/dev/null
-        fi
-        return 0
-    fi
-
-    if [ "$dir" = "src" ]; then
-        nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" ct mark set "$CLIENT_MARK" 2>/dev/null
-    elif [ "$dir" = "dst" ]; then
-        nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" \
-            meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
-    elif [ "$dir" = "out" ]; then
-        nft add rule ip "$TABLE" output ip daddr "@$nft_sname" \
-            meta l4proto "{ tcp, udp }" counter ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
     fi
 }
 
+_nft_apply_rule() {
+    local sname="$1" dir="$2" exc="$3" parent="$4" mode="$5"
+    local nft_sname="s_$sname"
+    local sel="ip daddr"
+    [ "$dir" = "src" ] && sel="ip saddr"
+
+    case "$mode" in
+        jumps)
+            [ "$dir" = "force_src" ] && {
+                _log "$nft_sname: applying jump to f_$sname" "debug"
+                nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" jump "f_${sname}" 2>/dev/null
+            }
+            ;;
+        exclude)
+            [ "$exc" != "1" ] && [ "$sname" != "$LNET_NAME" ] && return
+            
+            local target_info=""
+            [ -n "$parent" ] && target_info=" target=$parent"
+            _log "$nft_sname: applying exclude rule$target_info" "debug"
+
+            if [ -n "$parent" ]; then
+                nft insert rule ip "$TABLE" "$parent" ip daddr "@$nft_sname" accept 2>/dev/null
+            else
+                [ "$dir" != "out" ] && nft add rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
+                [ "$dir" = "out" ] && nft add rule ip "$TABLE" output "$sel" "@$nft_sname" accept 2>/dev/null
+            fi
+            ;;
+        main_rules)
+            [ "$exc" = "1" ] || [ "$dir" = "force_src" ] && return
+            
+            _log "$nft_sname: applying tproxy rules" "debug"
+
+            if [ "$mode_chain" = "prerouting" ] && [ "$dir" != "out" ]; then
+                if [ "$dir" = "src" ]; then
+                    nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" ct mark set "$CLIENT_MARK" 2>/dev/null
+                else
+                    nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
+                fi
+            elif [ "$mode_chain" = "output" ] && [ "$dir" = "out" ]; then
+                nft add rule ip "$TABLE" output ip daddr "@$nft_sname" meta l4proto "{ tcp, udp }" counter ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
+            fi
+            ;;
+    esac
+}
+
 _process_item() {
-    local id="$1" val="$2" type="$3" dir="$4" exc="$5" parent="$6" fullpath hfile changed=0
+    local id="$1" val="$2" type="$3" dir="$4" exc="$5" parent="$6" 
+    local fullpath hfile changed=0
     
-    [ "$type" = "dom" ] || [ "$type" = "udom" ] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
+    [[ "$type" == *dom ]] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
     hfile="$CACHE_DIR/$id.hash"
     
     echo "$fullpath" >> "$ACTIVE_LIST"
     echo "$hfile" >> "$ACTIVE_LIST"
-
+    
     local new_hash=$(_get_md5 "$val")
     local old_hash=$(cat "$hfile" 2>/dev/null)
 
-    if [ "$SKIP_URL" = "1" ] && { [ "$type" = "uip" ] || [ "$type" = "udom" ]; }; then
+    local status="stable"
-        _log "Reloading $id..." "info" "1"
+    if [ "$new_hash" != "$old_hash" ]; then
-        if [ "$new_hash" != "$old_hash" ]; then
+        status="changed"
-             _log "  -> Warning: UCI config changed. Run 'update' to fetch new data." "warn" "1"
+        [ "$SKIP_URL" = "1" ] && [[ "$type" == u* ]] && NEED_UPDATE=1
-        fi
+    fi
+   
+    _log "$id status: $status" "debug"
 
