857 lines
30 KiB
Bash
Executable File
857 lines
30 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
. /lib/functions.sh
|
|
|
|
readonly GLOBAL_CTXKEY="__global__"
|
|
readonly LIST_TYPE_MAP="ip:ip:0 dom:domain:1 uip:url_ip:0 udom:url_domain:1"
|
|
readonly SRC_LIST_SUFFIXES="ip uip"
|
|
readonly ALL_LIST_SUFFIXES="ip dom uip udom"
|
|
readonly DEBUG=0
|
|
readonly DEBUG_LOG="/tmp/xray-manager.log"
|
|
|
|
_log() {
|
|
local message="$1"
|
|
local level="${2:-info}"
|
|
local to_console="${3:-1}"
|
|
|
|
[ "$level" = "debug" ] && [ "$DEBUG" -ne 1 ] && return
|
|
|
|
if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
|
|
echo "$(date '+%Y-%m-%d %H:%M:%S') $message" >> "$DEBUG_LOG"
|
|
fi
|
|
|
|
local syslog_level="$level"
|
|
[ "$level" = "warn" ] && syslog_level="warning"
|
|
|
|
[ "$level" != "debug" ] && logger -t xray-manager -p "daemon.$syslog_level" "$message"
|
|
|
|
if [ "$to_console" = "1" ]; then
|
|
printf "%s\n" "$message" >&2
|
|
fi
|
|
}
|
|
|
|
_get_md5() { echo "$1" | md5sum | cut -d' ' -f1; }
|
|
_file_md5() { [ -s "$1" ] && md5sum "$1" | cut -d' ' -f1; }
|
|
|
|
_is_url_type() {
|
|
case "$1" in
|
|
u*) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
_sanitize_name() {
|
|
local __out_varname="$1" __source_value="$2"
|
|
__source_value=${__source_value//[^a-zA-Z0-9_-]/}
|
|
__source_value=${__source_value//-/_}
|
|
eval "$__out_varname=\"\$__source_value\""
|
|
}
|
|
|
|
_collect_list() {
|
|
local __out_varname="$1" __section="$2" __option="$3" __accum=""
|
|
__collect_list_cb() { __accum="${__accum}${__accum:+ }$1"; }
|
|
config_list_foreach "$__section" "$__option" __collect_list_cb
|
|
[ -z "$__accum" ] && config_get __accum "$__section" "$__option"
|
|
eval "$__out_varname=\"\$__accum\""
|
|
}
|
|
|
|
_curl_proxy_args() {
|
|
[ -n "$CURL_PROXY" ] || return
|
|
printf -- "--proxy %s " "$CURL_PROXY"
|
|
[ -n "$CURL_PROXY_USER" ] && printf -- "--proxy-user %s:%s " "$CURL_PROXY_USER" "$CURL_PROXY_PASS"
|
|
}
|
|
|
|
_fetch_url() {
|
|
local id="$1" url="$2"
|
|
local url_hash=$(echo "$url" | md5sum | cut -c1-8)
|
|
local cache_raw="$CACHE_DIR/${id}_$url_hash.raw"
|
|
local etag_file="$CACHE_DIR/${id}_$url_hash.etag"
|
|
local header_tmp="$CACHE_DIR/h_${id}_$url_hash"
|
|
local body_tmp="$CACHE_DIR/dl_${id}_${url_hash}.raw"
|
|
local etag=$(cat "$etag_file" 2>/dev/null)
|
|
|
|
curl -4 -sSfL --connect-timeout 15 --retry-connrefused --retry-delay 5 $(_curl_proxy_args) ${etag:+-H "If-None-Match: \"$etag\""} -D "$header_tmp" "$url" > "$body_tmp"
|
|
local curl_status=$?
