Compare commits
11
Commits
f9c51d0199
...
0.1.25
| Author | SHA1 | Date | |
|---|---|---|---|
 root
|
520eca9548 | ||
|
root
|
b0c53fb678 | ||
|
root
|
b78e53ee23 | ||
|
root
|
0553dc8d70 | ||
|
root
|
819111f953 | ||
 pyrschtjag
|
b8ac297adb | ||
|
root
|
e0f3b4ab8b | ||
|
root
|
3462c3a9ad | ||
|
root
|
e80f3f0171 | ||
|
pyrschtjag
|
1a631140a7 | ||
|
pyrschtjag
|
eb9621cec6 |
@@ -10,8 +10,11 @@
|
||||
* **Поддержка `auto-merge`**: Автоматическое решение конфликтов пересекающихся подсетей на уровне ядра (nftables), что предотвращает ошибки при загрузке больших списков.
|
||||
* **Умное обновление DNS**: Сервис `dnsmasq` перезапускается только при реальном изменении списков доменов, минимизируя разрывы соединений.
|
||||
* **Проверка изменений (Hashing)**: Скрипт отслеживает изменения в конфигурации URL и уведомляет о необходимости запуска обновления при использовании `reload`.
|
||||
* **Гибкая маршрутизация**: Поддержка фильтрации по источнику (`src`) и назначению (`dst`), а также корректная обработка локального трафика роутера (`route_local`).
|
||||
* **Гибкая маршрутизация**: Поддержка фильтрации по источнику (`src`) и назначению (`dst`).
|
||||
* **Автоматическая очистка**: Удаление устаревших кэш-файлов и правил при изменении структуры конфигурации.
|
||||
* **Персональные цепочки**: Возможность завернуть абсолютно весь трафик конкретного устройства в прокси с созданием изолированной цепочки правил.
|
||||
* **Изолированные исключения**: Поддержка параметра parent, который позволяет назначать списки исключений только для конкретных групп или устройств, не влияя на общую маршрутизацию.
|
||||
* **Защита от петель**: Автоматическое исключение IP-адресов самих прокси-серверов из обработки, что гарантирует стабильность соединения.
|
||||
|
||||
## Установка
|
||||
|
||||
@@ -52,7 +55,7 @@ ln -s /opt/.xray-manager/init.d/xray-manager /etc/init.d/xray-manager
|
||||
|
||||
* **/etc/init.d/xray-manager start** — **Холодный запуск** <br> Полная инициализация системы: создание таблиц nftables, цепочек и правил. При первом запуске скрипт автоматически скачает все списки из URL. Если списки уже есть в кэше — применит их.
|
||||
|
||||
* **/etc/init.dИ отредактируйте/xray-manager reload** — **Локальное обновление** <br> Применяет изменения, внесенные в конфигурационный файл /etc/config/xray-manager (например, изменение портов или добавление новых секций), но не обращается к сети. Если вы изменили URL в конфиге, скрипт выдаст предупреждение о необходимости запуска update.
|
||||
* **/etc/init.d/xray-manager reload** — **Локальное обновление** <br> Применяет изменения, внесенные в конфигурационный файл /etc/config/xray-manager (например, изменение портов или добавление новых секций), но не обращается к сети. Если вы изменили URL в конфиге, скрипт выдаст предупреждение о необходимости запуска update.
|
||||
|
||||
* **/etc/init.d/xray-manager update** — **Умная синхронизация** <br> Скрипт опрашивает все внешние URL. Благодаря системе хеширования (Hashing), загрузка и пересборка правил произойдет только для тех списков, которые реально изменились на удаленном сервере. Это экономит трафик и минимизирует нагрузку на процессор роутера.
|
||||
|
||||
@@ -75,9 +78,9 @@ ln -s /opt/.xray-manager/init.d/xray-manager /etc/init.d/xray-manager
|
||||
| **dnsmasq_dir** | `string` | `/tmp/dnsmasq.d` | Директория для `.conf` файлов dnsmasq (автоматически добавляется в `confdir` по пути `/etc/config/dhcp`). |
|
||||
| **cache_dir** | `string` | `/tmp/.xray-manager/cache` | Место хранения хэш-файлов для отслеживания изменений в списках. |
|
||||
| **active_list** | `string` | `/tmp/.xray-manager/active_files` | Файл-индекс для автоматической очистки «осиротевших» (удаленных) списков. |
|
||||
| **route_local** | `bool` | `0` | `1` — перехватывать и проксировать трафик самого роутера; <br> `0` — только трафик клиентов. |
|
||||
| **proxy_ip** | `list` | | Список IP прокси-серверов. Они будут автоматически добавлены в исключения, чтобы роутер не пытался проксировать соединение к самому прокси. |
|
||||
|
||||
Пример:
|
||||
Пример:
|
||||
|
||||
```bash
|
||||
config xray-manager 'main'
|
||||
@@ -85,7 +88,6 @@ config xray-manager 'main'
|
||||
option tproxy_port '61219'
|
||||
option tproxy_mark '10'
|
||||
option timeout '1h'
|
||||
option route_local '1'
|
||||
option ipnet_dir '/tmp/ipnet'
|
||||
option dnsmasq_dir '/tmp/dnsmasq.d'
|
||||
option cache_dir '/tmp/.xray-manager/cache'
|
||||
@@ -119,8 +121,9 @@ config xray-list 'lnet'
|
||||
| Параметр | Значение | Описание |
|
||||
| :--- | :--- | :--- |
|
||||
| **name** | `string` | Уникальное имя. Используется для названия сета в `nftables` (например, `@v2ray_udom`) и имени файла в `/tmp`. |
