From 5fd46871643f0dcf9790c1c9136ca28d388ed307 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 18 Jan 2019 06:42:21 +0000 Subject: [PATCH] shadowsocks-libev: ss-rules: add ipv6 support It will require support from ip6tables-mod-nat. The added functionality will be skipped otherwise. For $o_dst_bypass6_, include only address blocks in link [1] whose "Globally Reachable" field are explicitly "False" Closes openwrt/packages#7508 [1] IANA IPv6 Special-Purpose Address Registry, https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml Signed-off-by: Yousong Zhou --- net/shadowsocks-libev/Makefile | 2 +- .../files/shadowsocks-libev.init | 19 ++-- net/shadowsocks-libev/files/ss-rules | 96 +++++++++++++------ 3 files changed, 78 insertions(+), 39 deletions(-) diff --git a/net/shadowsocks-libev/Makefile b/net/shadowsocks-libev/Makefile index 0b2df0e99f..81731283f0 100644 --- a/net/shadowsocks-libev/Makefile +++ b/net/shadowsocks-libev/Makefile @@ -14,7 +14,7 @@ include $(TOPDIR)/rules.mk # PKG_NAME:=shadowsocks-libev PKG_VERSION:=3.2.3 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://github.com/shadowsocks/shadowsocks-libev/releases/download/v$(PKG_VERSION) diff --git a/net/shadowsocks-libev/files/shadowsocks-libev.init b/net/shadowsocks-libev/files/shadowsocks-libev.init index 22d825d0b1..23cb873cc6 100644 --- a/net/shadowsocks-libev/files/shadowsocks-libev.init +++ b/net/shadowsocks-libev/files/shadowsocks-libev.init @@ -157,7 +157,12 @@ ss_rules() { ss_redir_servers="$(echo "$ss_redir_servers" | tr ' ' '\n' | sort -u)" [ "$dst_forward_recentrst" = 0 ] || args="$args --dst-forward-recentrst" - "$bin" \ + ss_rules_call + ss_rules_call -6 +} + +ss_rules_call() { + "$bin" "$@" \ -s "$ss_redir_servers" \ -l "$local_port_tcp" \ -L "$local_port_udp" \ @@ -174,7 +179,7 @@ ss_rules() { --ifnames "$ifnames" \ --ipt-extra "$ipt_args" \ $args \ - || "$bin" -f + || "$bin" "$@" -f } start_service() { @@ -280,13 +285,13 @@ validate_ss_rules_section() { 'disabled:bool:0' \ 'redir_tcp:uci("shadowsocks-libev", "@ss_redir")' \ 'redir_udp:uci("shadowsocks-libev", "@ss_redir")' \ - 'src_ips_bypass:or(ip4addr,cidr4)' \ - 'src_ips_forward:or(ip4addr,cidr4)' \ - 'src_ips_checkdst:or(ip4addr,cidr4)' \ + 'src_ips_bypass:or(ipaddr,cidr)' \ + 'src_ips_forward:or(ipaddr,cidr)' \ + 'src_ips_checkdst:or(ipaddr,cidr)' \ 'dst_ips_bypass_file:file' \ - 'dst_ips_bypass:or(ip4addr,cidr4)' \ + 'dst_ips_bypass:or(ipaddr,cidr)' \ 'dst_ips_forward_file:file' \ - 'dst_ips_forward:or(ip4addr,cidr4)' \ + 'dst_ips_forward:or(ipaddr,cidr)' \ 'src_default:or("bypass", "forward", "checkdst"):checkdst' \ 'dst_default:or("bypass", "forward"):bypass' \ 'local_default:or("bypass", "forward", "checkdst"):bypass' \ diff --git a/net/shadowsocks-libev/files/ss-rules b/net/shadowsocks-libev/files/ss-rules index b0a30606e1..3d7bcdce30 100755 --- a/net/shadowsocks-libev/files/ss-rules +++ b/net/shadowsocks-libev/files/ss-rules @@ -8,10 +8,24 @@ # See /LICENSE for more information. # +__errmsg() { + echo "ss-rules: $*" >&2 +} + +if [ "$1" = "-6" ]; then + if ! ip6tables -t nat -L -n >/dev/null; then + __errmsg "Skipping ipv6. Please