|
|
|
|
if grep -qE '^HTTP/[0-9.]+ +304' "$header_tmp" 2>/dev/null; then
|
|
_log "$id: 304 not modified" "info"
|
|
rm -f "$body_tmp" "$header_tmp"
|
|
[ -f "$cache_raw" ] && { cat "$cache_raw"; return 0; }
|
|
return 1
|
|
elif [ "$curl_status" -eq 0 ] && [ -s "$body_tmp" ]; then
|
|
_log "$id: 200 ok" "info"
|
|
grep -i "^etag:" "$header_tmp" | awk -F': ' '{print $2}' | sed 's/W\///; s/["\r\n ]//g' > "$etag_file"
|
|
cp "$body_tmp" "$cache_raw"
|
|
cat "$body_tmp"
|
|
rm -f "$body_tmp" "$header_tmp"
|
|
return 0
|
|
else
|
|
_log "$id: download failed ($curl_status), using local cache" "warn"
|
|
rm -f "$body_tmp" "$header_tmp"
|
|
[ -f "$cache_raw" ] && { cat "$cache_raw"; return 0; }
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
_cfg_get_default() {
|
|
local __out_varname="$1" __option="$2" __default="$3" __value
|
|
__value=$(uci -q get xray-manager."$MAIN_SECTION"."$__option")
|
|
[ -z "$__value" ] && __value="$__default"
|
|
eval "$__out_varname"="${__value:-$__default}"
|
|
}
|
|
|
|
_init_vars() {
|
|
_log "config: loading configuration" "debug"
|
|
config_load xray-manager
|
|
MAIN_SECTION="main"
|
|
|
|
_cfg_get_default TABLE "table_name"
|
|
_cfg_get_default TPROXY_PORT "tproxy_port"
|
|
_cfg_get_default TPROXY_MARK "tproxy_mark"
|
|
_cfg_get_default CLIENT_MARK "client_mark"
|
|
_cfg_get_default RT_TABLE "rt_table"
|
|
_cfg_get_default TIMEOUT "timeout"
|
|
_cfg_get_default EXCLUDE_MARK "exclude_mark" "0x1"
|
|
_cfg_get_default PRIO_EXC "prio_exc" "-200"
|
|
_cfg_get_default PRIO_PROXY "prio_proxy" "-150"
|
|
_cfg_get_default PRIO_OUTPUT "prio_output" "-100"
|
|
_cfg_get_default IPNET_DIR "ipnet_dir" '/tmp/.xray-manager/ipnet'
|
|
_cfg_get_default DNSMASQ_DIR "dnsmasq_dir" '/tmp/.xray-manager/dnsmasq.d'
|
|
_cfg_get_default CACHE_DIR "cache_dir" '/tmp/.xray-manager/cache'
|
|
_cfg_get_default ACTIVE_LIST "active_list" '/tmp/.xray-manager/active_files'
|
|
_cfg_get_default DOMSTAGE_DIR "domstage_dir" "$CACHE_DIR/domstage"
|
|
_cfg_get_default CTX_DIR "ctx_dir" "$CACHE_DIR/ctx"
|
|
_cfg_get_default CURL_PROXY "curl_proxy"
|
|
_cfg_get_default CURL_PROXY_USER "curl_proxy_user"
|
|
_cfg_get_default CURL_PROXY_PASS "curl_proxy_pass"
|
|
|
|
local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK RT_TABLE TIMEOUT"
|
|
for var in $required_vars; do
|
|
eval "val=\$$var"
|
|
if [ -z "$val" ]; then
|
|
_log "config: variable '$var' is missing" "crit"
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
if [ "$((EXCLUDE_MARK))" -eq "$((TPROXY_MARK))" ] 2>/dev/null; then
|
|
_log "config: exclude_mark ($EXCLUDE_MARK) must differ from tproxy_mark ($TPROXY_MARK)" "crit"
|
|
return 1
|
|
fi
|
|
|
|
_log "config: loaded table=$TABLE, port=$TPROXY_PORT, mark=$TPROXY_MARK" "debug"
|
|
mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR" "$DOMSTAGE_DIR" "$CTX_DIR" "${ACTIVE_LIST%/*}"
|
|
|
|
if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
|
|
: > "$DEBUG_LOG" 2>/dev/null
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
_get_src_names() {
|
|
local section="$1" name
|
|
config_get name "$section" name
|
|
if [ -n "$name" ]; then
|
|
_sanitize_name name "$name"
|
|
case " $existing_src_names " in
|
|
*" $name "*)
|
|
_log "config: duplicate xray-src name '$name' - source jump chains require unique names!" "crit"
|
|
has_errors=1
|
|
;;
|
|
esac
|
|
existing_src_names="${existing_src_names}${existing_src_names:+ }$name"
|
|
fi
|
|
}
|
|
|
|
_get_dst_names() {
|
|
local section="$1" name
|
|
config_get name "$section" name
|
|
if [ -n "$name" ]; then
|
|
_sanitize_name name "$name"
|
|
case " $existing_dst_names " in
|
|
*" $name "*)
|
|
_log "config: duplicate xray-dst name '$name' - names must be unique within xray-dst!" "crit"