-        [ -f "$fullpath" ] && _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" 0 "$parent"
+    if [ "$SKIP_URL" = "1" ] && [[ "$type" == u* ]]; then
+        _log "$id: skipping download (reload mode)" "debug"
+        [ ! -f "$fullpath" ] && { _log "$id: data file missing" "warn"; NEED_UPDATE=1; }
+        [ -f "$fullpath" ] && _nft_prepare_data "$id" "$fullpath" "$type" 0 "$dir"
         return
     fi
 
     if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ] || [ "$SKIP_URL" = "0" ]; then
         case "$type" in
-            ip) 
+            ip)
-                echo "$val" | tr ' ' '\n' | sed 's/\r//g; /^#/d; /^[[:space:]]*$/d; /\//! s|$|/32|' | sort -u > "$fullpath.tmp"
+                echo "$val" | tr ' ' '\n' | sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' -e '/\//! s|$|/32|' | sort -u > "$fullpath.tmp"
-                if ! cmp -s "$fullpath.tmp" "$fullpath"; then
-                    mv "$fullpath.tmp" "$fullpath"; changed=1
-                else
-                    rm -f "$fullpath.tmp"
-                fi
                 ;;
             dom)
-                echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '
+                echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { gsub(/\r/, ""); printf "nftset=/%s/4#ip#%s#%s\n", tolower($1), t, i }' | sort -u > "$fullpath.tmp"
-                    /^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
-                    { gsub(/\r/, ""); print "nftset=/" tolower($1) "/4#ip#" t "#" i }' | sort -u > "$fullpath.tmp"
-                if ! cmp -s "$fullpath.tmp" "$fullpath"; then
-                    mv "$fullpath.tmp" "$fullpath"; changed=1; DNS_CHANGES=1
-                else
-                    rm -f "$fullpath.tmp"
-                fi
                 ;;
             uip|udom)
-                _log "Checking $id..." "info" "1"
+                _log "$id: fetching remote list" "info"
-                local tmp_all="$CACHE_DIR/dl_all_$id"
+                local tmp_all="$CACHE_DIR/dl_$id"
                 : > "$tmp_all"
                 local dl_ok=0
-                
-                for url in $val; do
-                    local url_hash=$(echo "$url" | md5sum | cut -c1-8)
-                    local etag_file="$CACHE_DIR/${id}_${url_hash}.etag"
-                    local cache_raw="$CACHE_DIR/${id}_${url_hash}.raw"
-                    local header_file="$CACHE_DIR/header_$id"
-                    local old_etag=$(cat "$etag_file" 2>/dev/null | tr -d '\r\n ')
-                    local etag_header=""; [ -n "$old_etag" ] && etag_header="-H 'If-None-Match: \"$old_etag\"'"
-                    
-                    local tmp_single="$CACHE_DIR/tmp_dl_$url_hash"
-                    eval "curl -sSfL --connect-timeout 10 $etag_header -D '$header_file' '$url'" > "$tmp_single"
-                    local exit_code=$?
 
-                    if grep -q "HTTP/.* 304" "$header_file" 2>/dev/null; then
+                for url in $val; do
-                        _log "  -> $url_hash: 304 Not Modified" "info" "1"
+                    local uhash=$(echo "$url" | md5sum | cut -c1-8)
-                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all"
+                    _log "$id: downloading $url" "debug"
-                        dl_ok=1
+                    local cache_raw="$CACHE_DIR/${id}_$uhash.raw"
-                    elif [ $exit_code -eq 0 ] && [ -s "$tmp_single" ]; then
+                    local hfile_tmp="$CACHE_DIR/h_$id"
-                        _log "  -> $url_hash: 200 OK" "info" "1"
+                    local etag_f="$CACHE_DIR/${id}_$uhash.etag"
-                        local current_etag=$(grep -i "^etag:" "$header_file" | sed 's/[Ee][Tt][Aa][Gg]: //; s/W\///; s/["\r\n ]//g')
+                    local etag=$(cat "$etag_f" 2>/dev/null)
-                        [ -n "$current_etag" ] && echo "$current_etag" > "$etag_file"
+
-                        cat "$tmp_single" > "$cache_raw"
+                    curl -sSfL --connect-timeout 15 ${etag:+-H "If-None-Match: \"$etag\""} -D "$hfile_tmp" "$url" > "$tmp_all.raw"
-                        cat "$tmp_single" >> "$tmp_all"
+                    local res=$?
+                    
+                    if grep -q "304" "$hfile_tmp" 2>/dev/null; then
+                        _log "$id: 304 not modified" "info"
+                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all" && dl_ok=1
+                    elif [ $res -eq 0 ] && [ -s "$tmp_all.raw" ]; then
+                        _log "$id: 200 ok" "info"
+                        grep -i "^etag:" "$hfile_tmp" | awk -F': ' '{print $2}' | sed 's/W\///; s/["\r\n ]//g' > "$etag_f"
+                        cat "$tmp_all.raw" > "$cache_raw"
+                        cat "$tmp_all.raw" >> "$tmp_all"
                         dl_ok=1
                     else
-                        _log "  -> $url_hash: Error. Trying cache..." "warn" "1"
+                        _log "$id: download failed, using local cache" "warn"
-                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all"
+                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all" && dl_ok=1
                     fi
-                    rm -f "$header_file" "$tmp_single"; echo "" >> "$tmp_all"
                 done
 