install ip6tables-mod-nat" + exit 1 + fi + o_use_ipv6=1; shift +fi + ss_rules_usage() { cat >&2 < Local port number of ss-redir with TCP mode @@ -50,7 +64,7 @@ populated by other programs like dnsmasq with ipset support EOF } -o_dst_bypass_=" +o_dst_bypass4_=" 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 @@ -71,13 +85,33 @@ o_dst_bypass_=" 240.0.0.0/4 255.255.255.255 " +o_dst_bypass6_=" + ::1/128 + ::/128 + ::ffff:0:0/96 + 64:ff9b:1::/48 + 100::/64 + 2001:2::/48 + 2001:db8::/32 + fe80::/10 + 2001::/23 + fc00::/7 +" o_src_default=bypass o_dst_default=bypass o_local_default=bypass -__errmsg() { - echo "ss-rules: $*" >&2 -} +alias grep_af="sed -nre '/^([0-9]+\.){3}[0-9]+$/p'" +o_dst_bypass_="$o_dst_bypass4_" +if [ -n "$o_use_ipv6" ]; then + alias grep_af="sed -ne /:/p" + alias iptables=ip6tables + alias iptables-save=ip6tables-save + alias iptables-restore=ip6tables-restore + alias ip="ip -6" + o_af=6 + o_dst_bypass_="$o_dst_bypass6_" +fi ss_rules_parse_args() { while [ "$#" -gt 0 ]; do @@ -109,10 +143,10 @@ ss_rules_parse_args() { return 1 fi if [ -n "$o_dst_forward_recentrst" ] && ! iptables -m recent -h >/dev/null; then - __errmsg "Please install iptables-mod-conntrack-extra with opkg" + __errmsg "Please install iptables-mod-conntrack-extra" return 1 fi - o_remote_servers="$(for s in $o_remote_servers; do resolveip -4 "$s"; done)" + o_remote_servers="$(for s in $o_remote_servers; do resolveip "$s" | grep_af; done)" } ss_rules_flush() { @@ -121,26 +155,26 @@ ss_rules_flush() { iptables-save --counters | grep -v ss_rules_ | iptables-restore --counters while ip rule del fwmark 1 lookup 100 2>/dev/null; do true; done ip route flush table 100 - for setname in $(ipset -n list | grep "ss_rules_"); do + for setname in $(ipset -n list | grep "ss_rules${o_af}_"); do ipset destroy "$setname" 2>/dev/null || true done } ss_rules_ipset_init() { ipset --exist restore <<-EOF - create ss_rules_src_bypass hash:net hashsize 64 - create ss_rules_src_forward hash:net hashsize 64 - create ss_rules_src_checkdst hash:net hashsize 64 - create ss_rules_dst_bypass hash:net hashsize 64 - create ss_rules_dst_bypass_ hash:net hashsize 64 - create ss_rules_dst_forward hash:net hashsize 64 - create ss_rules_dst_forward_recentrst_ hash:ip hashsize 64 timeout 3600 - $(ss_rules_ipset_mkadd ss_rules_dst_bypass_ "$o_dst_bypass_ $o_remote_servers") - $(ss_rules_ipset_mkadd ss_rules_src_bypass "$o_src_bypass") - $(ss_rules_ipset_mkadd ss_rules_src_forward "$o_src_forward") - $(ss_rules_ipset_mkadd ss_rules_src_checkdst "$o_src_checkdst") - $(ss_rules_ipset_mkadd ss_rules_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null)") - $(ss_rules_ipset_mkadd ss_rules_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null)") + create ss_rules${o_af}_src_bypass hash:net family inet$o_af hashsize 64 + create ss_rules${o_af}_src_forward hash:net family inet$o_af hashsize 64 + create ss_rules${o_af}_src_checkdst hash:net family inet$o_af hashsize 64 + create ss_rules${o_af}_dst_bypass hash:net family inet$o_af hashsize 64 + create ss_rules${o_af}_dst_bypass_ hash:net family inet$o_af hashsize 64 + create