|
|
has_errors=1
|
|
;;
|
|
esac
|
|
existing_dst_names="${existing_dst_names}${existing_dst_names:+ }$name"
|
|
fi
|
|
}
|
|
|
|
_get_out_names() {
|
|
local section="$1" name
|
|
config_get name "$section" name
|
|
if [ -n "$name" ]; then
|
|
_sanitize_name name "$name"
|
|
case " $existing_out_names " in
|
|
*" $name "*)
|
|
_log "config: duplicate xray-out name '$name' - names must be unique within xray-out!" "crit"
|
|
has_errors=1
|
|
;;
|
|
esac
|
|
existing_out_names="${existing_out_names}${existing_out_names:+ }$name"
|
|
fi
|
|
}
|
|
|
|
_validate_list_section() {
|
|
local section="$1" name type
|
|
config_get name "$section" name
|
|
config_get type "$section" TYPE
|
|
|
|
if [ -z "$name" ]; then
|
|
_log "config: section [$section] is missing 'name' option" "crit"
|
|
has_errors=1
|
|
return
|
|
fi
|
|
|
|
local config_option
|
|
for config_option in $(uci show xray-manager."$section" | cut -d'.' -f3 | cut -d'=' -f1 | sort -u); do
|
|
case "$config_option" in
|
|
.*) continue ;;
|
|
esac
|
|
if ! echo "$allowed_opts" | grep -qw "$config_option"; then
|
|
_log "config: section [$section] ($name) has unknown option: '$config_option'" "err"
|
|
has_errors=1
|
|
fi
|
|
done
|
|
|
|
case "$type" in
|
|
xray-dst|xray-src)
|
|
local parent_list
|
|
_collect_list parent_list "$section" parent
|
|
if [ -n "$parent_list" ]; then
|
|
local parent parent_clean
|
|
for parent in $parent_list; do
|
|
_sanitize_name parent_clean "$parent"
|
|
if ! echo "$existing_src_names" | grep -qw "$parent_clean"; then
|
|
_log "config: section [$section] ($name) contains parent '$parent' which does not exist as a valid xray-src!" "crit"
|
|
has_errors=1
|
|
fi
|
|
done
|
|
fi
|
|
;;
|
|
esac
|
|
}
|
|
|
|
_validate_config() {
|
|
_log "config: validating uci syntax and parents" "debug"
|
|
|
|
if [ -f "/etc/config/xray-manager" ]; then
|
|
sed -i 's/^ \+/ /g' /etc/config/xray-manager
|
|
fi
|
|
|
|
local dns_confdir
|
|
dns_confdir=$(uci -q get dhcp.@dnsmasq[0].confdir)
|
|
if [ -z "$dns_confdir" ] || ! echo "$dns_confdir" | grep -q "$DNSMASQ_DIR"; then
|
|
_log "config: $DNSMASQ_DIR is not set in dnsmasq" "warn"
|
|
fi
|
|
|
|
local allowed_opts="name exclude parent ip domain url_ip url_domain"
|
|
local has_errors=0
|
|
local existing_src_names=""
|
|
local existing_dst_names=""
|
|
local existing_out_names=""
|
|
config_foreach _get_src_names "xray-src"
|
|
config_foreach _get_dst_names "xray-dst"
|
|
config_foreach _get_out_names "xray-out"
|
|
|
|
config_foreach _validate_list_section "xray-src"
|
|
config_foreach _validate_list_section "xray-dst"
|
|
config_foreach _validate_list_section "xray-out"
|
|
|
|
if [ "$has_errors" = "1" ]; then
|
|
_log "config: validation failed! core configuration errors detected. aborting startup." "crit"
|
|
exit 1
|
|
fi
|
|
|
|
_log "config: validation complete" "info"
|
|
}
|
|
|
|
_nft_init() {
|
|
local mode="$1"
|
|
|
|
if ! nft list table ip "$TABLE" >/dev/null 2>&1; then
|
|
mode="full"
|
|
fi
|
|
|
|
if [ "$mode" = "full" ]; then
|
|
_log "$TABLE: full reset of nft table" "info"
|
|
nft delete table ip "$TABLE" 2>/dev/null
|
|
nft add table ip "$TABLE"
|
|
nft add chain ip "$TABLE" prerouting_exc { type filter hook prerouting priority $PRIO_EXC\; policy accept\; }
|
|
nft add chain ip "$TABLE" prerouting_proxy { type filter hook prerouting priority $PRIO_PROXY\; policy accept\; }
|
|
nft add chain ip "$TABLE" output { type route hook output priority $PRIO_OUTPUT\; policy accept\; }
|
|
nft add rule ip "$TABLE" prerouting_exc fib daddr type local accept
|
|
nft add rule ip "$TABLE" prerouting_proxy fib daddr type local accept
|
|
