op-packages/luci-app-jederproxy/root/usr/share/jederproxy/firewall_include.ut

#!/usr/bin/utpl
{%
    const uci = require("uci");
    const fs = require("fs");

    function iterate_file(filename, cb) {
        let fd = fs.open(filename, "r");
        if (!fd) {
            warn(`Unable to open '${filename}': ${fs.error()}\n`);
            return;
        }

        let line = null, count = 0;
        while (!!(line = trim(fd.read("line")))) {
            if (ord(line) == 35)  // skip lines which start with '#'
                continue;

            cb(line);

            count++;
        }
        fd.close();
        return count;
    }

    const cursor = uci.cursor();
    cursor.load("jederproxy");
    const config = cursor.get_all("jederproxy");
    const general = config[filter(keys(config), k => config[k][".type"] == "general")[0]];
    const jp_ether_src_forward = uniq(map(filter(keys(config), k => config[k][".type"] == "lan_hosts" && config[k].bypassed == "0"), k => config[k].macaddr) || []);
    const jp_ether_src_bypass = uniq(map(filter(keys(config), k => config[k][".type"] == "lan_hosts" && config[k].bypassed == "1"), k => config[k].macaddr) || []);
    const uids_direct = uniq(general.whitelist_process_uids || []);
    const gids_direct = uniq(general.whitelist_process_gids || []);
    const wan_bypass_rules = general.wan_bypass_rules || [];
    const wan_forward_rules = general.wan_forward_rules || [];
    const enable_udp = general.tproxy_enable_udp || "";
    iterate_file(general.wan_bypass_rule_file || "/dev/null", line => push(wan_bypass_rules, line));
    iterate_file(general.wan_forward_rule_file || "/dev/null", line => push(wan_forward_rules, line));
    // push(wan_bypass_rules, split(general.fast_dns, ":")[0]);
    // push(wan_forward_rules, split(general.secure_dns, ":")[0]);
%}
    set jp_ether_src_bypass {
        type ether_addr
        size 65536
{% if (length(jp_ether_src_bypass) > 0): %}
        elements = { {{ join(", ", jp_ether_src_bypass) }} }
{% endif %}
    }

    set jp_ether_src_forward {
        type ether_addr
        size 65536
{% if (length(jp_ether_src_forward) > 0): %}
        elements = { {{ join(", ", jp_ether_src_forward) }} }
{% endif %}
    }

    set jp_ipv4_rfc1918 {
        type ipv4_addr
        size 65536
        flags interval
        elements = {
            0.0.0.0/8,
            10.0.0.0/8,
            100.64.0.0/10,
            127.0.0.0/8,
            169.254.0.0/16,
            172.16.0.0/12,
            192.0.0.0/24,
            192.0.2.0/24,
            192.88.99.0/24,
            192.168.0.0/16,
            198.18.0.0/15,
            198.51.100.0/24,
            203.0.113.0/24,
            224.0.0.0/4,
            233.252.0.0/24,
            240.0.0.0/4
        }
        auto-merge
    }

    set jp_ipv4_dst_bypass {
        type ipv4_addr
        size 65536
        flags interval
        elements = { {{ join(", ", wan_bypass_rules)}} }
        auto-merge
    }

    set jp_ipv4_dst_forward {
        type ipv4_addr
        size 65536
        flags interval
        elements = { {{ join(", ", wan_forward_rules)}} }
        auto-merge
    }

    chain jproxy_rules {
{% if (length(uids_direct) > 0): %}
        meta skuid { {{ join(", ", uids_direct) }} } return comment "ignore traffic from processes owned by specific UIDs"
{% endif %}
{% if (length(gids_direct) > 0): %}
        meta skgid { {{ join(", ", gids_direct) }} } return comment "ignore traffic from processes owned by specific GIDs"
{% endif %}

        mark {{ sprintf("0x%08x", general.packet_mark_id) }} counter return comment "ignore outbound connections initiated by jederproxy"
        counter meta mark set ct mark comment "connection-mark -> packet-mark"
        mark 0x2333 counter return comment "ignore established connections"

        ip daddr @jp_ipv4_rfc1918 return comment "ignore traffic sent to reserved IP address/networks"
        ether saddr @jp_ether_src_bypass return comment "ignore traffic from specific sources (by macaddr)"
        ether saddr @jp_ether_src_forward jump jproxy_mark_connection comment "enforce proxy from specific sources (by macaddr)"
        ip daddr @jp_ipv4_dst_forward jump jproxy_mark_connection comment "enforce proxy to specific IP address/networks"
        ip daddr @jp_ipv4_dst_bypass return comment "ignore traffic sent to specific IP address/networks"

        jump jproxy_mark_connection
    }

    chain jproxy_mark_connection {
        tcp flags & (fin|syn|rst|ack) == syn counter meta mark set 0x2333 comment "mark the first packet of TCP connections"
        ip protocol udp ct state new counter meta mark set 0x2333 comment "mark the first packet of UDP connections"
        counter ct mark set mark comment "packet-mark -> connection-mark"
    }

    chain jproxy_prerouting {
        type filter hook prerouting priority filter; policy accept;

        iifname "{{ general.lan_interface }}" ip protocol {tcp, udp} fib saddr type != local fib daddr type != local counter jump jproxy_rules comment "proxy TCP/UDP traffic passing through this router (other->other)"

        meta l4proto tcp meta mark 0x2333 tproxy ip to 127.0.0.1:{{ general.tproxy_port }} counter accept comment "send marked TCP packets to jederproxy"
{% if (enable_udp == "1"): %}
        meta l4proto udp meta mark 0x2333 tproxy ip to 127.0.0.1:{{ general.tproxy_port }} counter accept comment "send marked UDP packets to jederproxy"
{% endif %}

    }

    chain jproxy_output {
        type route hook output priority filter; policy accept;
        ip protocol tcp fib saddr type local fib daddr type != local counter jump jproxy_rules comment "Proxy TCP traffic from router itself"
{% if (enable_udp == "1"): %}
        ip protocol udp fib saddr type local fib daddr type != local counter jump jproxy_rules comment "Proxy UDP traffic from router itself"
{% endif %}
    }