-                if [ "$dl_ok" = "1" ] && [ -s "$tmp_all" ]; then
+                if [ "$dl_ok" = "1" ]; then
-                    local out="$CACHE_DIR/out_$id"
                     if [ "$type" = "uip" ]; then
-                        sed 's/\r//g; /^#/d; /^[[:space:]]*$/d' "$tmp_all" | awk '{print ($1 ~ /\//) ? $1 : $1"/32"}' | sort -u > "$out"
+                        sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' "$tmp_all" | awk '{ print ($1 ~ /\// ? $1 : $1"/32") }' | sort -u > "$fullpath.tmp"
                     else
-                        tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | \
+                        tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | awk -v t="$TABLE" -v i="s_$id" '{ printf "nftset=/%s/4#ip#%s#%s\n", $1, t, i }' > "$fullpath.tmp"
-                        sed "s|^|nftset=/|; s|\$|/4#ip#$TABLE#s_$id|" > "$out"
                     fi
-                    
+                fi 
-                    if [ -f "$fullpath" ] && cmp -s "$out" "$fullpath"; then
+                ;;
-                        _log "  -> $id: No changes in content." "info" "1"
-                        rm -f "$out"
-                    else
-                        _log "  -> $id: Content updated." "info" "1"
-                        mv "$out" "$fullpath"; changed=1
-                        [ "$type" = "udom" ] && DNS_CHANGES=1
-                    fi
-                fi
-                rm -f "$tmp_all" ;;
         esac
+
+        if [ -s "$fullpath.tmp" ] && ! cmp -s "$fullpath.tmp" "$fullpath"; then
+            mv "$fullpath.tmp" "$fullpath"
+            changed=1
+            [[ "$type" == *dom ]] && DNS_CHANGES=1
+            _log "$id: list updated" "info"
+        else 
+            rm -f "$fullpath.tmp"
+        fi
         echo "$new_hash" > "$hfile"
     fi
-    _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "$changed" "$parent"
+    _nft_prepare_data "$id" "$fullpath" "$type" "$changed" "$dir"
 }
 
 _process_section() {
-    local s="$1" name dir exc parent ips doms uips udoms
+    local s="$1" mode="$2" name dir exc parent
-    config_get name "$s" name; config_get dir "$s" direction "dst"; config_get exc "$s" exclude "0"
+    config_get name "$s" name
+    config_get dir "$s" direction "dst"
+    config_get exc "$s" exclude "0"
     config_get parent "$s" parent
+    
     [ -z "$name" ] && return
-
     name=${name//[^a-zA-Z0-9_]/}
-    _append_list() { CURRENT_VAL="${CURRENT_VAL}${CURRENT_VAL:+ }$1"; }
-    
-    CURRENT_VAL=""; config_list_foreach "$s" ip _append_list; ips="$CURRENT_VAL"
-    CURRENT_VAL=""; config_list_foreach "$s" domain _append_list; doms="$CURRENT_VAL"
-    CURRENT_VAL=""; config_list_foreach "$s" url_ip _append_list; uips="$CURRENT_VAL"
-    CURRENT_VAL=""; config_list_foreach "$s" url_domain _append_list; udoms="$CURRENT_VAL"
-    
-    [ -n "$ips" ]   && _process_item "${name}_ip"   "$ips"   "ip"   "$dir" "$exc" "$parent"
-    [ -n "$doms" ]  && _process_item "${name}_dom"  "$doms"  "dom"  "$dir" "$exc" "$parent"
-    [ -n "$uips" ]  && _process_item "${name}_uip"  "$uips"  "uip"  "$dir" "$exc" "$parent"
-    [ -n "$udoms" ] && _process_item "${name}_udom" "$udoms" "udom" "$dir" "$exc" "$parent"
-}
 