nft add rule ip "$TABLE" prerouting_proxy meta mark $EXCLUDE_MARK return
|
|
nft add rule ip "$TABLE" prerouting_proxy meta mark $TPROXY_MARK meta l4proto { tcp, udp } tproxy to 127.0.0.1:"$TPROXY_PORT" accept
|
|
rm -f "$CTX_DIR"/*.sig "$CTX_DIR/active.prev" 2>/dev/null
|
|
else
|
|
_log "$TABLE: keeping existing nft table" "debug"
|
|
fi
|
|
|
|
echo "$mode"
|
|
}
|
|
|
|
_nft_prepare_data() {
|
|
local id="$1" file="$2" type="$3"
|
|
local marker="$CACHE_DIR/${id}.nftok"
|
|
local file_hash=$(_file_md5 "$file")
|
|
local prev_hash=$(cat "$marker" 2>/dev/null)
|
|
local set_exists=1
|
|
nft list set ip "$TABLE" "$id" >/dev/null 2>&1 || set_exists=0
|
|
|
|
if [ "$set_exists" = "1" ] && [ -n "$file_hash" ] && [ "$file_hash" = "$prev_hash" ]; then
|
|
_log "$id: nft set unchanged, skipping flush" "debug"
|
|
return
|
|
fi
|
|
|
|
local set_params="type ipv4_addr; flags interval; auto-merge;"
|
|
case "$type" in
|
|
*dom) set_params="type ipv4_addr; flags interval,timeout; timeout $TIMEOUT; auto-merge;" ;;
|
|
esac
|
|
|
|
nft add set ip "$TABLE" "$id" { $set_params } 2>/dev/null
|
|
nft flush set ip "$TABLE" "$id"
|
|
|
|
case "$type" in
|
|
*ip*)
|
|
if [ -s "$file" ]; then
|
|
{
|
|
printf "add element ip %s %s { " "$TABLE" "$id"
|
|
awk '
|
|
/^[0-9]/ {
|
|
addr = ($1 ~ /\// ? $1 : $1"/32");
|
|
printf "%s%s", (count++ ? ", " : ""), addr
|
|
}' "$file"
|
|
printf " }\n"
|
|
} | nft -f -
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
echo "$file_hash" > "$marker"
|
|
_log "$id: nft set (re)populated" "info"
|
|
}
|
|
|
|
_item_file_exists() {
|
|
local id="$1"
|
|
[ -f "$IPNET_DIR/$id.lst" ] || [ -f "$DOMSTAGE_DIR/$id.lst" ]
|
|
}
|
|
|
|
_existing_ids() {
|
|
local name="$1" direction="$2"; shift 2
|
|
local suffix id
|
|
for suffix in "$@"; do
|
|
id="${name}_${suffix}_${direction}"
|
|
_item_file_exists "$id" && echo "$id"
|
|
done
|
|
}
|
|
|
|
_process_item() {
|
|
local id="$1" value="$2" type="$3"
|
|
local fullpath hash_file changed=0
|
|
|
|
case "$type" in
|
|
*dom) fullpath="$DOMSTAGE_DIR/$id.lst" ;;
|
|
*) fullpath="$IPNET_DIR/$id.lst" ;;
|
|
esac
|
|
hash_file="$CACHE_DIR/$id.hash"
|
|
|
|
echo "$fullpath" >> "$ACTIVE_LIST"
|
|
echo "$hash_file" >> "$ACTIVE_LIST"
|
|
|
|
local new_hash=$(_get_md5 "$value")
|
|
local old_hash=$(cat "$hash_file" 2>/dev/null)
|
|
|
|
local status="stable"
|
|
if [ "$new_hash" != "$old_hash" ]; then
|
|
status="changed"
|
|
if [ "$SKIP_URL" = "1" ] && _is_url_type "$type"; then
|
|
NEED_UPDATE=1
|
|
fi
|
|
fi
|
|
|
|
_log "$id status: $status" "debug"
|
|
|
|
if [ "$SKIP_URL" = "1" ] && _is_url_type "$type"; then
|
|
if [ ! -f "$fullpath" ]; then
|
|
_log "$id: data file missing (reload mode), skipping" "warn"
|
|
return 1
|
|
fi
|
|
_log "$id: using local file (reload mode)" "debug"
|
|
_nft_prepare_data "$id" "$fullpath" "$type"
|
|
return 1
|
|
fi
|
|
|
|
if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ] || [ "$SKIP_URL" = "0" ]; then
|
|
case "$type" in
|
|
ip)
|
|
echo "$value" | tr ' ' '\n' | sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' -e '/\//! s|$|/32|' | sort -u > "$fullpath.tmp"
|
|
;;
|
|
dom)
|
|
echo "$value" | tr ' ' '\n' | awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { gsub(/\r/, ""); print tolower($1) }' | sort -u > "$fullpath.tmp"
|
|
;;
|
|
uip|udom)
|
|
_log "$id: fetching remote list" "info"
|
|
local tmp_all="$CACHE_DIR/dl_$id"
|
|
: > "$tmp_all"
|
|
local download_ok=0
|
|
local part_files="" pids="" n=0 part pid
|
|
|
|
for url in $value; do
|
|
n=$((n + 1))
|
|
part="$tmp_all.part${n}.$$"
|
|
part_files="${part_files}${part_files:+ }$part"
|
|
_log "$id: downloading $url" "debug"
|
|
_fetch_url "$id" "$url" > "$part" &
|
|
pids="${pids}${pids:+ }$!"
