276 lines
10 KiB
Bash
Executable File
276 lines
10 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
. /lib/functions.sh
|
|
|
|
_log() {
|
|
local msg="$1" level="${2:-info}" to_console="${3:-0}"
|
|
logger -t xray-manager -p "daemon.$level" "$msg"
|
|
[ "$to_console" = "1" ] && echo "[$level] $msg"
|
|
}
|
|
|
|
_get_md5() { echo "$1" | md5sum | cut -d' ' -f1; }
|
|
|
|
_init_vars() {
|
|
config_load xray-manager
|
|
|
|
local s="@xray-manager[0]"
|
|
TABLE=$(uci -q get xray-manager.$s.table_name)
|
|
TPROXY_PORT=$(uci -q get xray-manager.$s.tproxy_port)
|
|
TPROXY_MARK=$(uci -q get xray-manager.$s.tproxy_mark)
|
|
CLIENT_MARK=$(uci -q get xray-manager.$s.client_mark)
|
|
IPNET_DIR=$(uci -q get xray-manager.$s.ipnet_dir)
|
|
DNSMASQ_DIR=$(uci -q get xray-manager.$s.dnsmasq_dir)
|
|
CACHE_DIR=$(uci -q get xray-manager.$s.cache_dir)
|
|
ACTIVE_LIST=$(uci -q get xray-manager.$s.active_list)
|
|
ROUTE_LOCAL=$(uci -q get xray-manager.$s.route_local)
|
|
|
|
local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK IPNET_DIR DNSMASQ_DIR CACHE_DIR ACTIVE_LIST ROUTE_LOCAL"
|
|
|
|
for var in $required_vars; do
|
|
eval val=\$$var
|
|
if [ -z "$val" ]; then
|
|
_log "CRITICAL: Variable '$var' is not set in UCI config!" "err" "1"
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR" "${ACTIVE_LIST%/*}"
|
|
return 0
|
|
}
|
|
|
|
_check_marks() {
|
|
local m_dec=$(printf "%d" "$CLIENT_MARK" 2>/dev/null)
|
|
local m_hex=$(printf "%x" "$m_dec" 2>/dev/null)
|
|
local m_pattern="($m_dec|0x0*$m_hex)"
|
|
|
|
if nft list ruleset 2>/dev/null | sed "/table ip $TABLE/,/^}/d" | grep -iqE "mark.*$m_pattern"; then
|
|
_log "Mark 0x$m_hex is busy in another table!" "err" "1"
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
_check_dnsmasq() {
|
|
local current_dns_dir=$(uci -q get dhcp.@dnsmasq[0].confdir | awk '{print $1}')
|
|
|
|
if [ -z "$current_dns_dir" ]; then
|
|
_log "dnsmasq.confdir is empty. Setting to $DNSMASQ_DIR" "info" "1"
|
|
uci add_list dhcp.@dnsmasq[0].confdir="$DNSMASQ_DIR"
|
|
uci commit dhcp
|
|
DNS_CHANGES=1
|
|
elif [ "$current_dns_dir" != "$DNSMASQ_DIR" ]; then
|
|
_log "dnsmasq.confdir mismatch: $current_dns_dir" "err" "1"
|
|
_log "Expected $DNSMASQ_DIR. Check your DHCP config." "err" "1"
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
_load_config_full() {
|
|
_init_vars || return 1
|
|
_check_marks || return 1
|
|
_check_dnsmasq || return 1
|
|
return 0
|
|
}
|
|
|
|
_nft_init() {
|
|
[ -z "$TABLE" ] && return 1
|
|
nft add table ip "$TABLE" 2>/dev/null
|
|
|
|
nft add chain ip "$TABLE" prerouting { type filter hook prerouting priority mangle \; policy accept \; } 2>/dev/null
|
|
nft flush chain ip "$TABLE" prerouting
|
|
nft add rule ip "$TABLE" prerouting fib daddr type local accept
|
|
|
|
local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
|
|
|
|
ip route show table 110 | grep -q "local default" || ip route add local default dev lo table 110
|
|
ip rule show | grep -q "fwmark $mark_hex lookup 110" || ip rule add fwmark "$TPROXY_MARK" table 110
|
|
|
|
if [ "$ROUTE_LOCAL" = "1" ]; then
|
|
nft add chain ip "$TABLE" output { type route hook output priority mangle \; policy accept \; } 2>/dev/null
|
|
nft flush chain ip "$TABLE" output
|
|
nft add rule ip "$TABLE" output fib daddr type local accept
|
|
else
|
|
nft delete chain ip "$TABLE" output 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
_nft_batch_insert() {
|
|
local table="$1" sname="$2" file="$3"
|
|
{
|
|
printf "add element ip %s %s { " "$table" "$sname"
|
|
awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
|
|
{ val = ($1 ~ /\//) ? $1 : $1 "/32"
|
|
printf "%s%s", (count++ ? ", " : ""), val }' "$file"
|
|
echo " }"
|
|
} | nft -f -
|
|
}
|
|
|
|
_nft_apply_data() {
|
|
local sname="$1" file="$2" exc="$3" dir="$4" type="$5" changed="$6"
|
|
[ -z "$TABLE" ] && return 1
|
|
|
|
local nft_sname="s_$sname"
|
|
local flags="interval"
|
|
[ "$type" = "dom" ] || [ "$type" = "udom" ] && flags="interval,timeout"
|
|
|
|
nft add set ip "$TABLE" "$nft_sname" { type ipv4_addr \; flags $flags \; auto-merge \; } 2>/dev/null
|
|
|
|
if [ "$changed" = "1" ] && [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
|
|
_log "Syncing '$nft_sname' to NFT..."