ss_rules${o_af}_dst_forward hash:net family inet$o_af hashsize 64 + create ss_rules${o_af}_dst_forward_rrst_ hash:ip family inet$o_af hashsize 8 timeout 3600 + $(ss_rules_ipset_mkadd ss_rules${o_af}_dst_bypass_ "$o_dst_bypass_ $o_remote_servers") + $(ss_rules_ipset_mkadd ss_rules${o_af}_src_bypass "$o_src_bypass") + $(ss_rules_ipset_mkadd ss_rules${o_af}_src_forward "$o_src_forward") + $(ss_rules_ipset_mkadd ss_rules${o_af}_src_checkdst "$o_src_checkdst") + $(ss_rules_ipset_mkadd ss_rules${o_af}_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null)") + $(ss_rules_ipset_mkadd ss_rules${o_af}_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null)") EOF } @@ -149,8 +183,8 @@ ss_rules_ipset_mkadd() { local i for i in $*; do - echo "add $setname $i" - done + echo "$i" + done | grep_af | sed -e "s/^/add $setname /" } ss_rules_iptchains_init() { @@ -175,7 +209,7 @@ ss_rules_iptchains_init_tcp() { *nat :ss_rules_local_out - -I OUTPUT 1 -p tcp -j ss_rules_local_out - -A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_ dst -j RETURN + -A ss_rules_local_out -m set --match-set ss_rules${o_af}_dst_bypass_ dst -j RETURN -A ss_rules_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default" COMMIT EOF @@ -203,8 +237,8 @@ ss_rules_iptchains_init_() { COMMIT " recentrst_addset_rules=" - -A ss_rules_dst -m recent --name ss_rules_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules_dst_forward_recentrst_ dst --exist - -A ss_rules_dst -m set --match-set ss_rules_dst_forward_recentrst_ dst -j ss_rules_forward + -A ss_rules_dst -m recent --name ss_rules_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules${o_af}_dst_forward_rrst_ dst --exist + -A ss_rules_dst -m set --match-set ss_rules${o_af}_dst_forward_rrst_ dst -j ss_rules_forward " fi ;; @@ -230,14 +264,14 @@ ss_rules_iptchains_init_() { :ss_rules_dst - :ss_rules_forward - $(ss_rules_iptchains_mkprerules "$proto") - -A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_ dst -j RETURN + -A ss_rules_pre_src -m set --match-set ss_rules${o_af}_dst_bypass_ dst -j RETURN -A ss_rules_pre_src -p $proto $o_ipt_extra -j ss_rules_src - -A ss_rules_src -m set --match-set ss_rules_src_bypass src -j RETURN - -A ss_rules_src -m set --match-set ss_rules_src_forward src -j ss_rules_forward - -A ss_rules_src -m set --match-set ss_rules_src_checkdst src -j ss_rules_dst + -A ss_rules_src -m set --match-set ss_rules${o_af}_src_bypass src -j RETURN + -A ss_rules_src -m set --match-set ss_rules${o_af}_src_forward src -j ss_rules_forward + -A ss_rules_src -m set --match-set ss_rules${o_af}_src_checkdst src -j ss_rules_dst -A ss_rules_src -j $src_default_target -m comment --comment "src_default: $o_src_default" - -A ss_rules_dst -m set --match-set ss_rules_dst_bypass dst -j RETURN - -A ss_rules_dst -m set --match-set ss_rules_dst_forward dst -j ss_rules_forward + -A ss_rules_dst -m set --match-set ss_rules${o_af}_dst_bypass dst -j RETURN + -A ss_rules_dst -m set --match-set ss_rules${o_af}_dst_forward dst -j ss_rules_forward $recentrst_addset_rules -A ss_rules_dst -j $dst_default_target -m comment --comment "dst_default: $o_dst_default" $forward_rules