|
|
done
|
|
|
|
for pid in $pids; do
|
|
wait "$pid" && download_ok=1
|
|
done
|
|
|
|
cat $part_files > "$tmp_all" 2>/dev/null
|
|
rm -f $part_files
|
|
|
|
if [ "$download_ok" = "1" ] && [ -s "$tmp_all" ]; then
|
|
if [ "$type" = "uip" ]; then
|
|
sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' "$tmp_all" | awk '{ print ($1 ~ /\// ? $1 : $1"/32") }' | sort -u > "$fullpath.tmp"
|
|
else
|
|
tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u > "$fullpath.tmp"
|
|
fi
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
if [ -s "$fullpath.tmp" ] && ! cmp -s "$fullpath.tmp" "$fullpath"; then
|
|
mv "$fullpath.tmp" "$fullpath"
|
|
changed=1
|
|
_log "$id: list updated" "info"
|
|
else
|
|
rm -f "$fullpath.tmp"
|
|
fi
|
|
echo "$new_hash" > "$hash_file"
|
|
fi
|
|
|
|
_nft_prepare_data "$id" "$fullpath" "$type"
|
|
|
|
if [ "$changed" = "1" ]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
_process_prepare() {
|
|
local section="$1" name="$2" direction="$3"
|
|
local map_entry list_type option_name affects_dns value
|
|
|
|
for map_entry in $LIST_TYPE_MAP; do
|
|
list_type="${map_entry%%:*}"
|
|
option_name="${map_entry#*:}"; option_name="${option_name%%:*}"
|
|
affects_dns="${map_entry##*:}"
|
|
|
|
_collect_list value "$section" "$option_name"
|
|
if [ -n "$value" ]; then
|
|
if _process_item "${name}_${list_type}_${direction}" "$value" "$list_type"; then
|
|
[ "$affects_dns" = "1" ] && DNS_CHANGES=1
|
|
fi
|
|
fi
|
|
done
|
|
}
|
|
|
|
_process_section() {
|
|
local section="$1" mode="$2" name direction type
|
|
|
|
config_get name "$section" name
|
|
_sanitize_name name "$name"
|
|
[ -z "$name" ] && return
|
|
|
|
config_get type "$section" TYPE
|
|
case "$type" in
|
|
xray-src) direction="src" ;;
|
|
xray-out) direction="out" ;;
|
|
*) direction="dst" ;;
|
|
esac
|
|
|
|
case "$mode" in
|
|
prepare)
|
|
_process_prepare "$section" "$name" "$direction"
|
|
;;
|
|
apply_out)
|
|
[ "$direction" = "out" ] || return 0
|
|
local exclude_flag; config_get exclude_flag "$section" exclude "0"
|
|
[ "$exclude_flag" = "1" ] && return 0
|
|
local suffix item
|
|
for suffix in $ALL_LIST_SUFFIXES; do
|
|
item="${name}_${suffix}_${direction}"
|
|
_item_file_exists "$item" || continue
|
|
_log "nft: output rule for $item" "debug"
|
|
nft add rule ip "$TABLE" output ip daddr @"$item" meta mark set "$TPROXY_MARK" accept
|
|
done
|
|
;;
|
|
apply_out_exc)
|
|
[ "$direction" = "out" ] || return 0
|
|
local exclude_flag; config_get exclude_flag "$section" exclude "0"
|
|
[ "$exclude_flag" = "1" ] || return 0
|
|
local suffix item
|
|
for suffix in $ALL_LIST_SUFFIXES; do
|
|
item="${name}_${suffix}_${direction}"
|
|
_item_file_exists "$item" || continue
|
|
_log "nft: output exclusion for $item" "debug"
|
|
nft add rule ip "$TABLE" output ip daddr @"$item" return
|
|
done
|
|
;;
|
|
*)
|
|
_log "config: unknown process mode: $mode" "err"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
_in_scope() {
|
|
local context="$1" parent_list="$2"
|
|
if [ -z "$context" ]; then
|
|
[ -z "$parent_list" ]
|
|
return
|
|
fi
|
|
local parent parent_clean
|
|
for parent in $parent_list; do
|
|
_sanitize_name parent_clean "$parent"
|
|
[ "$parent_clean" = "$context" ] && return 0
|
|
done
|
|
return 1
|
|
}
|
|
|
|
_nft_scope_src() {
|
|
local section="$1" context="$2" want_exclude="$3"
|
|
local name exclude_flag parent_list
|
|
|
|
config_get name "$section" name
|
|
_sanitize_name name "$name"
|
|
[ -z "$name" ] && return
|
|
|
|
config_get exclude_flag "$section" exclude "0"
|
|
[ "$exclude_flag" != "1" ] && exclude_flag="0"
|
|
[ "$exclude_flag" = "$want_exclude" ] || return
|
|
|
|
_collect_list parent_list "$section" parent
|
|
_in_scope "$context" "$parent_list" || return
|
|
|
|
local id found=0
|
|
if [ "$exclude_flag" = "1" ]; then
|
|
for id in $(_existing_ids "$name" "src" $SRC_LIST_SUFFIXES); do
|
|
found=1
|
|
if [ -z "$context" ]; then
|
|