|
||||
| **direction** | `dst` или `src` | **Направление фильтрации**: <br> `dst`: проверка IP назначения (куда идём). <br> `src`: проверка IP отправителя (кто идёт). |
|
||||
| **exclude** | `0` или `1` | **Тип правила**: <br> `0`: Направлять трафик в прокси. <br> `1`: Пропускать трафик напрямую (исключение). |
|
||||
| **direction** | `dst`, `src`, `out`, `force_src` | **Направление фильтрации**: <br> `dst`: проверка IP назначения. <br> `src`: проверка IP отправителя. <br> `out`: трафик самого роутера (Self-traffic). <br> `force_src`: принудительный прокси для устройства (весь трафик). |
|
||||
| **exclude** | `bool` | **Тип правила**: <br> `0`: Направлять трафик в прокси. <br> `1`: Пропускать трафик напрямую (исключение). |
|
||||
| **parent** | `string` | Имя родительской секции (`force_src`). Если указан, то данное исключение (`exclude 1`) будет работать только для этого родителя. |
|
||||
|
||||
Внутри каждой секции можно комбинировать разные типы данных:
|
||||
|
||||
@@ -131,6 +134,39 @@ config xray-list 'lnet'
|
||||
| **list url_ip** | `http(s)://...` | Ссылка на сырой текстовый файл с IP. Скрипт скачает и объединит данные. |
|
||||
| **list url_domain** | `http(s)://...` | Ссылка на сырой текстовый файл с доменами. Готовит данные для dnsmasq. |
|
||||
|
||||
### Прокси для самого роутера
|
||||
|
||||
В этом примере завернём запросы до DNS-серверов Cloudflare в прокси:
|
||||
|
||||
```bash
|
||||
config xray-list
|
||||
option name 'router_self'
|
||||
option direction 'out' # Трафик роутера
|
||||
option exclude '0'
|
||||
list ip '1.1.1.1'
|
||||
list ip '1.0.0.1'
|
||||
```
|
||||
|
||||
### Проксировать весь трафик от клиента с поддержкой исключений
|
||||
|
||||
Завернём в прокси весь трафик от клиента, исключив 2ip.ru:
|
||||
|
||||
```bash
|
||||
# Проксировать весь трафик от клиента 10.2.0.4
|
||||
config xray-list
|
||||
option name 'my_pc'
|
||||
option direction 'force_src'
|
||||
list ip '10.2.0.4'
|
||||
|
||||
# Исключение для my_pc
|
||||
config xray-list
|
||||
option name 'my_pc_exc'
|
||||
option direction 'dst'
|
||||
option exclude '1'
|
||||
option parent 'my_pc' # Привязка к родителю
|
||||
list domain '2ip.ru'
|
||||
```
|
||||
|
||||
### Практический пример по выборочной маршрутизации
|
||||
|
||||
**Задача**: Направить трафик конкретного устройства (10.1.0.2) через прокси только при обращении к ресурсам Spotify, не затрагивая остальных клиентов сети.
|
||||
|
||||
+16
-22
@@ -5,36 +5,30 @@ config xray-manager 'main'
|
||||
option tproxy_mark '10'
|
||||
option client_mark '103'
|
||||
option timeout '1h'
|
||||
option route_local '1'
|
||||
option ipnet_dir '/tmp/.xray-manager/ipnet'
|
||||
option dnsmasq_dir '/tmp/.xray-manager/dnsmasq.d'
|
||||
option cache_dir '/tmp/.xray-manager/cache'
|
||||
option active_list '/tmp/.xray-manager/active_files'
|
||||
|
||||
config xray-list 'lnet'
|
||||
option name 'whitelist'
|
||||
option direction 'dst'
|
||||
option exclude '1'
|
||||
list ip '127.0.0.0/8'
|
||||
list ip '10.0.0.0/8'
|
||||
list ip '172.16.0.0/12'
|
||||
list ip '192.168.0.0/16'
|
||||
list ip '169.254.0.0/16'
|
||||
list ip '100.64.0.0/10'
|
||||
list ip '224.0.0.0/4'
|
||||
list ip '255.255.255.255/32'
|
||||
list ip '0.0.0.0/8'
|
||||
list ip '192.0.0.0/24'
|
||||
list ip '192.0.2.0/24'
|
||||
list ip '198.18.0.0/15'
|
||||
list ip '198.51.100.0/24'
|
||||
list ip '203.0.113.0/24'
|
||||
list proxy_ip 'x.x.x.x'
|
||||
|
||||
config xray-list
|
||||
option name 'proxyserver'
|
||||
option name 'router'
|
||||
option direction 'out'
|
||||
option exclude '0'
|
||||
list ip '1.1.1.1'
|
||||
list ip '1.0.0.1'
|
||||
|
||||
config xray-list
|
||||
option name 'pc'
|
||||
option direction 'force_src'
|
||||
list ip '192.168.2.10'
|
||||
|
||||
config xray-list
|
||||
option name 'pc_exclude'
|
||||
option direction 'dst'
|
||||
option exclude '1'
|
||||
list ip ''
|
||||
option parent 'pc'
|
||||
list domain 'ifconfig.io'
|
||||
|
||||
config xray-list
|
||||
option name 'local'
|
||||
|
||||
+15
-24
@@ -3,43 +3,34 @@
|
||||
START=99
|
||||
USE_PROCD=1
|
||||
|
||||
XRAY_BIN="/opt/.xray-manager/xray-manager.sh"
|
||||
XRAYMANAGER_BIN="/opt/.xray-manager/xray-manager.sh"
|
||||
|
||||
extra_command "update" "Download and refresh remote lists"
|
||||
|
||||
start_service() {
|
||||
local timeout=20
|
||||
while [ ! -s /proc/net/route ] && [ $timeout -gt 0 ]; do
|
||||
sleep 1
|
||||
timeout=$((timeout - 1))
|
||||
done
|
||||
|
||||
timeout=20
|
||||
while ! ping -q -c 1 -W 2 1.1.1.1 >/dev/null 2>&1 && [ $timeout -gt 0 ]; do
|
||||
sleep 2
|
||||
timeout=$((timeout - 2))
|
||||
done
|
||||
|
||||
