🌴 Sync 2026-03-05 23:51:42

mnh/Makefile

@@ -0,0 +1,58 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=mnh
+PKG_VERSION:=0.7.3
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/hzyitc/mnh/tar.gz/v${PKG_VERSION}?
+PKG_HASH:=skip
+
+PKG_MAINTAINER:=HZY
+PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_BUILD_DEPENDS:=golang/host
+PKG_BUILD_PARALLEL:=1
+PKG_USE_MIPS16:=0
+
+GO_PKG:=github.com/hzyitc/mnh
+
+include $(INCLUDE_DIR)/package.mk
+include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk
+
+define Package/mnh
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=NAT hole punching tool
+  URL:=https://github.com/hzyitc/mnh
+  DEPENDS:= $(GO_ARCH_DEPENDS)
+endef
+
+define Package/mnh/description
+  mnh is a NAT hole punching tool that allows peers directly connect to your 
+  NATed server without client. 
+endef
+
+define Package/mnh/conffiles
+/etc/config/mnh
+endef
+
+define Package/mnh/install
+	$(call GoPackage/Package/Install/Bin,$(PKG_INSTALL_DIR))
+
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/mnh $(1)/usr/bin/mnh
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/mnh.init $(1)/etc/init.d/mnh
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/mnh.config $(1)/etc/config/mnh
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/mnh.defaults $(1)/etc/uci-defaults/99-mnh
+	$(INSTALL_DIR) $(1)/usr/share/mnh/
+	$(INSTALL_BIN) ./files/firewall3.include $(1)/usr/share/mnh/firewall3.include
+	$(INSTALL_BIN) ./files/firewall4.include $(1)/usr/share/mnh/firewall4.include
+	$(INSTALL_BIN) ./files/hook.sh $(1)/usr/share/mnh/hook.sh
+endef
+
+$(eval $(call BuildPackage,mnh))

mnh/files/firewall3.include

@@ -0,0 +1,44 @@
+#!/bin/sh
+
+. /lib/functions/network.sh
+
+iptables_insert() {
+	local chain="$1"
+	local position="$2"
+	shift 2
+
+	local line="$(
+		iptables -t "filter" --line-numbers -n -L "$chain" \
+		| wc \
+		| awk '{print $1 - 2}'
+	)"
+
+	[[ "$position" -lt 0 ]] && position=$(( line + 1 + position + 1 ))
+
+	[[ "$position" -lt 1 ]] && position=1
+	[[ "$position" -gt "$(( line + 1 ))" ]] && position="$(( line + 1 ))"
+
+	iptables -t "filter" -I "$chain" $position $@
+}
+
+iptables_check_and_insert() {
+	local chain="$1"
+	local position="$2"
+	shift 2
+
+	iptables -t "filter" -C "$chain" $@ 2>/dev/null \
+	|| iptables_insert "$chain" "$position" $@
+}
+
+main() {
+	iptables -t "filter" -N "MNH" 2>/dev/null
+
+	network_find_wan wan_iface
+	network_get_device wan_device "$wan_iface"
+	wan_zone=$(fw3 -q device "$wan_device")
+	
+	# before REJECT
+	iptables_check_and_insert "zone_${wan_zone}_input" -2 -j MNH
+}
+
+main

mnh/files/firewall4.include

@@ -0,0 +1,45 @@
+#!/bin/sh
+
+. /lib/functions/network.sh
+
+nft_insert() {
+	local chain="$1"
+	local position="$2"
+	shift 2
+
+	local line="$(
+		nft list chain inet fw4 "$chain" \
+		| wc \
+		| awk '{print $1 - 4}'
+	)"
+
+	[[ "$position" -lt 0 ]] && position=$(( line + 1 + position + 1 ))
+
+	[[ "$position" -lt 1 ]] && position=1
+	[[ "$position" -gt "$(( line + 1 ))" ]] && position="$(( line + 1 ))"
+
+	nft insert rule inet fw4 "$chain" index $(( position - 1 )) $@
+}
+
+nft_check_and_insert() {
+	local chain="$1"
+	local position="$2"
+	shift 2
+
+	nft list chain inet fw4 "$chain" | grep -q "$*" 2>/dev/null \
+	|| nft_insert "$chain" "$position" $@
+}
+
+main() {
+	nft add chain inet fw4 "mnh"
+
+	network_find_wan wan_iface
+	network_get_device wan_device "$wan_iface"
+	# avoid dead lock in `fw4 reload`
+	wan_zone=$(QUIET=1 ACTION=device OBJECT=$wan_device utpl -S /usr/share/firewall4/main.uc)
+
+	# before REJECT
+	nft_check_and_insert "input_${wan_zone}" -2 jump "mnh" comment \"Hook into mnh input chain\"
+}
+
+main

