🌴 Sync 2026-03-05 23:51:42

luci-app-jederproxy/root/usr/share/jederproxy/firewall_include.lua

@@ -0,0 +1,92 @@
+#!/usr/bin/lua
+local ucursor = require "luci.model.uci"
+
+local flush = [[# firewall include file to stop transparent proxy
+ip rule  del   table 100
+ip route flush table 100
+iptables-save -c | grep -v "JPROXY" | iptables-restore -c]]
+local header = [[# firewall include file to start transparent proxy
+ip route add local default dev lo table 100
+ip rule  add fwmark 0x2333        table 100
+
+iptables-restore -n <<-EOF
+*mangle
+:JPROXY_RULES - [0:0]
+:JPROXY_MARK_CONNECTIONS - [0:0]
+]]
+local rules = [[
+##### JPROXY_RULES #####
+# ignore traffic marked by JPROXY outbound
+-A JPROXY_RULES -m mark --mark 0x%x -j RETURN
+# connection-mark -> packet-mark
+-A JPROXY_RULES -j CONNMARK --restore-mark
+# ignore established connections
+-A JPROXY_RULES -m mark --mark 0x2333 -j RETURN
+
+# ignore traffic sent to reserved addresses
+-A JPROXY_RULES -m set --match-set jp_ipv4_rfc1918 dst -j RETURN
+
+# route traffic depends on whitelist/blacklists
+-A JPROXY_RULES -m set --match-set jp_ether_src_bypass src -j RETURN
+-A JPROXY_RULES -m set --match-set jp_ether_src_forward src -j JPROXY_MARK_CONNECTIONS
+
+-A JPROXY_RULES -m set --match-set jp_ipv4_dst_forward dst -j JPROXY_MARK_CONNECTIONS
+-A JPROXY_RULES -m set --match-set jp_ipv4_dst_bypass dst -j RETURN
+-A JPROXY_RULES -j JPROXY_MARK_CONNECTIONS
+
+##### JPROXY_MARK_CONNECTIONS #####
+# mark the first packet of the connection
+-A JPROXY_MARK_CONNECTIONS -p tcp --syn                      -j MARK --set-mark 0x2333
+-A JPROXY_MARK_CONNECTIONS -p udp -m conntrack --ctstate NEW -j MARK --set-mark 0x2333
+
+# packet-mark -> connection-mark
+-A JPROXY_MARK_CONNECTIONS -j CONNMARK --save-mark
+
+##### OUTPUT #####
+-A OUTPUT -p tcp -m addrtype --src-type LOCAL ! --dst-type LOCAL -j JPROXY_RULES
+
+##### PREROUTING #####
+# proxy traffic passing through this machine (other->other)
+-A PREROUTING -i %s -p tcp -m addrtype ! --src-type LOCAL ! --dst-type LOCAL -j JPROXY_RULES
+
+# hand over the marked package to TPROXY for processing
+-A PREROUTING -p tcp -m mark --mark 0x2333 -j TPROXY --on-ip 127.0.0.1 --on-port %d
+]]
+
+local rules_udp = [[
+##### OUTPUT #####
+-A OUTPUT -p udp -m addrtype --src-type LOCAL ! --dst-type LOCAL -j JPROXY_RULES
+
+##### PREROUTING #####
+# proxy traffic passing through this machine (other->other)
+-A PREROUTING -i %s -p udp -m addrtype ! --src-type LOCAL ! --dst-type LOCAL -j JPROXY_RULES
+
+# hand over the marked package to TPROXY for processing
+-A PREROUTING -p udp -m mark --mark 0x2333 -j TPROXY --on-ip 127.0.0.1 --on-port %d
+]]
+
+local footer = [[
+COMMIT
+EOF]]
+
+local proxy_section = ucursor:get_first("jederproxy", "general")
+local proxy = ucursor:get_all("jederproxy", proxy_section)
+
+print(flush)
+if proxy.transparent_proxy_enable ~= "1" then
+    do
+        return
+    end
+end
+if arg[1] == "enable" then
+    print(header)
+    print(string.format(rules, tonumber(proxy.mark),
+        proxy.lan_interface, proxy.tproxy_port))
+    if proxy.tproxy_enable_udp ~= "1" then
+        print(string.format(rules_udp
+            proxy.lan_interface, proxy.tproxy_port))
+    end
+    print(footer)
+    else
+    print("# arg[1] == " .. arg[1] .. ", not enable")
+end

