🌴 Sync 2026-03-05 23:51:42

ShadowVPN/files/client_down.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+#
+# Copyright (C) 2015 OpenWrt-dist
+# Copyright (C) 2015 Jian Chang <aa65535@live.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+# This script will be executed when client is down.
+# All key value pairs in ShadowVPN config file will be passed to this script
+# as environment variables, except password.
+
+PID=$(cat $pidfile 2>/dev/null)
+loger() {
+	echo "$(date '+%c') down.$1 ShadowVPN[$PID] $2"
+}
+
+# Get uci setting
+route_mode=$(uci get shadowvpn.@shadowvpn[-1].route_mode_save 2>/dev/null)
+
+# Turn off NAT over VPN
+iptables -t nat -D POSTROUTING -o $intf -j MASQUERADE
+iptables -D FORWARD -i $intf -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -D FORWARD -o $intf -j ACCEPT
+loger notice "Turn off NAT over $intf"
+
+# Change routing table
+ip route del $server
+if [ "$route_mode" != 2 ]; then
+	ip route del 0.0.0.0/1
+	ip route del 128.0.0.0/1
+	loger notice "Default route changed to original route"
+fi
+
+# Remove route rules
+if [ -f /tmp/shadowvpn_routes ]; then
+	sed -e "s/^/route del /" /tmp/shadowvpn_routes | ip -batch -
+	loger notice "Route rules have been removed"
+fi
+
+rm -rf /tmp/shadowvpn_routes
+
+loger info "Script $0 completed"

ShadowVPN/files/client_up.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+#
+# Copyright (C) 2015 OpenWrt-dist
+# Copyright (C) 2015 Jian Chang <aa65535@live.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+# This script will be executed when client is up.
+# All key value pairs in ShadowVPN config file will be passed to this script
+# as environment variables, except password.
+
+PID=$(cat $pidfile 2>/dev/null)
+loger() {
+	echo "$(date '+%c') up.$1 ShadowVPN[$PID] $2"
+}
+
+# Configure IP address and MTU of VPN interface
+ip addr add $net dev $intf
+ip link set $intf mtu $mtu
+ip link set $intf up
+
+# Get original gateway
+gateway=$(ip route show 0/0 | sed -e 's/.* via \([^ ]*\).*/\1/')
+loger info "The default gateway: via $gateway"
+
+# Get uci setting
+route_mode=$(uci get shadowvpn.@shadowvpn[-1].route_mode 2>/dev/null)
+route_file=$(uci get shadowvpn.@shadowvpn[-1].route_file 2>/dev/null)
+
+# Save uci setting
+uci set shadowvpn.@shadowvpn[-1].route_mode_save=$route_mode
+uci commit shadowvpn
+
+# Turn on NAT over VPN
+iptables -t nat -A POSTROUTING -o $intf -j MASQUERADE
+iptables -I FORWARD 1 -i $intf -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -I FORWARD 1 -o $intf -j ACCEPT
+loger notice "Turn on NAT over $intf"
+
+# Change routing table
+suf="dev $intf"
+ip route add $server via $gateway
+if [ "$route_mode" != 2 ]; then
+	ip route add 0.0.0.0/1 dev $intf
+	ip route add 128.0.0.0/1 dev $intf
+	loger notice "Default route changed to VPN tun"
+	suf="via $gateway"
+fi
+
+# Load route rules
+if [ "$route_mode" != 0 -a -f "$route_file" ]; then
+	grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}" $route_file >/tmp/shadowvpn_routes
+	sed -e "s/^/route add /" -e "s/$/ $suf/" /tmp/shadowvpn_routes | ip -batch -
+	loger notice "Route rules have been loaded"
+fi
+
+loger info "Script $0 completed"

ShadowVPN/files/shadowvpn.config

@@ -0,0 +1,12 @@
+
+config shadowvpn
+	option enable '0'
+	option server '127.0.0.1'
+	option port '1123'
+	option password 'my_password'
+	option concurrency '1'
+	option net '10.7.0.2/24'
+	option mtu '1432'
+	option intf 'tun0'
+	option route_mode '1'
+	option route_file '/etc/chinadns_chnroute.txt'

ShadowVPN/files/shadowvpn.hotplug

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+[ "$ACTION" = ifup ] || exit 0
+
+device=$(ip route show 0/0 | sed -e 's/.* dev \([^ ]*\).*/\1/')
+
+[ -z "$device" -o "$DEVICE" = "$device" ] || exit 0
+
+/etc/init.d/shadowvpn restart
+logger -t ShadowVPN "Restart ShadowVPN due to ifup of $INTERFACE ($DEVICE)"

ShadowVPN/files/shadowvpn.init

@@ -0,0 +1,71 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (C) 2015 OpenWrt-dist
+# Copyright (C) 2015 Jian Chang <aa65535@live.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+START=90
+STOP=15
+
+CONFIG=/var/etc/shadowvpn.conf
+
+start_vpn() {
+	local enable server port password concurrency mtu intf
+	config_get_bool enable $1 enable
+	[ "$enable" = 1 ] || return 0
+	config_get server $1 server
+	config_get port $1 port
+	config_get user_token $1 user_token
+	config_get password $1 password
+	config_get concurrency $1 concurrency
+	config_get net $1 net
+	config_get mtu $1 mtu
+	config_get intf $1 intf
+	: ${server:?}
+	: ${port:?}
+	: ${password:?}
+	: ${user_token:=0000000000000000}
+	mkdir -p $(dirname $CONFIG)
+	cat <<-EOF >$CONFIG
+		server=$server
+		port=$port
+		password=$password
+		mode=client
+		concurrency=1
+		net=${net:-10.7.0.2/24}
+		mtu=${mtu:-1432}
+		intf=${intf:-tun0}
+		up=/etc/shadowvpn/client_up.sh
+		down=/etc/shadowvpn/client_down.sh
+		pidfile=/var/run/shadowvpn.pid
+		logfile=/var/log/shadowvpn.log
+EOF
+	if [ "$user_token" != "0000000000000000" ]; then
+		echo "user_token=$user_token" >>$CONFIG
+	fi
+	/usr/bin/shadowvpn -c $CONFIG -s start
+}
+
+start() {
+	config_load shadowvpn
+	config_foreach start_vpn shadowvpn
+}
+
+stop() {
+	/usr/bin/shadowvpn -c $CONFIG -s stop
+}
+
+boot() {
+	if [ ! -c "/dev/net/tun" ]; then
+		mkdir -p /dev/net
+		mknod /dev/net/tun c 10 200
+		chmod 0666 /dev/net/tun
+	fi
+	until ip route show 0/0 | grep -q "^default"; do
+		sleep 1
+	done
+	start
+}