-_cleanup_orphans() {
+    [ "$exc" = "1" ] && [ -n "$parent" ] && parent="f_${parent}_ip"
-    [ -z "$IPNET_DIR" ] || [ -z "$DNSMASQ_DIR" ] && return
+
-    for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
+    if [ -z "$mode" ]; then
-        [ -e "$f" ] || continue
+        _log "$name: configuring section" "debug"
-        if ! grep -Fxq "$f" "$ACTIVE_LIST" 2>/dev/null; then
+        _get_v() { V="${V}${V:+ }$1"; }
-            local base="${f##*/}"; local sname="${base%.*}"
+        V=""; config_list_foreach "$s" ip _get_v; [ -n "$V" ] && _process_item "${name}_ip" "$V" "ip" "$dir" "$exc" "$parent"
-            _log "Orphan detected: $sname. Cleaning up..." "info" "1"
+        V=""; config_list_foreach "$s" domain _get_v; [ -n "$V" ] && _process_item "${name}_dom" "$V" "dom" "$dir" "$exc" "$parent"
-            nft delete set ip "$TABLE" "s_$sname" 2>/dev/null
+        V=""; config_list_foreach "$s" url_ip _get_v; [ -n "$V" ] && _process_item "${name}_uip" "$V" "uip" "$dir" "$exc" "$parent"
-            [[ "$f" == "$DNSMASQ_DIR"* ]] && DNS_CHANGES=1
+        V=""; config_list_foreach "$s" url_domain _get_v; [ -n "$V" ] && _process_item "${name}_udom" "$V" "udom" "$dir" "$exc" "$parent"
-            rm -f "$f" "$CACHE_DIR/$sname.hash"
+    else
+        [ -f "$IPNET_DIR/${name}_ip.lst" ] && _nft_apply_rule "${name}_ip" "$dir" "$exc" "$parent" "$mode"
+        [ -f "$DNSMASQ_DIR/${name}_dom.lst" ] && _nft_apply_rule "${name}_dom" "$dir" "$exc" "$parent" "$mode"
+        [ -f "$IPNET_DIR/${name}_uip.lst" ] && _nft_apply_rule "${name}_uip" "$dir" "$exc" "$parent" "$mode"
+        [ -f "$DNSMASQ_DIR/${name}_udom.lst" ] && _nft_apply_rule "${name}_udom" "$dir" "$exc" "$parent" "$mode"
+
+        if [ "$mode" = "exclude" ] && [ "$dir" = "force_src" ]; then
+             _log "$name: force-src: injecting lnet exclusion" "debug"
+             _nft_apply_rule "$LNET_NAME" "dst" "1" "f_${name}_ip" "exclude"
         fi
-    done
-    rm -f "$ACTIVE_LIST"
-}
-
-_wait_for_net() {
-    local timeout=20
-    _log "Waiting for network routes..."
-    while [ ! -s /proc/net/route ] && [ $timeout -gt 0 ]; do
-        sleep 1
-        timeout=$((timeout - 1))
-    done
-
-    timeout=20
-    _log "Checking internet connectivity ($PING_ADDR)..."
-    while ! ping -q -c 1 -W 2 "$PING_ADDR" >/dev/null 2>&1 && [ $timeout -gt 0 ]; do
-        _log "  -> No response from $PING_ADDR, retrying... ($timeout s)"
-        sleep 2
-        timeout=$((timeout - 2))
-    done
-    
-    if [ $timeout -le 0 ]; then
-        _log "  -> WARNING: Internet check failed. Using cache/local data." "warn"
-        export SKIP_URL=1
-    fi
-}
-
-_validate_config() {
-    _log "Validating UCI config syntax..." "info" "0"
-
-    local main_allowed="table_name tproxy_port tproxy_mark client_mark timeout ipnet_dir dnsmasq_dir cache_dir active_list proxy_ip"
-    local main_required="table_name tproxy_port tproxy_mark client_mark"
-    
-    for opt in $(uci show xray-manager.@xray-manager[0] | cut -d'.' -f3 | cut -d'=' -f1); do
-        if ! echo "$main_allowed" | grep -qw "$opt"; then
-            _log "Unknown option '$opt' in xray-manager main section!" "err" "1"
-            exit 1
-        fi
-    done
-
-    validate_list_section() {
-        local s="$1"
-        local name direction exclude
-        local list_allowed="name direction exclude parent ip domain url_ip url_domain"
-        
-        config_get name "$s" name
-        config_get direction "$s" direction
-        config_get exclude "$s" exclude
-
-        if [ -z "$name" ]; then
-            _log "Section $s is missing 'option name'!" "err" "1"
-            exit 1
-        fi
-
-        case "$direction" in
-            src|dst|out|force_src) ;;
-            *) _log "Section '$name' has invalid direction '$direction'!" "err" "1"; exit 1 ;;
-        esac
-
-        local has_data=0
-        for opt in $list_allowed; do
-            [ -n "$(uci -q get xray-manager.$s.$opt)" ] && has_data=1
-        done
-
-        if [ "$has_data" -eq 0 ]; then
-            _log "Section '$name' has no data (ip, domain, url_ip, etc.)!" "err" "1"
-            exit 1
-        fi
-
-        for opt in $(uci show xray-manager.$s | cut -d'.' -f3 | cut -d'=' -f1); do
-             if ! echo "$list_allowed" | grep -qw "$opt"; then
-                _log "Unknown option '$opt' in section '$name'!" "err" "1"
-                exit 1
-            fi
-        done
-    }
-
-    config_foreach validate_list_section "xray-list"
-}
-
-_apply_force_jumps() {
-    local s="$1" n d
-    config_get n "$s" name
-    config_get d "$s" direction
-    if [ "$d" = "force_src" ] && [ -n "$n" ]; then
-        n=$(echo "$n" | sed 's/[^a-zA-Z0-9_]//g')
-        nft insert rule ip "$TABLE" prerouting ip saddr "@s_${n}_ip" jump "f_${n}_ip" 2>/dev/null
     fi
 }
 
