mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-27 03:12:52 +08:00
300 lines
11 KiB
Bash
Executable File
300 lines
11 KiB
Bash
Executable File
#!/bin/sh /etc/rc.common
|
|
# FlowProxy - Traffic Diversion Service
|
|
|
|
START=99
|
|
STOP=10
|
|
USE_PROCD=1
|
|
|
|
NAME="flowproxy"
|
|
UCI_CONFIG="flowproxy"
|
|
LOG_FILE="/var/log/flowproxy.log"
|
|
NFT_CONF="/tmp/flowproxy/nft.conf"
|
|
GENERATE_SCRIPT="/usr/share/flowproxy/generate_nft.sh"
|
|
STATE_FILE="/var/run/flowproxy.running"
|
|
|
|
get_level_weight() {
|
|
case "$1" in
|
|
debug) echo 0 ;;
|
|
info) echo 1 ;;
|
|
warn) echo 2 ;;
|
|
error) echo 3 ;;
|
|
*) echo 1 ;;
|
|
esac
|
|
}
|
|
|
|
log_msg() {
|
|
local level="$1"; shift
|
|
local msg="$*"
|
|
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
|
|
# 等级过滤
|
|
local conf_level=$(uci -q get "$UCI_CONFIG.global.log_level" || echo "info")
|
|
local conf_weight=$(get_level_weight "$conf_level")
|
|
local msg_weight=$(get_level_weight "$level")
|
|
[ "$msg_weight" -lt "$conf_weight" ] && return
|
|
|
|
# 简单的日志截断逻辑，防止日志无限增长
|
|
# 读取配置的大小限制，默认 1024KB
|
|
local max_size=$(uci -q get "$UCI_CONFIG.global.log_size" || echo 1024)
|
|
local current_size=$(du -k "$LOG_FILE" 2>/dev/null | cut -f1)
|
|
if [ "${current_size:-0}" -gt "$max_size" ]; then
|
|
mv "$LOG_FILE" "$LOG_FILE.old"
|
|
touch "$LOG_FILE"
|
|
fi
|
|
|
|
echo "[$timestamp] [$level] $msg" >> "$LOG_FILE"
|
|
}
|
|
|
|
check_env() {
|
|
# 检测核心二进制工具是否存在
|
|
if ! command -v nft >/dev/null 2>&1; then
|
|
log_msg error "nftables binary not found"
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
check_config() {
|
|
local proxy_server_ip_addr=$(uci -q get "$UCI_CONFIG.global.proxy_server_ip_addr")
|
|
[ -z "$proxy_server_ip_addr" ] && { log_msg error "proxy_server_ip_addr not configured"; return 1; }
|
|
return 0
|
|
}
|
|
|
|
apply_nft_rules() {
|
|
log_msg info "Generating nftables configuration..."
|
|
local conf_level=$(uci -q get "$UCI_CONFIG.global.log_level" || echo "info")
|
|
|
|
mkdir -p "$(dirname "$NFT_CONF")"
|
|
if [ -x "$GENERATE_SCRIPT" ]; then
|
|
# 传递日志等级并捕获 stderr 到临时文件
|
|
local err_file="/tmp/flowproxy/gen_err.tmp"
|
|
FLOWPROXY_LOG_LEVEL="$conf_level" "$GENERATE_SCRIPT" >/dev/null 2> "$err_file"
|
|
local ret=$?