|
|
nft flush set ip "$TABLE" "$nft_sname"
|
|
_nft_batch_insert "$TABLE" "$nft_sname" "$file"
|
|
fi
|
|
|
|
local has_out; nft list chain ip "$TABLE" output >/dev/null 2>&1 && has_out=1
|
|
|
|
if [ "$exc" = "1" ]; then
|
|
local sel="ip daddr"; [ "$dir" = "src" ] && sel="ip saddr"
|
|
nft insert rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
|
|
elif [ "$dir" = "src" ]; then
|
|
nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" ct mark set "$CLIENT_MARK" 2>/dev/null
|
|
else
|
|
for proto in tcp udp; do
|
|
nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" \
|
|
meta l4proto "$proto" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
|
[ "$has_out" = "1" ] && \
|
|
nft add rule ip "$TABLE" output ip daddr "@$nft_sname" \
|
|
meta l4proto "$proto" ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
|
done
|
|
fi
|
|
}
|
|
|
|
_process_item() {
|
|
local id="$1" val="$2" type="$3" dir="$4" exc="$5" fullpath hfile changed=0
|
|
|
|
[ "$type" = "dom" ] || [ "$type" = "udom" ] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
|
|
hfile="$CACHE_DIR/$id.hash"
|
|
|
|
echo "$fullpath" >> "$ACTIVE_LIST"
|
|
echo "$hfile" >> "$ACTIVE_LIST"
|
|
|
|
local new_hash=$(_get_md5 "$val")
|
|
local old_hash=$(cat "$hfile" 2>/dev/null)
|
|
|
|
if [ "$SKIP_URL" = "1" ] && { [ "$type" = "uip" ] || [ "$type" = "udom" ]; }; then
|
|
[ "$new_hash" != "$old_hash" ] && _log "$id: Config changed. Run update." "warn" "1"
|
|
[ -f "$fullpath" ] && _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "0"
|
|
return
|
|
fi
|
|
|
|
if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ]; then
|
|
changed=1
|
|
case "$type" in
|
|
ip) echo "$val" | tr ' ' '\n' | sed 's/\r//g; /^#/d; /^[[:space:]]*$/d; /\//! s|$|/32|' | sort -u > "$fullpath" ;;
|
|
dom)
|
|
echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '
|
|
/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
|
|
{ gsub(/\r/, ""); print "nftset=/" tolower($1) "/4#ip#" t "#" i }' | sort -u > "$fullpath"
|
|
DNS_CHANGES=1 ;;
|
|
uip|udom)
|
|
_log "Processing $id..." "info"
|
|
local tmp_all="$CACHE_DIR/dl_all_$id"; : > "$tmp_all"
|
|
local dl_ok=0
|
|
for url in $val; do
|
|
curl -sSfL --connect-timeout 10 "$url" >> "$tmp_all" && dl_ok=1
|
|
echo "" >> "$tmp_all"
|
|
done
|
|
if [ "$dl_ok" = "1" ] && [ -s "$tmp_all" ]; then
|
|
local out="$CACHE_DIR/out_$id"
|
|
if [ "$type" = "uip" ]; then
|
|
sed 's/\r//g; /^#/d; /^[[:space:]]*$/d' "$tmp_all" | \
|
|
awk '{print ($1 ~ /\//) ? $1 : $1"/32"}' | sort -u > "$out"
|
|
else
|
|
tr '[:upper:]' '[:lower:]' < "$tmp_all" | \
|
|
grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | \
|
|
sed "s|^|nftset=/|; s|\$|/4#ip#$TABLE#s_$id|" > "$out"
|
|
DNS_CHANGES=1
|
|
fi
|
|
mv "$out" "$fullpath"; changed=1
|
|
fi
|
|
rm -f "$tmp_all" ;;
|