"$XRAYMANAGER_BIN" start
|
||||
procd_open_instance "main"
|
||||
|
||||
procd_set_param command "$XRAY_BIN" start
|
||||
procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
|
||||
procd_set_param limits core="unlimited"
|
||||
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
|
||||
procd_set_param command /bin/sh -c "while true; do sleep 3600; done"
|
||||
procd_set_param respawn
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
"$XRAY_BIN" stop
|
||||
"$XRAYMANAGER_BIN" stop
|
||||
}
|
||||
|
||||
reload_service() {
|
||||
"$XRAY_BIN" reload
|
||||
if procd_running "xray-manager" "main"; then
|
||||
"$XRAYMANAGER_BIN" reload
|
||||
else
|
||||
echo "xray-manager is not running"
|
||||
fi
|
||||
}
|
||||
|
||||
update() {
|
||||
"$XRAY_BIN" update
|
||||
if procd_running "xray-manager" "main"; then
|
||||
"$XRAYMANAGER_BIN" update
|
||||
else
|
||||
echo "xray-manager is not running"
|
||||
fi
|
||||
}
|
||||
+303
-198
@@ -2,18 +2,47 @@
|
||||
|
||||
. /lib/functions.sh
|
||||
|
||||
readonly LNET_RESERVED="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 100.64.0.0/10 224.0.0.0/4 255.255.255.255/32 0.0.0.0/8"
|
||||
readonly LNET_NAME="system_lnet"
|
||||
readonly TEST_DOMAIN="github.com"
|
||||
readonly PING_ADDR=1.1.1.1
|
||||
readonly RT_TABLE=110
|
||||
readonly DEBUG=0
|
||||
readonly DEBUG_LOG="/tmp/xray-manager.log"
|
||||
|
||||
_log() {
|
||||
local msg="$1" level="${2:-info}" to_console="${3:-1}"
|
||||
logger -t xray-manager -p "daemon.$level" "$msg"
|
||||
[ "$to_console" = "1" ] && echo "[$level] $msg"
|
||||
local msg="$1"
|
||||
local level="${2:-info}"
|
||||
local to_console="${3:-1}"
|
||||
|
||||
[ "$level" = "debug" ] && [ "$DEBUG" -ne 1 ] && return
|
||||
|
||||
if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
|
||||
echo "$(date '+%Y-%m-%d %H:%M:%S') $msg" >> "$DEBUG_LOG"
|
||||
fi
|
||||
|
||||
local sys_level="info"
|
||||
case "$level" in
|
||||
info) sys_level="info" ;;
|
||||
crit) sys_level="crit" ;;
|
||||
err) sys_level="err" ;;
|
||||
warn) sys_level="warning" ;;
|
||||
debug) sys_level="debug" ;;
|
||||
esac
|
||||
|
||||
[ "$level" != "debug" ] && logger -t xray-manager -p "daemon.$sys_level" "$msg"
|
||||
|
||||
if [ "$to_console" = "1" ]; then
|
||||
printf "%s\n" "$msg"
|
||||
fi
|
||||
}
|
||||
|
||||
_get_md5() { echo "$1" | md5sum | cut -d' ' -f1; }
|
||||
|
||||
_init_vars() {
|
||||
_log "config: loading configuration" "debug"
|
||||
config_load xray-manager
|
||||
|
||||
local s="@xray-manager[0]"
|
||||
local s="main"
|
||||
TABLE=$(uci -q get xray-manager.$s.table_name)
|
||||
TPROXY_PORT=$(uci -q get xray-manager.$s.tproxy_port)
|
||||
TPROXY_MARK=$(uci -q get xray-manager.$s.tproxy_mark)
|
||||
@@ -23,136 +52,176 @@ _init_vars() {
|
||||
DNSMASQ_DIR=$(uci -q get xray-manager.$s.dnsmasq_dir)
|
||||
CACHE_DIR=$(uci -q get xray-manager.$s.cache_dir)
|
||||
ACTIVE_LIST=$(uci -q get xray-manager.$s.active_list)
|
||||
ROUTE_LOCAL=$(uci -q get xray-manager.$s.route_local)
|
||||
|
||||
local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK TIMEOUT IPNET_DIR DNSMASQ_DIR CACHE_DIR ACTIVE_LIST ROUTE_LOCAL"
|
||||
_get_proxy_list() { PROXY_SERVERS="${PROXY_SERVERS}${PROXY_SERVERS:+ }$1"; }
|
||||
PROXY_SERVERS=""
|
||||
config_list_foreach "$s" proxy_ip _get_proxy_list
|
||||
|
||||
local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK TIMEOUT IPNET_DIR DNSMASQ_DIR CACHE_DIR ACTIVE_LIST"
|
||||
for var in $required_vars; do
|
||||
eval val=\$$var
|
||||
if [ -z "$val" ]; then
|
||||
_log "CRITICAL: Variable '$var' is not set in UCI config!" "err" "1"
|
||||
_log "config: variable '$var' is missing" "crit"
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
|
||||
_log "config: loaded table=$TABLE, port=$TPROXY_PORT, mark=$TPROXY_MARK" "debug"
|
||||
mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR" "${ACTIVE_LIST%/*}"
|
||||
return 0
|
||||
}
|
||||
|
||||
_check_marks() {
|
||||
local m_dec=$(printf "%d" "$CLIENT_MARK" 2>/dev/null)
|
||||
local m_hex=$(printf "%x" "$m_dec" 2>/dev/null)
|
||||
local m_pattern="($m_dec|0x0*$m_hex)"
|
||||
|
||||
if nft list ruleset 2>/dev/null | sed "/table ip $TABLE/,/^}/d" | grep -iqE "mark.*$m_pattern"; then
|
||||
_log "Mark 0x$m_hex is busy in another table!" "err" "1"
|
||||
return 1
|
||||
if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
|
||||
: > "$DEBUG_LOG" 2>/dev/null
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
_check_dnsmasq() {
|
||||
local current_dns_dir=$(uci -q get dhcp.@dnsmasq[0].confdir | awk '{print $1}')
|
||||
_validate_config() {
|
||||
_log "config: validating uci syntax" "debug"
|
||||
|
||||
if [ -z "$current_dns_dir" ]; then