|
|
|
|
# 将脚本的输出记录到日志
|
|
if [ -s "$err_file" ]; then
|
|
while read -r line; do
|
|
log_msg debug "Script: $line"
|
|
done < "$err_file"
|
|
rm -f "$err_file"
|
|
fi
|
|
|
|
if [ $ret -eq 0 ]; then
|
|
log_msg info "Applying nftables rules from $NFT_CONF"
|
|
# 确保内核支持 inet 表
|
|
nft delete table inet flowproxy 2>/dev/null
|
|
if nft -f "$NFT_CONF"; then
|
|
return 0
|
|
else
|
|
log_msg error "nftables rules application failed (syntax error)"
|
|
return 1
|
|
fi
|
|
else
|
|
log_msg error "Failed to generate nftables config"
|
|
return 1
|
|
fi
|
|
else
|
|
log_msg error "Generator script $GENERATE_SCRIPT not found or not executable"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
add_route() {
|
|
local proxy_server_ip_addr=$(uci -q get "$UCI_CONFIG.global.proxy_server_ip_addr")
|
|
local interface=$(uci -q get "$UCI_CONFIG.global.interface" || echo "br-lan")
|
|
local traffic_mark=$(uci -q get "$UCI_CONFIG.global.traffic_mark" || echo "0x666")
|
|
local routing_table=$(uci -q get "$UCI_CONFIG.global.routing_table" || echo "888")
|
|
local rule_priority=$(uci -q get "$UCI_CONFIG.global.rule_priority" || echo "1000")
|
|
|
|
# 1. 先尝试用旧记录清理一次，防止由于配置变更导致的残留
|
|
delete_route "quiet"
|
|
|
|
log_msg info "Setting up routing table $routing_table and rule for mark $traffic_mark with priority $rule_priority..."
|
|
|
|
# 2. 记录当前使用的标记值、路由表 ID 和优先级
|
|
echo "$traffic_mark:$routing_table:$rule_priority" > "/var/run/flowproxy.mark"
|
|
|
|
# 3. 再次确保新标记和表的规则是干净的
|
|
while ip rule del fwmark "$traffic_mark" lookup "$routing_table" 2>/dev/null; do :; done
|
|
ip route flush table "$routing_table" 2>/dev/null
|
|
|
|
# 4. 添加路由和策略
|
|
local err
|
|
ip route add default via "$proxy_server_ip_addr" dev "$interface" table "$routing_table" 2>/dev/null
|
|
err=$(ip rule add fwmark "$traffic_mark" lookup "$routing_table" priority "$rule_priority" 2>&1)
|
|
if [ $? -eq 0 ]; then
|
|
log_msg info "Route added: via $proxy_server_ip_addr dev $interface table $routing_table for mark $traffic_mark with priority $rule_priority"
|
|
else
|
|
log_msg error "Failed to add ip rule: $err"
|
|
fi
|
|
}
|
|
|
|
delete_route() {
|
|
local traffic_mark routing_table rule_priority
|
|
local quiet="$1"
|
|
|
|
# 1. 获取两组清理目标：旧值(记录文件) 和 新值(当前UCI)
|
|
local old_mark="" old_table="" old_prio=""
|
|
if [ -f "/var/run/flowproxy.mark" ]; then
|
|
local saved_val=$(cat "/var/run/flowproxy.mark")
|
|
old_mark=$(echo "$saved_val" | cut -d':' -f1)
|
|
old_table=$(echo "$saved_val" | cut -d':' -f2)
|
|
old_prio=$(echo "$saved_val" | cut -d':' -f3)
|
|
[ "$quiet" != "quiet" ] && rm -f "/var/run/flowproxy.mark"
|
|
fi
|
|
|
|
local curr_mark=$(uci -q get "$UCI_CONFIG.global.traffic_mark" || echo "0x666")
|
|
local curr_table=$(uci -q get "$UCI_CONFIG.global.routing_table" || echo "888")
|
|
local curr_prio=$(uci -q get "$UCI_CONFIG.global.rule_priority" || echo "1000")
|
|
|
|
[ "$quiet" != "quiet" ] && log_msg info "Cleaning up FlowProxy routes (Atomic Mode)..."