 _run() {
+    _log "main: starting execution ($1)" "info"
     _init_vars || return 1
     _validate_config
-    DNS_CHANGES=0
+    DNS_CHANGES=0; NEED_UPDATE=0; : > "$ACTIVE_LIST"
     
-    if [ "$FULL_LOAD" = "1" ]; then
+    [ "$FULL_LOAD" = "1" ] && _wait_for_net
-        _wait_for_net
+    _nft_init
-        _log "Starting Xray-Manager (Full Load)..." "info" "1"
-        _load_config_full || return 1
-    else
-        _log "Running Xray-Manager (Partial Load)..." "info" "1"
-    fi
-    
-    : > "$ACTIVE_LIST"
-    _nft_init || return 1
-
-    if [ -n "$PROXY_SERVERS" ]; then
-        _log "Applying proxy server exclusions..."
-        local proxy_set="s_proxy_servers"
-        nft "add set ip $TABLE $proxy_set { type ipv4_addr; flags interval; }" 2>/dev/null
-        nft "flush set ip $TABLE $proxy_set" 2>/dev/null
-        for ip in $PROXY_SERVERS; do
-            local val=$([ "${ip%/*}" = "$ip" ] && echo "$ip/32" || echo "$ip")
-            nft "add element ip $TABLE $proxy_set { $val }" 2>/dev/null
-        done
-        nft insert rule ip "$TABLE" output ip daddr "@$proxy_set" accept 2>/dev/null
-    fi
 
+    _log "main: processing data sections" "debug"
     config_foreach _process_section "xray-list"
-    
     _process_item "$LNET_NAME" "$LNET_RESERVED" "ip" "dst" "1"
-    _process_item "$LNET_NAME" "$LNET_RESERVED" "ip" "out" "1"
 
-    config_foreach _apply_force_jumps "xray-list"
+    _log "main: applying nft rules" "info"
+    config_foreach _process_section "xray-list" "jumps"
+    _nft_apply_rule "$LNET_NAME" "dst" "1" "" "exclude"
+    config_foreach _process_section "xray-list" "exclude"
     