|
||||
_log "dnsmasq.confdir is empty. Setting to $DNSMASQ_DIR" "info" "1"
|
||||
uci add_list dhcp.@dnsmasq[0].confdir="$DNSMASQ_DIR"
|
||||
uci commit dhcp
|
||||
DNS_CHANGES=1
|
||||
elif [ "$current_dns_dir" != "$DNSMASQ_DIR" ]; then
|
||||
_log "dnsmasq.confdir mismatch: $current_dns_dir" "err" "1"
|
||||
_log "Expected $DNSMASQ_DIR. Check your DHCP config." "err" "1"
|
||||
return 1
|
||||
if [ -f "/etc/config/xray-manager" ]; then
|
||||
sed -i 's/^ \+/ /g' /etc/config/xray-manager
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
_load_config_full() {
|
||||
_init_vars || return 1
|
||||
_check_marks || return 1
|
||||
_check_dnsmasq || return 1
|
||||
return 0
|
||||
local dns_confdir
|
||||
dns_confdir=$(uci -q get dhcp.@dnsmasq[0].confdir)
|
||||
if [ -z "$dns_confdir" ] || ! echo "$dns_confdir" | grep -q "$DNSMASQ_DIR"; then
|
||||
_log "config: $DNSMASQ_DIR is not set in dnsmasq" "warn"
|
||||
fi
|
||||
|
||||
local allowed_opts="name direction exclude parent ip domain url_ip url_domain"
|
||||
|
||||
validate_list_section() {
|
||||
local s="$1" name direction
|
||||
config_get name "$s" name
|
||||
config_get direction "$s" direction "dst"
|
||||
|
||||
if [ -z "$name" ]; then
|
||||
_log "config: section $s is missing name" "crit"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local current_opt
|
||||
for current_opt in $(uci show xray-manager."$s" | cut -d'.' -f3 | cut -d'=' -f1 | sort -u); do
|
||||
case "$current_opt" in
|
||||
.*) continue ;;
|
||||
esac
|
||||
|
||||
if ! echo "$allowed_opts" | grep -qw "$current_opt"; then
|
||||
_log "$name: unknown option: '$current_opt'" "err"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
case "$direction" in
|
||||
src|dst|out|force_src) ;;
|
||||
*) _log "$name: invalid direction: $direction" "err"; exit 1 ;;
|
||||
esac
|
||||
}
|
||||
config_foreach validate_list_section "xray-list"
|
||||
_log "config: validation complete" "info"
|
||||
}
|
||||
|
||||
_nft_init() {
|
||||
[ -z "$TABLE" ] && return 1
|
||||
_log "Initializing NFT table: $TABLE" "info" "1"
|
||||
_log "$TABLE: initializing nft table" "info"
|
||||
nft add table ip "$TABLE" 2>/dev/null
|
||||
|
||||
_log "$TABLE: setting up base chains" "debug"
|
||||
nft add chain ip "$TABLE" prerouting { type filter hook prerouting priority mangle \; policy accept \; } 2>/dev/null
|
||||
nft flush chain ip "$TABLE" prerouting
|
||||
|
||||
nft add rule ip "$TABLE" prerouting udp dport 67-68 accept
|
||||
nft add rule ip "$TABLE" prerouting fib daddr type local accept
|
||||
|
||||
local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
|
||||
|
||||
ip route show table 110 | grep -q "local default" || ip route add local default dev lo table 110
|
||||
ip rule show | grep -q "fwmark $mark_hex lookup 110" || ip rule add fwmark "$TPROXY_MARK" table 110
|
||||
|
||||
if [ "$ROUTE_LOCAL" = "1" ]; then
|
||||
nft add chain ip "$TABLE" output { type route hook output priority mangle \; policy accept \; } 2>/dev/null
|
||||
nft add chain ip "$TABLE" output { type route hook output priority -150 \; policy accept \; } 2>/dev/null
|
||||
nft flush chain ip "$TABLE" output
|
||||
nft add rule ip "$TABLE" output fib daddr type local accept
|
||||
else
|
||||
nft delete chain ip "$TABLE" output 2>/dev/null || true
|
||||
fi
|
||||
|
||||
local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
|
||||
_log "route: configuring table $RT_TABLE, mark $mark_hex" "debug"
|
||||
ip route show table $RT_TABLE 2>/dev/null | grep -q "local default" || ip route add local default dev lo table $RT_TABLE
|
||||
ip rule show | grep -q "fwmark $mark_hex lookup $RT_TABLE" || ip rule add fwmark "$TPROXY_MARK" table $RT_TABLE
|
||||
}
|
||||
|
||||
_nft_batch_insert() {
|
||||
local table="$1" sname="$2" file="$3"
|
||||
_nft_prepare_data() {
|
||||
local id="$1" file="$2" type="$3" changed="$4" dir="$5"
|
||||
local sname="s_$id"
|
||||
local set_params="type ipv4_addr; flags interval; auto-merge;"
|
||||
|
||||
[[ "$type" == *dom ]] && set_params="type ipv4_addr; flags interval,timeout; timeout $TIMEOUT; auto-merge;"
|
||||
|
||||
_log "$sname: creating nft set" "debug"
|
||||
nft add set ip "$TABLE" "$sname" { $set_params } 2>/dev/null
|
||||
|
||||
if [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
|
||||
if [ "$changed" = "1" ] || [ "$FULL_LOAD" = "1" ]; then
|
||||
_log "$sname: flushing and loading elements" "debug"
|
||||
nft flush set ip "$TABLE" "$sname"
|
||||
{
|
||||
printf "add element ip %s %s { " "$table" "$sname"
|
||||
awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
|
||||
{ val = ($1 ~ /\//) ? $1 : $1 "/32"
|
||||