|
|
|
|
# 2. 核心清理函数：只清理带 fwmark 且指向特定 table 的规则
|
|
safe_del_rule() {
|
|
local m="$1" t="$2" p="$3"
|
|
[ -z "$m" ] || [ -z "$t" ] && return
|
|
log_msg debug "Attempting cleanup: mark=$m, table=$t, priority=${p:-any}"
|
|
# 精准清理 (带优先级)
|
|
[ -n "$p" ] && while ip rule del fwmark "$m" lookup "$t" priority "$p" 2>/dev/null; do
|
|
log_msg debug "Removed stale ip rule: mark $m lookup $t priority $p"
|
|
done
|
|
# 模糊清理 (不带优先级，防止配置中途被手动改动)
|
|
while ip rule del fwmark "$m" lookup "$t" 2>/dev/null; do
|
|
log_msg debug "Removed stale ip rule (fuzzy): mark $m lookup $t"
|
|
done
|
|
# 清空路由表
|
|
ip route flush table "$t" 2>/dev/null
|
|
log_msg debug "Flushed routing table $t"
|
|
}
|
|
|
|
# 执行清理：先清旧值，再清当前值 (防止残留)
|
|
safe_del_rule "$old_mark" "$old_table" "$old_prio"
|
|
[ "$old_mark" != "$curr_mark" ] || [ "$old_table" != "$curr_table" ] && \
|
|
safe_del_rule "$curr_mark" "$curr_table" "$curr_prio"
|
|
}
|
|
|
|
delete_nft() {
|
|
nft delete table inet flowproxy 2>/dev/null
|
|
log_msg info "Removed nftables table 'flowproxy'"
|
|
}
|
|
|
|
setup_dns() {
|
|
local enabled=$(uci -q get "$UCI_CONFIG.global.enabled" || echo 0)
|
|
local dns_proxy_enabled=$(uci -q get "$UCI_CONFIG.global.dns_proxy_enabled" || echo 0)
|
|
local proxy_server_dns_port=$(uci -q get "$UCI_CONFIG.global.proxy_server_dns_port" || echo 5353)
|
|
local proxy_server_ip_addr=$(uci -q get "$UCI_CONFIG.global.proxy_server_ip_addr")
|
|
|
|
# Only apply DNS proxy if BOTH main service and DNS proxy are enabled
|
|
if [ "$enabled" -eq 0 ] || [ "$dns_proxy_enabled" -eq 0 ]; then
|
|
cleanup_dns
|
|
return 0
|
|
fi
|
|
|
|
[ -z "$proxy_server_ip_addr" ] && { log_msg error "proxy_server_ip_addr not configured, cannot setup DNS"; return 1; }
|
|
|
|
log_msg info "Setting up DNS redirection to $proxy_server_ip_addr#$proxy_server_dns_port..."
|
|
|
|
# Persistent backup in UCI
|
|
if ! uci -q get "$UCI_CONFIG.dns_backup" >/dev/null; then
|
|
local old_noresolv=$(uci -q get dhcp.@dnsmasq[0].noresolv)
|
|
local old_dns_redirect=$(uci -q get dhcp.@dnsmasq[0].dns_redirect)
|
|
local old_servers=$(uci -q get dhcp.@dnsmasq[0].server | tr '\n' ',' | sed 's/,$//')
|
|
|
|
log_msg debug "Backing up DNS: noresolv=${old_noresolv:-empty}, redirect=${old_dns_redirect:-empty}, servers=${old_servers:-empty}"
|
|
|
|
uci set "$UCI_CONFIG.dns_backup=dns_backup"
|
|
[ -n "$old_noresolv" ] && uci set "$UCI_CONFIG.dns_backup.noresolv=$old_noresolv"
|
|
[ -n "$old_dns_redirect" ] && uci set "$UCI_CONFIG.dns_backup.dns_redirect=$old_dns_redirect"
|
|
[ -n "$old_servers" ] && uci set "$UCI_CONFIG.dns_backup.servers=$old_servers"
|
|
uci commit "$UCI_CONFIG"
|
|
fi
|
|
|
|
log_msg debug "Applying new DNS: noresolv=1, redirect=0, server=$proxy_server_ip_addr#$proxy_server_dns_port"
|
|
uci set dhcp.@dnsmasq[0].noresolv='1'
|
|
uci set dhcp.@dnsmasq[0].dns_redirect='0'
|
|
|
|
# Delete current servers and add our proxy
|
|
uci -q delete dhcp.@dnsmasq[0].server
|
|
uci add_list dhcp.@dnsmasq[0].server="$proxy_server_ip_addr#$proxy_server_dns_port"
|
|
|
|
uci commit dhcp
|
|
/etc/init.d/dnsmasq restart
|
|
}
|
|
|
|
cleanup_dns() {
|
|
if uci -q get "$UCI_CONFIG.dns_backup" >/dev/null; then
|
|
log_msg info "Restoring original DNS configuration..."