_log "nft: global source exclusion for $name ($id)" "debug"
|
|
nft add rule ip "$TABLE" prerouting_exc ip saddr @"$id" meta mark set $EXCLUDE_MARK accept
|
|
else
|
|
_log "nft: source exclusion for $name ($id) inside '$context'" "debug"
|
|
nft add rule ip "$TABLE" "$context" ip saddr @"$id" meta mark set $EXCLUDE_MARK return
|
|
fi
|
|
done
|
|
[ "$found" = "0" ] && _log "nft: excluded source '$name' has no ip/url_ip data, exclusion has no effect" "warn"
|
|
else
|
|
nft add chain ip "$TABLE" "$name" 2>/dev/null
|
|
local chain
|
|
[ -z "$context" ] && chain="prerouting_proxy" || chain="$context"
|
|
for id in $(_existing_ids "$name" "src" $SRC_LIST_SUFFIXES); do
|
|
found=1
|
|
_log "nft: dispatching $name ($id) into its own chain" "debug"
|
|
nft add rule ip "$TABLE" "$chain" ip saddr @"$id" jump "$name"
|
|
done
|
|
[ "$found" = "0" ] && _log "nft: source '$name' has no ip/url_ip data, its chain will never be entered" "warn"
|
|
fi
|
|
}
|
|
|
|
_nft_scope_dst() {
|
|
local section="$1" context="$2" want_exclude="$3"
|
|
local name exclude_flag parent_list
|
|
|
|
config_get name "$section" name
|
|
_sanitize_name name "$name"
|
|
[ -z "$name" ] && return
|
|
|
|
config_get exclude_flag "$section" exclude "0"
|
|
[ "$exclude_flag" != "1" ] && exclude_flag="0"
|
|
[ "$exclude_flag" = "$want_exclude" ] || return
|
|
|
|
_collect_list parent_list "$section" parent
|
|
_in_scope "$context" "$parent_list" || return
|
|
|
|
local id
|
|
for id in $(_existing_ids "$name" "dst" $ALL_LIST_SUFFIXES); do
|
|
if [ "$exclude_flag" = "1" ]; then
|
|
if [ -z "$context" ]; then
|
|
_log "nft: global destination exclusion for $name ($id)" "debug"
|
|
nft add rule ip "$TABLE" prerouting_exc ip daddr @"$id" meta mark set $EXCLUDE_MARK accept
|
|
else
|
|
_log "nft: destination exclusion for $name ($id) inside '$context'" "debug"
|
|
nft add rule ip "$TABLE" "$context" ip daddr @"$id" meta mark set $EXCLUDE_MARK return
|
|
fi
|
|
else
|
|
local chain
|
|
[ -z "$context" ] && chain="prerouting_proxy" || chain="$context"
|
|
_log "nft: proxy rule for $name ($id) inside '${context:-<global>}'" "debug"
|
|
nft add rule ip "$TABLE" "$chain" ip daddr @"$id" meta l4proto { tcp, udp } \
|
|
tproxy to 127.0.0.1:"$TPROXY_PORT" ct mark set "$CLIENT_MARK" \
|
|
meta mark set "$TPROXY_MARK" accept
|
|
fi
|
|
done
|
|
}
|
|
|
|
_ctx_sig_line_src() {
|
|
local section="$1" context="$2" name exclude_flag parent_list
|
|
config_get name "$section" name; _sanitize_name name "$name"; [ -z "$name" ] && return
|
|
config_get exclude_flag "$section" exclude "0"; [ "$exclude_flag" != "1" ] && exclude_flag="0"
|
|
_collect_list parent_list "$section" parent
|
|
_in_scope "$context" "$parent_list" || return
|
|
local suffix bits=""
|
|
for suffix in $SRC_LIST_SUFFIXES; do
|
|
_item_file_exists "${name}_${suffix}_src" && bits="${bits}1" || bits="${bits}0"
|
|
done
|
|
echo "src:$name:$exclude_flag:$bits"
|
|
}
|
|
_ctx_sig_line_dst() {
|
|
local section="$1" context="$2" name exclude_flag parent_list
|
|
config_get name "$section" name; _sanitize_name name "$name"; [ -z "$name" ] && return
|
|
config_get exclude_flag "$section" exclude "0"; [ "$exclude_flag" != "1" ] && exclude_flag="0"
|
|
_collect_list parent_list "$section" parent
|
|
_in_scope "$context" "$parent_list" || return
|
|
local suffix bits=""
|
|
for suffix in $ALL_LIST_SUFFIXES; do
|
|
_item_file_exists "${name}_${suffix}_dst" && bits="${bits}1" || bits="${bits}0"
|
|
done
|
|
echo "dst:$name:$exclude_flag:$bits"
|
|
}
|
|
_ctx_signature() {
|
|
local context="$1"
|
|
{ config_foreach _ctx_sig_line_src "xray-src" "$context"
|
|
config_foreach _ctx_sig_line_dst "xray-dst" "$context"; } | sort | md5sum | cut -d' ' -f1
|
|
}
|
|
_echo_child_src() {
|
|
local section="$1" context="$2" name exclude_flag parent_list
|
|
config_get name "$section" name; _sanitize_name name "$name"; [ -z "$name" ] && return
|
|
config_get exclude_flag "$section" exclude "0"; [ "$exclude_flag" = "1" ] && return