printf "%s%s", (count++ ? ", " : ""), val }' "$file"
|
||||
echo " }"
|
||||
printf "add element ip %s %s { " "$TABLE" "$sname"
|
||||
awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { addr = ($1 ~ /\// ? $1 : $1"/32"); printf "%s%s", (count++ ? ", " : ""), addr }' "$file"
|
||||
printf " }\n"
|
||||
} | nft -f -
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$dir" = "force_src" ]; then
|
||||
local cn="f_$id"
|
||||
_log "$cn: creating force-chain" "debug"
|
||||
nft add chain ip "$TABLE" "$cn" 2>/dev/null
|
||||
nft flush chain ip "$TABLE" "$cn"
|
||||
nft add rule ip "$TABLE" "$cn" meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
||||
fi
|
||||
}
|
||||
|
||||
_nft_apply_data() {
|
||||
local sname="$1" file="$2" exc="$3" dir="$4" type="$5" changed="$6"
|
||||
[ -z "$TABLE" ] && return 1
|
||||
|
||||
_nft_apply_rule() {
|
||||
local sname="$1" dir="$2" exc="$3" parent="$4" mode="$5"
|
||||
local nft_sname="s_$sname"
|
||||
local flags="interval"
|
||||
local set_params="type ipv4_addr; flags $flags; auto-merge;"
|
||||
local sel="ip daddr"
|
||||
[ "$dir" = "src" ] && sel="ip saddr"
|
||||
|
||||
if [ "$type" = "dom" ] || [ "$type" = "udom" ]; then
|
||||
flags="interval,timeout"
|
||||
set_params="type ipv4_addr; flags $flags; timeout $TIMEOUT; auto-merge;"
|
||||
case "$mode" in
|
||||
jumps)
|
||||
[ "$dir" = "force_src" ] && {
|
||||
_log "$nft_sname: applying jump to f_$sname" "debug"
|
||||
nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" jump "f_${sname}" 2>/dev/null
|
||||
}
|
||||
;;
|
||||
exclude)
|
||||
[ "$exc" != "1" ] && [ "$sname" != "$LNET_NAME" ] && return
|
||||
|
||||
local target_info=""
|
||||
[ -n "$parent" ] && target_info=" target=$parent"
|
||||
_log "$nft_sname: applying exclude rule$target_info" "debug"
|
||||
|
||||
if [ -n "$parent" ]; then
|
||||
nft insert rule ip "$TABLE" "$parent" ip daddr "@$nft_sname" accept 2>/dev/null
|
||||
else
|
||||
[ "$dir" != "out" ] && nft add rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
|
||||
[ "$dir" = "out" ] && nft add rule ip "$TABLE" output "$sel" "@$nft_sname" accept 2>/dev/null
|
||||
fi
|
||||
;;
|
||||
main_rules)
|
||||
[ "$exc" = "1" ] || [ "$dir" = "force_src" ] && return
|
||||
|
||||
nft add set ip "$TABLE" "$nft_sname" { $set_params } 2>/dev/null
|
||||
_log "$nft_sname: applying tproxy rules" "debug"
|
||||
|
||||
if [ "$changed" = "1" ] && [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
|
||||
_log " -> Syncing '$nft_sname' to NFT ruleset..." "info" "1"
|
||||
nft flush set ip "$TABLE" "$nft_sname"
|
||||
_nft_batch_insert "$TABLE" "$nft_sname" "$file"
|
||||
fi
|
||||
|
||||
local has_out; nft list chain ip "$TABLE" output >/dev/null 2>&1 && has_out=1
|
||||
|
||||
if [ "$exc" = "1" ]; then
|
||||
local sel="ip daddr"; [ "$dir" = "src" ] && sel="ip saddr"
|
||||
nft insert rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
|
||||
elif [ "$dir" = "src" ]; then
|
||||
if [ "$mode_chain" = "prerouting" ] && [ "$dir" != "out" ]; then
|
||||
if [ "$dir" = "src" ]; then
|
||||
nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" ct mark set "$CLIENT_MARK" 2>/dev/null
|
||||
else
|
||||
for proto in tcp udp; do
|
||||
nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" \
|
||||
meta l4proto "$proto" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
||||
[ "$has_out" = "1" ] && \
|
||||
nft add rule ip "$TABLE" output ip daddr "@$nft_sname" \
|
||||
meta l4proto "$proto" ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
||||
done
|
||||
nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
||||
fi
|
||||
elif [ "$mode_chain" = "output" ] && [ "$dir" = "out" ]; then
|
||||
nft add rule ip "$TABLE" output ip daddr "@$nft_sname" meta l4proto "{ tcp, udp }" counter ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
_process_item() {
|
||||
local id="$1" val="$2" type="$3" dir="$4" exc="$5" fullpath hfile changed=0
|
||||
local id="$1" val="$2" type="$3" dir="$4" exc="$5" parent="$6"
|
||||
local fullpath hfile changed=0
|
||||
|
||||
[ "$type" = "dom" ] || [ "$type" = "udom" ] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
|
||||
[[ "$type" == *dom ]] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
|
||||
hfile="$CACHE_DIR/$id.hash"
|
||||
|
||||
echo "$fullpath" >> "$ACTIVE_LIST"
|
||||
@@ -161,166 +230,202 @@ _process_item() {
|
||||
local new_hash=$(_get_md5 "$val")
|
||||
local old_hash=$(cat "$hfile" 2>/dev/null)
|
||||
|
||||
# RELOAD MODE
|
||||
if [ "$SKIP_URL" = "1" ] && { [ "$type" = "uip" ] || [ "$type" = "udom" ]; }; then
|
||||
_log "Reloading $id..." "info" "1"
|
||||
local status="stable"
|
||||
if [ "$new_hash" != "$old_hash" ]; then
|
||||