luci-app-jederproxy/root/usr/share/jederproxy/firewall_include.ut

@@ -0,0 +1,144 @@
+#!/usr/bin/utpl
+{%
+    const uci = require("uci");
+    const fs = require("fs");
+
+    function iterate_file(filename, cb) {
+        let fd = fs.open(filename, "r");
+        if (!fd) {
+            warn(`Unable to open '${filename}': ${fs.error()}\n`);
+            return;
+        }
+
+        let line = null, count = 0;
+        while (!!(line = trim(fd.read("line")))) {
+            if (ord(line) == 35)  // skip lines which start with '#'
+                continue;
+
+            cb(line);
+
+            count++;
+        }
+        fd.close();
+        return count;
+    }
+
+    const cursor = uci.cursor();
+    cursor.load("jederproxy");
+    const config = cursor.get_all("jederproxy");
+    const general = config[filter(keys(config), k => config[k][".type"] == "general")[0]];
+    const jp_ether_src_forward = uniq(map(filter(keys(config), k => config[k][".type"] == "lan_hosts" && config[k].bypassed == "0"), k => config[k].macaddr) || []);
+    const jp_ether_src_bypass = uniq(map(filter(keys(config), k => config[k][".type"] == "lan_hosts" && config[k].bypassed == "1"), k => config[k].macaddr) || []);
+    const uids_direct = uniq(general.whitelist_process_uids || []);
+    const gids_direct = uniq(general.whitelist_process_gids || []);
+    const wan_bypass_rules = general.wan_bypass_rules || [];
+    const wan_forward_rules = general.wan_forward_rules || [];
+    const enable_udp = general.tproxy_enable_udp || "";
+    iterate_file(general.wan_bypass_rule_file || "/dev/null", line => push(wan_bypass_rules, line));
+    iterate_file(general.wan_forward_rule_file || "/dev/null", line => push(wan_forward_rules, line));
+    // push(wan_bypass_rules, split(general.fast_dns, ":")[0]);
+    // push(wan_forward_rules, split(general.secure_dns, ":")[0]);
+%}
+    set jp_ether_src_bypass {
+        type ether_addr
+        size 65536
+{% if (length(jp_ether_src_bypass) > 0): %}
+        elements = { {{ join(", ", jp_ether_src_bypass) }} }
+{% endif %}
+    }
+
+    set jp_ether_src_forward {
+        type ether_addr
+        size 65536
+{% if (length(jp_ether_src_forward) > 0): %}
+        elements = { {{ join(", ", jp_ether_src_forward) }} }
+{% endif %}
+    }
+
+    set jp_ipv4_rfc1918 {
+        type ipv4_addr
+        size 65536
+        flags interval
+        elements = {
+            0.0.0.0/8,
+            10.0.0.0/8,
+            100.64.0.0/10,
+            127.0.0.0/8,
+            169.254.0.0/16,
+            172.16.0.0/12,
+            192.0.0.0/24,
+            192.0.2.0/24,
+            192.88.99.0/24,
+            192.168.0.0/16,
+            198.18.0.0/15,
+            198.51.100.0/24,
+            203.0.113.0/24,
+            224.0.0.0/4,
+            233.252.0.0/24,
+            240.0.0.0/4
+        }
+        auto-merge
+    }
+
+    set jp_ipv4_dst_bypass {
+        type ipv4_addr
+        size 65536
+        flags interval
+        elements = { {{ join(", ", wan_bypass_rules)}} }