|
|
|
|
local noresolv=$(uci -q get "$UCI_CONFIG.dns_backup.noresolv")
|
|
local dns_redirect=$(uci -q get "$UCI_CONFIG.dns_backup.dns_redirect")
|
|
local servers=$(uci -q get "$UCI_CONFIG.dns_backup.servers")
|
|
|
|
log_msg debug "Restoring DNS values: noresolv=${noresolv:-0}, redirect=${dns_redirect:-1}, servers=${servers:-empty}"
|
|
|
|
# Restore noresolv (default to 0 if not backed up)
|
|
[ -n "$noresolv" ] && uci set dhcp.@dnsmasq[0].noresolv="$noresolv" || uci set dhcp.@dnsmasq[0].noresolv="0"
|
|
|
|
# Restore dns_redirect (default to 1 as requested for OpenWrt typical modded builds)
|
|
[ -n "$dns_redirect" ] && uci set dhcp.@dnsmasq[0].dns_redirect="$dns_redirect" || uci set dhcp.@dnsmasq[0].dns_redirect="1"
|
|
|
|
# Restore servers
|
|
uci -q delete dhcp.@dnsmasq[0].server
|
|
if [ -n "$servers" ]; then
|
|
for s in $servers; do
|
|
[ -n "$s" ] && uci add_list dhcp.@dnsmasq[0].server="$s"
|
|
done
|
|
fi
|
|
|
|
uci commit dhcp
|
|
uci delete "$UCI_CONFIG.dns_backup"
|
|
uci commit "$UCI_CONFIG"
|
|
/etc/init.d/dnsmasq restart
|
|
fi
|
|
}
|
|
|
|
start_service() {
|
|
local enabled=$(uci -q get "$UCI_CONFIG.global.enabled" || echo 0)
|
|
|
|
if [ "$enabled" -eq 0 ]; then
|
|
log_msg info "FlowProxy is disabled, ensuring service is stopped"
|
|
stop_service
|
|
return 0
|
|
fi
|
|
|
|
log_msg info "Starting FlowProxy..."
|
|
|
|
check_env || return 1
|
|
check_config || return 1
|
|
apply_nft_rules || return 1
|
|
add_route
|
|
setup_dns
|
|
|
|
touch "$STATE_FILE"
|
|
log_msg info "FlowProxy service started successfully"
|
|
}
|
|
stop_service() {
|
|
log_msg info "Stopping FlowProxy..."
|
|
# 强制先移除标记，防止状态误报
|
|
rm -f "$STATE_FILE"
|
|
delete_route
|
|
delete_nft
|
|
cleanup_dns
|
|
log_msg info "FlowProxy service stopped"
|
|
}
|
|
|
|
restart_service() {
|
|
stop_service
|
|
start_service
|
|
}
|
|
|
|
service_triggers() {
|
|
# 监听自身配置改动
|
|
procd_add_reload_trigger "$UCI_CONFIG"
|
|
# 监听防火墙重载事件，防止规则被 fw4 清空后无法自动恢复
|
|
procd_add_reload_trigger "firewall"
|
|
}
|
|
|
|
reload_service() {
|
|
restart
|
|
}
|