_log " -> Warning: UCI config changed. Run 'update' to fetch new data." "warn" "1"
|
||||
status="changed"
|
||||
[ "$SKIP_URL" = "1" ] && [[ "$type" == u* ]] && NEED_UPDATE=1
|
||||
fi
|
||||
[ -f "$fullpath" ] && _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "0"
|
||||
|
||||
_log "$id status: $status" "debug"
|
||||
|
||||
if [ "$SKIP_URL" = "1" ] && [[ "$type" == u* ]]; then
|
||||
_log "$id: skipping download (reload mode)" "debug"
|
||||
[ ! -f "$fullpath" ] && { _log "$id: data file missing" "warn"; NEED_UPDATE=1; }
|
||||
[ -f "$fullpath" ] && _nft_prepare_data "$id" "$fullpath" "$type" 0 "$dir"
|
||||
return
|
||||
fi
|
||||
|
||||
if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ] || [ "$SKIP_URL" = "0" ]; then
|
||||
case "$type" in
|
||||
ip)
|
||||
echo "$val" | tr ' ' '\n' | sed 's/\r//g; /^#/d; /^[[:space:]]*$/d; /\//! s|$|/32|' | sort -u > "$fullpath.tmp"
|
||||
if ! cmp -s "$fullpath.tmp" "$fullpath"; then
|
||||
mv "$fullpath.tmp" "$fullpath"; changed=1
|
||||
else
|
||||
rm -f "$fullpath.tmp"
|
||||
fi
|
||||
echo "$val" | tr ' ' '\n' | sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' -e '/\//! s|$|/32|' | sort -u > "$fullpath.tmp"
|
||||
;;
|
||||
dom)
|
||||
echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '
|
||||
/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
|
||||
{ gsub(/\r/, ""); print "nftset=/" tolower($1) "/4#ip#" t "#" i }' | sort -u > "$fullpath.tmp"
|
||||
if ! cmp -s "$fullpath.tmp" "$fullpath"; then
|
||||
mv "$fullpath.tmp" "$fullpath"; changed=1; DNS_CHANGES=1
|
||||
else
|
||||
rm -f "$fullpath.tmp"
|
||||
fi
|
||||
echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { gsub(/\r/, ""); printf "nftset=/%s/4#ip#%s#%s\n", tolower($1), t, i }' | sort -u > "$fullpath.tmp"
|
||||
;;
|
||||
uip|udom)
|
||||
_log "Checking $id..." "info" "1"
|
||||
local tmp_all="$CACHE_DIR/dl_all_$id"
|
||||
_log "$id: fetching remote list" "info"
|
||||
local tmp_all="$CACHE_DIR/dl_$id"
|
||||
: > "$tmp_all"
|
||||
local dl_ok=0
|
||||
|
||||
for url in $val; do
|
||||
local url_hash=$(echo "$url" | md5sum | cut -c1-8)
|
||||
local etag_file="$CACHE_DIR/${id}_${url_hash}.etag"
|
||||
local cache_raw="$CACHE_DIR/${id}_${url_hash}.raw"
|
||||
local header_file="$CACHE_DIR/header_$id"
|
||||
local old_etag=$(cat "$etag_file" 2>/dev/null | tr -d '\r\n ')
|
||||
local etag_header=""; [ -n "$old_etag" ] && etag_header="-H 'If-None-Match: \"$old_etag\"'"
|
||||
local uhash=$(echo "$url" | md5sum | cut -c1-8)
|
||||
_log "$id: downloading $url" "debug"
|
||||
local cache_raw="$CACHE_DIR/${id}_$uhash.raw"
|
||||
local hfile_tmp="$CACHE_DIR/h_$id"
|
||||
local etag_f="$CACHE_DIR/${id}_$uhash.etag"
|
||||
local etag=$(cat "$etag_f" 2>/dev/null)
|
||||
|
||||
local tmp_single="$CACHE_DIR/tmp_dl_$url_hash"
|
||||
eval "curl -sSfL --connect-timeout 10 $etag_header -D '$header_file' '$url'" > "$tmp_single"
|
||||
local exit_code=$?
|
||||
curl -sSfL --connect-timeout 15 ${etag:+-H "If-None-Match: \"$etag\""} -D "$hfile_tmp" "$url" > "$tmp_all.raw"
|
||||
local res=$?
|
||||
|
||||
if grep -q "HTTP/.* 304" "$header_file" 2>/dev/null; then
|
||||
_log " -> $url_hash: 304 Not Modified" "info" "1"
|
||||
[ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all"
|
||||
dl_ok=1
|
||||
elif [ $exit_code -eq 0 ] && [ -s "$tmp_single" ]; then
|
||||
_log " -> $url_hash: 200 OK" "info" "1"
|
||||
local current_etag=$(grep -i "^etag:" "$header_file" | sed 's/[Ee][Tt][Aa][Gg]: //; s/W\///; s/["\r\n ]//g')
|
||||
[ -n "$current_etag" ] && echo "$current_etag" > "$etag_file"
|
||||
cat "$tmp_single" > "$cache_raw"
|
||||
cat "$tmp_single" >> "$tmp_all"
|
||||
if grep -q "304" "$hfile_tmp" 2>/dev/null; then
|
||||
_log "$id: 304 not modified" "info"
|
||||
[ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all" && dl_ok=1
|
||||
elif [ $res -eq 0 ] && [ -s "$tmp_all.raw" ]; then
|
||||
_log "$id: 200 ok" "info"
|
||||
grep -i "^etag:" "$hfile_tmp" | awk -F': ' '{print $2}' | sed 's/W\///; s/["\r\n ]//g' > "$etag_f"
|
||||
cat "$tmp_all.raw" > "$cache_raw"
|
||||
cat "$tmp_all.raw" >> "$tmp_all"
|
||||
dl_ok=1
|
||||
else
|
||||
_log " -> $url_hash: Error. Trying cache..." "warn" "1"
|
||||
[ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all"
|
||||
_log "$id: download failed, using local cache" "warn"
|
||||
[ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all" && dl_ok=1
|
||||
fi
|
||||
rm -f "$header_file" "$tmp_single"; echo "" >> "$tmp_all"
|
||||
done
|
||||
|
||||
if [ "$dl_ok" = "1" ] && [ -s "$tmp_all" ]; then
|
||||
local out="$CACHE_DIR/out_$id"
|
||||
if [ "$dl_ok" = "1" ]; then
|
||||
if [ "$type" = "uip" ]; then
|
||||