|
esac
|
|
echo "$new_hash" > "$hfile"
|
|
fi
|
|
_nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "$changed"
|
|
}
|
|
|
|
_process_section() {
|
|
local s="$1" name dir exc ips doms uips udoms
|
|
config_get name "$s" name; config_get dir "$s" direction "dst"; config_get exc "$s" exclude "0"
|
|
[ -z "$name" ] && return
|
|
|
|
name=${name//[^a-zA-Z0-9_]/}
|
|
|
|
_append_list() { CURRENT_VAL="${CURRENT_VAL}${CURRENT_VAL:+ }$1"; }
|
|
CURRENT_VAL=""; config_list_foreach "$s" ip _append_list; ips="$CURRENT_VAL"
|
|
CURRENT_VAL=""; config_list_foreach "$s" domain _append_list; doms="$CURRENT_VAL"
|
|
CURRENT_VAL=""; config_list_foreach "$s" url_ip _append_list; uips="$CURRENT_VAL"
|
|
CURRENT_VAL=""; config_list_foreach "$s" url_domain _append_list; udoms="$CURRENT_VAL"
|
|
|
|
[ -n "$ips" ] && _process_item "${name}_ip" "$ips" "ip" "$dir" "$exc"
|
|
[ -n "$doms" ] && _process_item "${name}_dom" "$doms" "dom" "$dir" "$exc"
|
|
[ -n "$uips" ] && _process_item "${name}_uip" "$uips" "uip" "$dir" "$exc"
|
|
[ -n "$udoms" ] && _process_item "${name}_udom" "$udoms" "udom" "$dir" "$exc"
|
|
}
|
|
|
|
_cleanup_orphans() {
|
|
[ -z "$IPNET_DIR" ] || [ -z "$DNSMASQ_DIR" ] && return
|
|
for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
|
|
[ -e "$f" ] || continue
|
|
if ! grep -Fxq "$f" "$ACTIVE_LIST" 2>/dev/null; then
|
|
local base="${f##*/}"
|
|
local sname="${base%.*}"
|
|
_log "Orphan detected: $sname. Cleaning up..." "info"
|
|
nft delete set ip "$TABLE" "s_$sname" 2>/dev/null
|
|
[[ "$f" == "$DNSMASQ_DIR"* ]] && DNS_CHANGES=1
|
|
rm -f "$f" "$CACHE_DIR/$sname.hash"
|
|
fi
|
|
done
|
|
rm -f "$ACTIVE_LIST"
|
|
}
|
|
|
|
_run() {
|
|
DNS_CHANGES=0
|
|
|
|
if [ "$FULL_LOAD" = "1" ]; then
|
|
_load_config_full || return 1
|
|
else
|
|
_init_vars || return 1
|
|
fi
|
|
|
|
: > "$ACTIVE_LIST"
|
|
_nft_init || return 1
|
|
|
|
local lnet_val=$(uci -q get xray-manager.@lnet[0].ip)
|
|
[ -n "$lnet_val" ] && _process_item "lnet" "$lnet_val" "ip" "dst" "1"
|
|
|
|
config_foreach _process_section "xray-list"
|
|
_cleanup_orphans
|
|
|
|
[ "$DNS_CHANGES" = "1" ] && /etc/init.d/dnsmasq restart
|
|
}
|
|
|
|
_stop() {
|
|
_load_config_full || exit 1
|
|
nft delete table ip "$TABLE" 2>/dev/null
|
|
ip rule del fwmark "$TPROXY_MARK" table 110 2>/dev/null
|
|
ip route del local default dev lo table 110 2>/dev/null
|
|
rm -rf "$IPNET_DIR"/* "$DNSMASQ_DIR"/* "$CACHE_DIR"/*
|
|
/etc/init.d/dnsmasq restart
|
|
}
|
|
|
|
case "$1" in
|
|
start)
|
|
export SKIP_URL=0 FULL_LOAD=1; _run ;;
|
|
restart)
|
|
_stop; export SKIP_URL=0 FULL_LOAD=1; _run ;;
|
|
reload)
|
|
export SKIP_URL=1 FULL_LOAD=0; _run ;;
|
|
update)
|
|
export SKIP_URL=0 FULL_LOAD=0; _run ;;
|
|
stop)
|
|
_stop ;;
|
|
*)
|
|
echo "Usage: $0 {start|reload|update|stop|restart}" ;;
|
|
esac |