-    _cleanup_orphans
+    _log "main: applying proxy bypass" "debug"
-    
+    if [ -n "$PROXY_SERVERS" ]; then
-    if [ "$DNS_CHANGES" = "1" ]; then
+        _process_item "proxy_servers" "$PROXY_SERVERS" "ip" "out" "0"
-        _log "Domains changes detected. Restarting dnsmasq..." "info" "1"
+        nft add rule ip "$TABLE" output ip daddr "@s_proxy_servers" accept 2>/dev/null
-        /etc/init.d/dnsmasq restart
-    else
-        _log "No domains changes. dnsmasq restart skipped." "info" "1"
     fi
+    
+    _log "main: applying tproxy rules" "debug"
+    mode_chain="prerouting"; config_foreach _process_section "xray-list" "main_rules"
+    mode_chain="output";     config_foreach _process_section "xray-list" "main_rules"
+
+    _log "main: cleaning up orphans" "info"
+    if [ -n "$IPNET_DIR" ] && [ -n "$DNSMASQ_DIR" ]; then
+        for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
+            [ -e "$f" ] || continue
+            if ! grep -Fxq "$f" "$ACTIVE_LIST"; then
+                local fname="${f##*/}"
+                _log "orphan: removing $fname" "info"
+                case "$f" in "$DNSMASQ_DIR"/*) DNS_CHANGES=1 ;; esac
+                nft delete set ip "$TABLE" "s_${fname%.*}" 2>/dev/null
+                rm -f "$f"
+            fi
+        done
+    fi
+
+    [ "$DNS_CHANGES" = "1" ] && { _log "dnsmasq: restarting service" "info"; /etc/init.d/dnsmasq restart; }
+    [ "$SKIP_URL" = "1" ] && [ "$NEED_UPDATE" = "1" ] && { 
+        _log "main: outdated lists detected" "warn"
+        _log "main: run 'update' to refresh data" "warn"
+    }
+    
+    _log "main: execution finished" "info"
+}
+
+_wait_for_net() {
+    _log "network: checking connectivity" "info"
+    local t=1
+    while [ "$t" -le 20 ]; do
+        if ping -q -c 1 -W 2 "$PING_ADDR" >/dev/null 2>&1; then
+            if nslookup "$TEST_DOMAIN" >/dev/null 2>&1; then
+                _log "network: access confirmed" "info"
+                return 0
+            else
+                _log "network: dns resolution failed" "warn"
+            fi
+        else
+            _log "network: unreachable" "warn"
+        fi
+        sleep 2; t=$((t + 2))
+    done
+    _log "network: timeout: switching to offline mode" "warn"
+    export SKIP_URL=1
 }
 
 _stop() {
-    _load_config_full || exit 1
+    _log "main: stopping service" "info"
-    _log "Stopping Xray-Manager and flushing NFT table..." "info" "1"
+    _init_vars 
     nft delete table ip "$TABLE" 2>/dev/null
-    ip rule del fwmark "$TPROXY_MARK" table 110 2>/dev/null
+    ip rule del fwmark "$TPROXY_MARK" table $RT_TABLE 2>/dev/null
-    ip route del local default dev lo table 110 2>/dev/null
+    ip route del local default dev lo table $RT_TABLE 2>/dev/null
-    rm -rf "$IPNET_DIR"/* "$DNSMASQ_DIR"/* "$CACHE_DIR"/*
     /etc/init.d/dnsmasq restart
+    _log "main: service stopped" "info"
 }
 
 case "$1" in
-    start)   export SKIP_URL=0 FULL_LOAD=1; _run ;;
+    start)      export SKIP_URL=0 FULL_LOAD=1; _run "start" ;;
-    restart) _stop; export SKIP_URL=0 FULL_LOAD=1; _run ;;
+    stop)       _stop ;;
-    reload)  export SKIP_URL=1 FULL_LOAD=0; _run ;;
+    restart)    _stop; export SKIP_URL=0 FULL_LOAD=1; _run "restart" ;;
-    update)  export SKIP_URL=0 FULL_LOAD=0; _run ;;
+    reload)     export SKIP_URL=1 FULL_LOAD=0; _run "reload" ;;
-    stop)    _stop ;;
+    update)     export SKIP_URL=0 FULL_LOAD=0; _run "update" ;;
-    *)       echo "Usage: $0 {start|reload|update|stop|restart}" ;;
+    *)          echo "Usage: $0 {start|stop|restart|reload|update}"; exit 1 ;;
-esac
+esac