sed 's/\r//g; /^#/d; /^[[:space:]]*$/d' "$tmp_all" | awk '{print ($1 ~ /\//) ? $1 : $1"/32"}' | sort -u > "$out"
|
||||
sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' "$tmp_all" | awk '{ print ($1 ~ /\// ? $1 : $1"/32") }' | sort -u > "$fullpath.tmp"
|
||||
else
|
||||
tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | \
|
||||
sed "s|^|nftset=/|; s|\$|/4#ip#$TABLE#s_$id|" > "$out"
|
||||
fi
|
||||
|
||||
if [ -f "$fullpath" ] && cmp -s "$out" "$fullpath"; then
|
||||
_log " -> $id: No changes in content." "info" "1"
|
||||
rm -f "$out"
|
||||
else
|
||||
_log " -> $id: Content updated." "info" "1"
|
||||
mv "$out" "$fullpath"; changed=1
|
||||
[ "$type" = "udom" ] && DNS_CHANGES=1
|
||||
tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | awk -v t="$TABLE" -v i="s_$id" '{ printf "nftset=/%s/4#ip#%s#%s\n", $1, t, i }' > "$fullpath.tmp"
|
||||
fi
|
||||
fi
|
||||
rm -f "$tmp_all" ;;
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ -s "$fullpath.tmp" ] && ! cmp -s "$fullpath.tmp" "$fullpath"; then
|
||||
mv "$fullpath.tmp" "$fullpath"
|
||||
changed=1
|
||||
[[ "$type" == *dom ]] && DNS_CHANGES=1
|
||||
_log "$id: list updated" "info"
|
||||
else
|
||||
rm -f "$fullpath.tmp"
|
||||
fi
|
||||
echo "$new_hash" > "$hfile"
|
||||
fi
|
||||
_nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "$changed"
|
||||
_nft_prepare_data "$id" "$fullpath" "$type" "$changed" "$dir"
|
||||
}
|
||||
|
||||
_process_section() {
|
||||
local s="$1" name dir exc ips doms uips udoms
|
||||
config_get name "$s" name; config_get dir "$s" direction "dst"; config_get exc "$s" exclude "0"
|
||||
local s="$1" mode="$2" name dir exc parent
|
||||
config_get name "$s" name
|
||||
config_get dir "$s" direction "dst"
|
||||
config_get exc "$s" exclude "0"
|
||||
config_get parent "$s" parent
|
||||
|
||||
[ -z "$name" ] && return
|
||||
name=${name//[^a-zA-Z0-9_]/}
|
||||
_append_list() { CURRENT_VAL="${CURRENT_VAL}${CURRENT_VAL:+ }$1"; }
|
||||
CURRENT_VAL=""; config_list_foreach "$s" ip _append_list; ips="$CURRENT_VAL"
|
||||
CURRENT_VAL=""; config_list_foreach "$s" domain _append_list; doms="$CURRENT_VAL"
|
||||
CURRENT_VAL=""; config_list_foreach "$s" url_ip _append_list; uips="$CURRENT_VAL"
|
||||
CURRENT_VAL=""; config_list_foreach "$s" url_domain _append_list; udoms="$CURRENT_VAL"
|
||||
[ -n "$ips" ] && _process_item "${name}_ip" "$ips" "ip" "$dir" "$exc"
|
||||
[ -n "$doms" ] && _process_item "${name}_dom" "$doms" "dom" "$dir" "$exc"
|
||||
[ -n "$uips" ] && _process_item "${name}_uip" "$uips" "uip" "$dir" "$exc"
|
||||
[ -n "$udoms" ] && _process_item "${name}_udom" "$udoms" "udom" "$dir" "$exc"
|
||||
}
|
||||
|
||||
_cleanup_orphans() {
|
||||
[ -z "$IPNET_DIR" ] || [ -z "$DNSMASQ_DIR" ] && return
|
||||
for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
|
||||
[ -e "$f" ] || continue
|
||||
if ! grep -Fxq "$f" "$ACTIVE_LIST" 2>/dev/null; then
|
||||
local base="${f##*/}"; local sname="${base%.*}"
|
||||
_log "Orphan detected: $sname. Cleaning up..." "info" "1"
|
||||
nft delete set ip "$TABLE" "s_$sname" 2>/dev/null
|
||||
[[ "$f" == "$DNSMASQ_DIR"* ]] && DNS_CHANGES=1
|
||||
rm -f "$f" "$CACHE_DIR/$sname.hash"
|
||||
[ "$exc" = "1" ] && [ -n "$parent" ] && parent="f_${parent}_ip"
|
||||
|
||||
if [ -z "$mode" ]; then
|
||||
_log "$name: configuring section" "debug"
|
||||
_get_v() { V="${V}${V:+ }$1"; }
|
||||
V=""; config_list_foreach "$s" ip _get_v; [ -n "$V" ] && _process_item "${name}_ip" "$V" "ip" "$dir" "$exc" "$parent"
|
||||
V=""; config_list_foreach "$s" domain _get_v; [ -n "$V" ] && _process_item "${name}_dom" "$V" "dom" "$dir" "$exc" "$parent"
|
||||
V=""; config_list_foreach "$s" url_ip _get_v; [ -n "$V" ] && _process_item "${name}_uip" "$V" "uip" "$dir" "$exc" "$parent"
|
||||
V=""; config_list_foreach "$s" url_domain _get_v; [ -n "$V" ] && _process_item "${name}_udom" "$V" "udom" "$dir" "$exc" "$parent"
|
||||
else
|
||||
[ -f "$IPNET_DIR/${name}_ip.lst" ] && _nft_apply_rule "${name}_ip" "$dir" "$exc" "$parent" "$mode"
|
||||
[ -f "$DNSMASQ_DIR/${name}_dom.lst" ] && _nft_apply_rule "${name}_dom" "$dir" "$exc" "$parent" "$mode"
|
||||
[ -f "$IPNET_DIR/${name}_uip.lst" ] && _nft_apply_rule "${name}_uip" "$dir" "$exc" "$parent" "$mode"
|
||||
[ -f "$DNSMASQ_DIR/${name}_udom.lst" ] && _nft_apply_rule "${name}_udom" "$dir" "$exc" "$parent" "$mode"
|
||||
|
||||
if [ "$mode" = "exclude" ] && [ "$dir" = "force_src" ]; then
|
||||
_log "$name: force-src: injecting lnet exclusion" "debug"
|
||||
_nft_apply_rule "$LNET_NAME" "dst" "1" "f_${name}_ip" "exclude"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
rm -f "$ACTIVE_LIST"
|
||||
}
|
||||
|
||||
_run() {
|
||||