|
|
_collect_list parent_list "$section" parent
|
|
_in_scope "$context" "$parent_list" || return
|
|
echo "$name"
|
|
}
|
|
_child_srcs() { config_foreach _echo_child_src "xray-src" "$1"; }
|
|
|
|
_nft_build_scope() {
|
|
local context="$1"
|
|
local context_key="${context:-$GLOBAL_CTXKEY}"
|
|
|
|
case " $VISITED_CTX " in
|
|
*" $context_key "*)
|
|
_log "nft: cyclic parent reference at '$context_key', skipping to avoid infinite recursion" "crit"
|
|
return
|
|
;;
|
|
esac
|
|
VISITED_CTX="${VISITED_CTX}${VISITED_CTX:+ }$context_key"
|
|
echo "$context_key" >> "$CTX_ACTIVE_LIST"
|
|
|
|
local sigfile="$CTX_DIR/${context_key}.sig"
|
|
local newsig=$(_ctx_signature "$context")
|
|
local oldsig=$(cat "$sigfile" 2>/dev/null)
|
|
local chain_exists=1
|
|
[ -z "$context" ] || { nft list chain ip "$TABLE" "$context" >/dev/null 2>&1 || chain_exists=0; }
|
|
|
|
if [ "$FULL_REBUILD" = "1" ] || [ "$newsig" != "$oldsig" ] || [ "$chain_exists" = "0" ]; then
|
|
_log "nft: (re)building scope '${context:-<global>}' - structure changed" "info"
|
|
if [ -z "$context" ]; then
|
|
nft flush chain ip "$TABLE" prerouting_exc
|
|
nft flush chain ip "$TABLE" prerouting_proxy
|
|
nft add rule ip "$TABLE" prerouting_exc fib daddr type local accept
|
|
nft add rule ip "$TABLE" prerouting_proxy fib daddr type local accept
|
|
nft add rule ip "$TABLE" prerouting_proxy meta mark $EXCLUDE_MARK return
|
|
nft add rule ip "$TABLE" prerouting_proxy meta mark $TPROXY_MARK meta l4proto { tcp, udp } tproxy to 127.0.0.1:"$TPROXY_PORT" accept
|
|
else
|
|
nft add chain ip "$TABLE" "$context" 2>/dev/null
|
|
nft flush chain ip "$TABLE" "$context"
|
|
fi
|
|
|
|
config_foreach _nft_scope_src "xray-src" "$context" "1"
|
|
config_foreach _nft_scope_src "xray-src" "$context" "0"
|
|
config_foreach _nft_scope_dst "xray-dst" "$context" "1"
|
|
config_foreach _nft_scope_dst "xray-dst" "$context" "0"
|
|
echo "$newsig" > "$sigfile"
|
|
else
|
|
_log "nft: scope '${context:-<global>}' unchanged, skipping rebuild" "debug"
|
|
fi
|
|
|
|
local child
|
|
for child in $(_child_srcs "$context"); do
|
|
_nft_build_scope "$child"
|
|
done
|
|
}
|
|
|
|
_cleanup_orphan_ctx() {
|
|
local prev="$CTX_DIR/active.prev"
|
|
[ -f "$prev" ] || { cp "$CTX_ACTIVE_LIST" "$prev"; return; }
|
|
|
|
local old_context
|
|
while read -r old_context; do
|
|
[ -z "$old_context" ] && continue
|
|
if ! grep -Fxq "$old_context" "$CTX_ACTIVE_LIST"; then
|
|
[ "$old_context" = "$GLOBAL_CTXKEY" ] && continue
|
|
_log "nft: removing orphaned source chain '$old_context'" "info"
|
|
nft delete chain ip "$TABLE" "$old_context" 2>/dev/null
|
|
rm -f "$CTX_DIR/${old_context}.sig"
|
|
fi
|
|
done < "$prev"
|
|
|
|
cp "$CTX_ACTIVE_LIST" "$prev"
|
|
}
|
|
|
|
_merge_dnsmasq_sets() {
|
|
local out="$DNSMASQ_DIR/nftsets.lst" tmp="$DNSMASQ_DIR/.nftsets.lst.tmp"
|
|
: > "$tmp"
|
|
|
|
local file id
|
|
for file in "$DOMSTAGE_DIR"/*.lst; do
|
|
[ -e "$file" ] || continue
|
|
id="${file##*/}"; id="${id%.lst}"
|
|
awk -v id="$id" '{ print $0"\t"id }' "$file"
|
|
done | sort -t "$(printf '\t')" -k1,1 | awk -F'\t' -v t="$TABLE" '
|
|
function flush_domain() {
|
|
if (dom != "") printf "nftset=/%s/%s\n", dom, targets
|
|
}
|
|
{
|
|
if ($1 != dom) { flush_domain(); dom = $1; targets = "" }
|
|
targets = targets (targets != "" ? "," : "") "4#ip#" t "#" $2
|
|
}
|
|
END { flush_domain() }
|
|
' > "$tmp"
|
|
|
|
if ! cmp -s "$tmp" "$out" 2>/dev/null; then
|
|
mv "$tmp" "$out"
|
|
DNS_CHANGES=1
|
|
_log "dnsmasq: merged nftset directives changed ($out)" "info"
|
|
else
|
|
rm -f "$tmp"
|
|
_log "dnsmasq: merged nftset directives unchanged" "debug"
|
|
fi
|
|
}
|
|
|
|
_cleanup_orphan_files() {
|
|
local removed_ids_file="$1" file filename id
|
|
for file in "$IPNET_DIR"/* "$DOMSTAGE_DIR"/*; do
|
|
[ -e "$file" ] || continue
|
|
if ! grep -Fxq "$file" "$ACTIVE_LIST"; then
|
|
filename="${file##*/}"
|
|
id="${filename%.*}"
|
|
_log "orphan: removing $filename" "info"