+        auto-merge
+    }
+
+    set jp_ipv4_dst_forward {
+        type ipv4_addr
+        size 65536
+        flags interval
+        elements = { {{ join(", ", wan_forward_rules)}} }
+        auto-merge
+    }
+
+    chain jproxy_rules {
+{% if (length(uids_direct) > 0): %}
+        meta skuid { {{ join(", ", uids_direct) }} } return comment "ignore traffic from processes owned by specific UIDs"
+{% endif %}
+{% if (length(gids_direct) > 0): %}
+        meta skgid { {{ join(", ", gids_direct) }} } return comment "ignore traffic from processes owned by specific GIDs"
+{% endif %}
+
+        mark {{ sprintf("0x%08x", general.packet_mark_id) }} counter return comment "ignore outbound connections initiated by jederproxy"
+        counter meta mark set ct mark comment "connection-mark -> packet-mark"
+        mark 0x2333 counter return comment "ignore established connections"
+
+        ip daddr @jp_ipv4_rfc1918 return comment "ignore traffic sent to reserved IP address/networks"
+        ether saddr @jp_ether_src_bypass return comment "ignore traffic from specific sources (by macaddr)"
+        ether saddr @jp_ether_src_forward jump jproxy_mark_connection comment "enforce proxy from specific sources (by macaddr)"
+        ip daddr @jp_ipv4_dst_forward jump jproxy_mark_connection comment "enforce proxy to specific IP address/networks"
+        ip daddr @jp_ipv4_dst_bypass return comment "ignore traffic sent to specific IP address/networks"
+
+        jump jproxy_mark_connection
+    }
+
+    chain jproxy_mark_connection {
+        tcp flags & (fin|syn|rst|ack) == syn counter meta mark set 0x2333 comment "mark the first packet of TCP connections"
+        ip protocol udp ct state new counter meta mark set 0x2333 comment "mark the first packet of UDP connections"
+        counter ct mark set mark comment "packet-mark -> connection-mark"
+    }
+
+    chain jproxy_prerouting {
+        type filter hook prerouting priority filter; policy accept;
+
+        iifname "{{ general.lan_interface }}" ip protocol {tcp, udp} fib saddr type != local fib daddr type != local counter jump jproxy_rules comment "proxy TCP/UDP traffic passing through this router (other->other)"
+
+        meta l4proto tcp meta mark 0x2333 tproxy ip to 127.0.0.1:{{ general.tproxy_port }} counter accept comment "send marked TCP packets to jederproxy"
+{% if (enable_udp == "1"): %}
+        meta l4proto udp meta mark 0x2333 tproxy ip to 127.0.0.1:{{ general.tproxy_port }} counter accept comment "send marked UDP packets to jederproxy"
+{% endif %}
+
+    }
+
+    chain jproxy_output {
+        type route hook output priority filter; policy accept;
+        ip protocol tcp fib saddr type local fib daddr type != local counter jump jproxy_rules comment "Proxy TCP traffic from router itself"
+{% if (enable_udp == "1"): %}
+        ip protocol udp fib saddr type local fib daddr type != local counter jump jproxy_rules comment "Proxy UDP traffic from router itself"
+{% endif %}
+    }