DNS_CHANGES=0
|
||||
if [ "$FULL_LOAD" = "1" ]; then
|
||||
_log "Starting Xray-Manager (Full Load)..." "info" "1"
|
||||
_load_config_full || return 1
|
||||
else
|
||||
_log "Running Xray-Manager (Partial Load)..." "info" "1"
|
||||
_log "main: starting execution ($1)" "info"
|
||||
_init_vars || return 1
|
||||
fi
|
||||
: > "$ACTIVE_LIST"
|
||||
_nft_init || return 1
|
||||
local lnet_val=$(uci -q get xray-manager.@lnet[0].ip)
|
||||
[ -n "$lnet_val" ] && _process_item "lnet" "$lnet_val" "ip" "dst" "1"
|
||||
_validate_config
|
||||
DNS_CHANGES=0; NEED_UPDATE=0; : > "$ACTIVE_LIST"
|
||||
|
||||
[ "$FULL_LOAD" = "1" ] && _wait_for_net
|
||||
_nft_init
|
||||
|
||||
_log "main: processing data sections" "debug"
|
||||
config_foreach _process_section "xray-list"
|
||||
_cleanup_orphans
|
||||
if [ "$DNS_CHANGES" = "1" ]; then
|
||||
_log "Domains changes detected. Restarting dnsmasq..." "info" "1"
|
||||
/etc/init.d/dnsmasq restart
|
||||
else
|
||||
_log "No domains changes. dnsmasq restart skipped." "info" "1"
|
||||
_process_item "$LNET_NAME" "$LNET_RESERVED" "ip" "dst" "1"
|
||||
|
||||
_log "main: applying nft rules" "info"
|
||||
config_foreach _process_section "xray-list" "jumps"
|
||||
_nft_apply_rule "$LNET_NAME" "dst" "1" "" "exclude"
|
||||
config_foreach _process_section "xray-list" "exclude"
|
||||
|
||||
_log "main: applying proxy bypass" "debug"
|
||||
if [ -n "$PROXY_SERVERS" ]; then
|
||||
_process_item "proxy_servers" "$PROXY_SERVERS" "ip" "out" "0"
|
||||
nft add rule ip "$TABLE" output ip daddr "@s_proxy_servers" accept 2>/dev/null
|
||||
fi
|
||||
|
||||
_log "main: applying tproxy rules" "debug"
|
||||
mode_chain="prerouting"; config_foreach _process_section "xray-list" "main_rules"
|
||||
mode_chain="output"; config_foreach _process_section "xray-list" "main_rules"
|
||||
|
||||
_log "main: cleaning up orphans" "info"
|
||||
if [ -n "$IPNET_DIR" ] && [ -n "$DNSMASQ_DIR" ]; then
|
||||
for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
|
||||
[ -e "$f" ] || continue
|
||||
if ! grep -Fxq "$f" "$ACTIVE_LIST"; then
|
||||
local fname="${f##*/}"
|
||||
_log "orphan: removing $fname" "info"
|
||||
case "$f" in "$DNSMASQ_DIR"/*) DNS_CHANGES=1 ;; esac
|
||||
nft delete set ip "$TABLE" "s_${fname%.*}" 2>/dev/null
|
||||
rm -f "$f"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
[ "$DNS_CHANGES" = "1" ] && { _log "dnsmasq: restarting service" "info"; /etc/init.d/dnsmasq restart; }
|
||||
[ "$SKIP_URL" = "1" ] && [ "$NEED_UPDATE" = "1" ] && {
|
||||
_log "main: outdated lists detected" "warn"
|
||||
_log "main: run 'update' to refresh data" "warn"
|
||||
}
|
||||
|
||||
_log "main: execution finished" "info"
|
||||
}
|
||||
|
||||
_wait_for_net() {
|
||||
_log "network: checking connectivity" "info"
|
||||
local t=1
|
||||
while [ "$t" -le 20 ]; do
|
||||
if ping -q -c 1 -W 2 "$PING_ADDR" >/dev/null 2>&1; then
|
||||
if nslookup "$TEST_DOMAIN" >/dev/null 2>&1; then
|
||||
_log "network: access confirmed" "info"
|
||||
return 0
|
||||
else
|
||||
_log "network: dns resolution failed" "warn"
|
||||
fi
|
||||
else
|
||||
_log "network: unreachable" "warn"
|
||||
fi
|
||||
sleep 2; t=$((t + 2))
|
||||
done
|
||||
_log "network: timeout: switching to offline mode" "warn"
|
||||
export SKIP_URL=1
|
||||
}
|
||||
|
||||
_stop() {
|
||||
_load_config_full || exit 1
|
||||
_log "Stopping Xray-Manager and flushing NFT table..." "info" "1"
|
||||
_log "main: stopping service" "info"
|
||||
_init_vars
|
||||
nft delete table ip "$TABLE" 2>/dev/null
|
||||
ip rule del fwmark "$TPROXY_MARK" table 110 2>/dev/null
|
||||
ip route del local default dev lo table 110 2>/dev/null
|
||||
rm -rf "$IPNET_DIR"/* "$DNSMASQ_DIR"/* "$CACHE_DIR"/*
|
||||
ip rule del fwmark "$TPROXY_MARK" table $RT_TABLE 2>/dev/null
|
||||
ip route del local default dev lo table $RT_TABLE 2>/dev/null
|
||||
/etc/init.d/dnsmasq restart
|
||||
_log "main: service stopped" "info"
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start) export SKIP_URL=0 FULL_LOAD=1; _run ;;
|
||||
restart) _stop; export SKIP_URL=0 FULL_LOAD=1; _run ;;
|
||||
reload) export SKIP_URL=1 FULL_LOAD=0; _run ;;
|
||||
update) export SKIP_URL=0 FULL_LOAD=0; _run ;;
|
||||
start) export SKIP_URL=0 FULL_LOAD=1; _run "start" ;;
|
||||
stop) _stop ;;
|
||||
*) echo "Usage: $0 {start|reload|update|stop|restart}" ;;
|
||||
restart) _stop; export SKIP_URL=0 FULL_LOAD=1; _run "restart" ;;
|
||||
reload) export SKIP_URL=1 FULL_LOAD=0; _run "reload" ;;
|
||||
update) export SKIP_URL=0 FULL_LOAD=0; _run "update" ;;
|
||||
*) echo "Usage: $0 {start|stop|restart|reload|update}"; exit 1 ;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user