|
|
case "$file" in "$DOMSTAGE_DIR"/*) DNS_CHANGES=1 ;; esac
|
|
echo "$id" >> "$removed_ids_file"
|
|
rm -f "$file" "$CACHE_DIR/${id}.nftok" "$CACHE_DIR/${id}.hash"
|
|
fi
|
|
done
|
|
}
|
|
|
|
_render_out_rules() {
|
|
local section="$1" want_file="$2" name direction type exclude_flag
|
|
config_get name "$section" name; _sanitize_name name "$name"; [ -z "$name" ] && return
|
|
config_get type "$section" TYPE; [ "$type" = "xray-out" ] || return
|
|
config_get exclude_flag "$section" exclude "0"
|
|
local suffix item
|
|
for suffix in $ALL_LIST_SUFFIXES; do
|
|
item="${name}_${suffix}_out"
|
|
_item_file_exists "$item" || continue
|
|
if [ "$exclude_flag" = "1" ]; then
|
|
echo "exc $item" >> "$want_file"
|
|
else
|
|
echo "acc $item" >> "$want_file"
|
|
fi
|
|
done
|
|
}
|
|
|
|
_run() {
|
|
_init_vars || return 1
|
|
_validate_config
|
|
DNS_CHANGES=0; NEED_UPDATE=0; VISITED_CTX=""
|
|
: > "$ACTIVE_LIST"
|
|
CTX_ACTIVE_LIST="$CACHE_DIR/ctx_active.$$"
|
|
: > "$CTX_ACTIVE_LIST"
|
|
|
|
local requested_mode="$1"
|
|
local actual_mode=$(_nft_init "$requested_mode")
|
|
[ "$actual_mode" = "full" ] && FULL_REBUILD=1 || FULL_REBUILD=0
|
|
|
|
local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
|
|
ip route show table $RT_TABLE 2>/dev/null | grep -q "local default" || ip route add local default dev lo table $RT_TABLE
|
|
ip rule show | grep -q "fwmark $mark_hex lookup $RT_TABLE" || ip rule add fwmark "$TPROXY_MARK" table $RT_TABLE
|
|
|
|
config_foreach _process_section "xray-src" "prepare"
|
|
config_foreach _process_section "xray-dst" "prepare"
|
|
config_foreach _process_section "xray-out" "prepare"
|
|
|
|
local removed_ids_file="$CACHE_DIR/removed_ids.$$"
|
|
: > "$removed_ids_file"
|
|
_cleanup_orphan_files "$removed_ids_file"
|
|
|
|
_merge_dnsmasq_sets
|
|
|
|
_nft_build_scope ""
|
|
_cleanup_orphan_ctx
|
|
rm -f "$CTX_ACTIVE_LIST"
|
|
|
|
if [ -s "$removed_ids_file" ]; then
|
|
while read -r removed_id; do
|
|
[ -z "$removed_id" ] && continue
|
|
nft delete set ip "$TABLE" "$removed_id" 2>/dev/null
|
|
done < "$removed_ids_file"
|
|
fi
|
|
rm -f "$removed_ids_file"
|
|
|
|
if [ "$FULL_REBUILD" = "1" ]; then
|
|
config_foreach _process_section "xray-out" "apply_out_exc"
|
|
config_foreach _process_section "xray-out" "apply_out"
|
|
else
|
|
local want_file="$CACHE_DIR/out_rules.want" have_file="$CACHE_DIR/out_rules.have"
|
|
: > "$want_file"
|
|
config_foreach _render_out_rules "xray-out" "$want_file"
|
|
sort -o "$want_file" "$want_file"
|
|
if ! cmp -s "$want_file" "$have_file" 2>/dev/null; then
|
|
_log "nft: xray-out rules changed, rebuilding output chain" "info"
|
|
nft flush chain ip "$TABLE" output
|
|
config_foreach _process_section "xray-out" "apply_out_exc"
|
|
config_foreach _process_section "xray-out" "apply_out"
|
|
cp "$want_file" "$have_file"
|
|
else
|
|
_log "nft: xray-out rules unchanged" "debug"
|
|
fi
|
|
fi
|
|
|
|
[ "$DNS_CHANGES" = "1" ] && { _log "dnsmasq: restarting service" "info"; /etc/init.d/dnsmasq restart; }
|
|
|
|
if [ "$SKIP_URL" = "1" ] && [ "$NEED_UPDATE" = "1" ]; then
|
|
_log "main: outdated lists detected, run 'update' to refresh" "warn"
|
|
fi
|
|
|
|
_log "main: execution finished (mode=$actual_mode)" "info"
|
|
}
|
|
|
|
_stop() {
|
|
_log "main: stopping service" "info"
|
|
_init_vars
|
|
nft delete table ip "$TABLE" 2>/dev/null
|
|
ip rule del fwmark "$TPROXY_MARK" table $RT_TABLE 2>/dev/null
|
|
ip route del local default dev lo table $RT_TABLE 2>/dev/null
|
|
rm -f "$CTX_DIR"/*.sig "$CTX_DIR/active.prev" 2>/dev/null
|
|
/etc/init.d/dnsmasq restart
|
|
_log "main: service stopped" "info"
|
|
}
|
|
|
|
case "$1" in
|
|
start) export SKIP_URL=0; _run "full" ;;
|
|
stop) _stop ;;
|
|
restart) _stop; export SKIP_URL=0; _run "full" ;;
|
|
reload) export SKIP_URL=1; _run "incr" ;;
|
|
update) export SKIP_URL=0; _run "incr" ;;
|
|
*) echo "Usage: $0 {start|stop|restart|reload|update}"; exit 1 ;;
|
|
esac
|