luci-app-jederproxy/root/usr/share/jederproxy/gen_ipset_rules.lua

@@ -0,0 +1,78 @@
+#!/usr/bin/lua
+
+local io = require("io")
+local ucursor = require "luci.model.uci"
+local proxy_section = ucursor:get_first("jederproxy", "general")
+local proxy = ucursor:get_all("jederproxy", proxy_section)
+local gen_ipset_rules_extra = dofile("/usr/share/jederproxy/gen_ipset_rules_extra.lua")
+
+local create_ipset_rules = [[create jp_ether_src_bypass hash:mac hashsize 64
+create jp_ether_src_forward hash:mac hashsize 64
+create jp_ipv4_rfc1918 hash:net hashsize 64
+create jp_ipv4_dst_bypass hash:net hashsize 64
+create jp_ipv4_dst_forward hash:net hashsize 64]]
+
+local function create_ipset()
+    print(create_ipset_rules)
+end
+
+local function split_ipv4_host_port(val, port_default)
+    local found, _, ip, port = val:find("([%d.]+):(%d+)")
+    if found == nil then
+        return val, tonumber(port_default)
+    else
+        return ip, tonumber(port)
+    end
+end
+
+local function lan_access_control()
+    ucursor:foreach("xray", "lan_hosts", function(v)
+        if v.bypassed == '0' then
+            print(string.format("add jp_ether_src_forward %s", v.macaddr))
+        else
+            print(string.format("add jp_ether_src_bypass %s", v.macaddr))
+        end
+    end)
+end
+
+local function iterate_list(ln, set_name)
+    local ip_list = proxy[ln]
+    if ip_list == nil then
+        return
+    end
+    for _, line in ipairs(ip_list) do
+        print(string.format("add %s %s", set_name, line))
+    end
+end
+
+local function iterate_file(fn, set_name)
+    if fn == nil then
+        return
+    end
+    local f = io.open(fn)
+    if f == nil then
+        return
+    end
+    for line in io.lines(fn) do
+        if line ~= "" then
+            print(string.format("add %s %s", set_name, line))
+        end
+    end
+    f:close()
+end
+
+local function dns_ips()
+    local fast_dns_ip, fast_dns_port = split_ipv4_host_port(proxy.fast_dns, 53)
+    local secure_dns_ip, secure_dns_port = split_ipv4_host_port(proxy.secure_dns, 53)
+    print(string.format("add jp_ipv4_dst_bypass %s", fast_dns_ip))
+    print(string.format("add jp_ipv4_dst_forward %s", secure_dns_ip))
+end
+
+create_ipset()
+dns_ips()
+lan_access_control()
+iterate_list("wan_bypass_rules", "jp_ipv4_dst_bypass")
+iterate_file(proxy.wan_bypass_rule_file or "/dev/null", "jp_ipv4_dst_bypass")
+iterate_list("wan_forward_rules", "jp_ipv4_dst_forward")
+iterate_file(proxy.wan_forward_rule_file or "/dev/null", "jp_ipv4_dst_forward")
+gen_ipset_rules_extra(proxy)

luci-app-jederproxy/root/usr/share/jederproxy/gen_ipset_rules_extra_normal.lua

@@ -0,0 +1,23 @@
+#!/usr/bin/lua
+
+local special_purpose_rules = [[add jp_ipv4_rfc1918 255.255.255.255
+add jp_ipv4_rfc1918 0.0.0.0/8
+add jp_ipv4_rfc1918 10.0.0.0/8
+add jp_ipv4_rfc1918 100.64.0.0/10
+add jp_ipv4_rfc1918 127.0.0.0/8
+add jp_ipv4_rfc1918 169.254.0.0/16
+add jp_ipv4_rfc1918 172.16.0.0/12
+add jp_ipv4_rfc1918 192.0.0.0/24
+add jp_ipv4_rfc1918 192.0.2.0/24
+add jp_ipv4_rfc1918 192.88.99.0/24
+add jp_ipv4_rfc1918 192.168.0.0/16
+add jp_ipv4_rfc1918 198.18.0.0/15
+add jp_ipv4_rfc1918 198.51.100.0/24
+add jp_ipv4_rfc1918 203.0.113.0/24
+add jp_ipv4_rfc1918 224.0.0.0/4
+add jp_ipv4_rfc1918 233.252.0.0/24
+add jp_ipv4_rfc1918 240.0.0.0/4]]
+
+return function(proxy)
+    print(special_purpose_rules)
+end

luci-app-jederproxy/root/usr/share/luci/menu.d/luci-app-jederproxy.json

@@ -0,0 +1,17 @@
+{
+    "admin/services/jederproxy": {
+        "title": "Jederproxy",
+        "action": {
+            "type": "view",
+            "path": "jederproxy"
+        },
+        "depends": {
+            "acl": [
+                "luci-app-jederproxy"
+            ],
+            "uci": {
+                "jederproxy": true
+            }
+        }
+    }
+}

luci-app-jederproxy/root/usr/share/rpcd/acl.d/luci-app-jederproxy.json

@@ -0,0 +1,25 @@
+{
+    "luci-app-jederproxy": {
+        "description": "Grant access to jederproxy configurations",
+        "read": {
+            "ubus": {
+                "luci": [
+                    "getInitList",
+                    "setInitAction"
+                ]
+            },
+            "uci": [
+                "jederproxy"
+            ],
+            "file": {
+                "/etc/init.d/jederproxy": [ "exec" ],
+                "/var/run/jederproxy.pid": [ "read" ]
+            }
+        },
+        "write": {
+            "uci": [
+                "jederproxy"
+            ]
+        }
+    }
+}