mnh/files/hook.sh

@@ -0,0 +1,70 @@
+#!/bin/sh
+
+# Global variable
+name="$1"
+type="$2"
+event="$3"
+errmsg="$4"
+port="$5"
+addr="$6"
+
+iptables_check_and_append() {
+	iptables -t "filter" -C "MNH" $@ 2>/dev/null \
+	|| iptables -t "filter" -A "MNH" $@
+}
+
+insert_iptables_rule() {
+	iptables_check_and_append -p $type -m $type --dport $port -j ACCEPT
+}
+
+remove_iptables_rule() {
+	iptables -t "filter" -D "MNH" -p $type -m $type --dport $port -j ACCEPT
+}
+
+nft_check_and_append() {
+	nft list chain inet fw4 "mnh" | grep -q "$*" 2>/dev/null \
+	|| nft add rule inet fw4 "mnh" $@
+}
+
+insert_nft_rule() {
+	nft_check_and_append $type dport $port accept
+}
+
+remove_nft_rule() {
+	handle="$(
+		nft list chain inet fw4 "mnh" \
+		| grep "$type dport $port accept" \
+		| sed -E 's/^.*# handle ([0-9]+)$/\1/'
+	)"
+	nft rule delete inet fw4 "mnh" handle $handle
+}
+
+main() {
+	cat <<-EOF >"/var/run/mnh/$name"
+		${event}
+		${errmsg}
+		${port}
+		${addr}
+	EOF
+
+	case "$event" in
+		success)
+			if fw4 >/dev/null; then
+				insert_nft_rule
+			else
+				insert_iptables_rule
+			fi
+			;;
+
+		disconnected)
+			if fw4 >/dev/null; then
+				remove_nft_rule
+			else
+				remove_iptables_rule
+			fi
+			;;
+
+	esac
+}
+
+main

mnh/files/mnh.config

@@ -0,0 +1,9 @@
+config instance
+	option disabled '1'
+	option type 'tcp'
+	option server 'server.com'
+	option id 'demo'
+	option port '10000'
+	option protocol 'mnh'
+	option mode 'proxy'
+	option service '127.0.0.1:80'

mnh/files/mnh.defaults

@@ -0,0 +1,38 @@
+#!/bin/sh
+[ ! -f "/usr/share/ucitrack/luci-app-mnh.json" ] && {
+    cat > /usr/share/ucitrack/luci-app-mnh.json << EEOF
+{
+    "config": "mnh",
+    "init": "mnh"
+}
+EEOF
+}
+
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@mnh[-1]
+	add ucitrack mnh
+	set ucitrack.@mnh[-1].init=mnh
+	commit ucitrack
+EOF
+
+if fw4 >/dev/null; then
+	uci -q batch <<-EOF
+		delete firewall.mnh
+		set firewall.mnh=include
+		set firewall.mnh.type=script
+		set firewall.mnh.path=/usr/share/mnh/firewall4.include
+		commit firewall
+	EOF
+else
+	uci -q batch <<-EOF
+		delete firewall.mnh
+		set firewall.mnh=include
+		set firewall.mnh.type=script
+		set firewall.mnh.path=/usr/share/mnh/firewall3.include
+		set firewall.mnh.family=ipv4
+		set firewall.mnh.reload=1
+		commit firewall
+	EOF
+fi
+
+exit 0

mnh/files/mnh.init

@@ -0,0 +1,72 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+START=99
+
+NAME=mnh
+PROG=/usr/bin/$NAME
+
+_err() {
+	echo "$*" >&2
+	logger -p daemon.err -t "$NAME" "$*"
+}
+
+parse() {
+	local name="$1"
+	local type="$2"
+	
+	local disabled type server id port protocol mode service
+	uci_validate_section "$NAME" "$type" "$name" \
+		'disabled:bool:0' \
+		'type:or("tcp","udp")' \
+		'server:regex("[a-zA-Z0-9\-]*?(\.[a-zA-Z0-9\-]*)*(\:[0-9]*)?")' \
+		'id:string' \
+		'port:port:0' \
+		'protocol:string:mnh' \
+		'mode:string:proxy' \
+		'service:regex("[a-zA-Z0-9\-]*?(\.[a-zA-Z0-9\-]*)*\:[0-9]*")' \
+		|| return 1
+
+	[ "$disabled" = 0 ] || return 1
+
+	mkdir -p "/var/run/mnh"
+	touch "/var/run/mnh/$name"
+	chown nobody "/var/run/mnh/$name"
+
+	if fw4 >/dev/null; then
+		nft list chain inet fw4 "mnh" >/dev/null 2>&1 || fw4 reload
+	else
+		iptables -t "filter" -L "MNH" >/dev/null 2>&1 || fw3 reload
+	fi
+
+	local hook="/usr/share/mnh/hook.sh '$name' '$type' '%e' '%m' '%p' '%a'"
+
+	procd_open_instance "$name"
+	procd_set_param command "$PROG" "$type" --routerForward none --event-hook "$hook" --server "$server" --mode "$mode" --service "$service" --port "$port" --id "$id"
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	# procd_set_param user "nobody"
+	# [ $respawn -eq 1 ] && procd_set_param respawn
+	procd_close_instance
+}
+
+start_service() {
+	config_load "$NAME"
+	config_foreach parse instance
+}
+
+service_triggers() {
+	procd_add_reload_trigger "$NAME"
+}
+
+stop_service() {
+	if fw4 >/dev/null; then
+		nft flush chain inet fw4 "mnh" 2>/dev/null
+	else
+		iptables -t "filter" -F "MNH" 2>/dev/null
+	fi
+}
+
+reload_service() {
+	restart
+}