cdfff4a693
*** MAKEFILE *** * remove libubus dependency as it was causing issues https://forum.openwrt.org/t/policy-based-routing-pbr-package-discussion/140639/318 * move firewall hotplug directory/file creation out of default section into pbr and pbr-iptables packages sections in preparation for dropping it from pbr * fix no new line after output when uninstalling packages *** UCI-DEFAULTS *** * only add firewall include to firewall config if the include file exists * add shellcheck exception to netifd uci-defaults file *** SCRIPTS *** * more informative logging for firewall and iface hotplug scripts * more informative logging for firewall include script *** SERVICE *** * introduce lock-file to prevent package starting on external events if it hasn't been auto- or manually started before * use the `ip`, not `ip-full` command to prevent errors on OpenWrt 21.02 * parse firewall WAN zone to append list of interfaces * append error and warning "arrays" with new messages * used shared memory to store the service output/logging messages * improve is_ovpn function to filter out false positives when interface names started with `tun` * introduce is_valid_ovpn to find OpenVPN tunnels where the device name in OpenVPN config matches the device name in network config * introduce opkg_get_version to compare versions of principal and luci packages * better code to obtain AdGuardHome version with betas installed * optimize code and add better logging for errors when inserting policies with iptables * optimize code and add better logging for errors when inserting policies with nft * bugfix: insert policies in all specified protocols * bugfix: support using physical devices in policies in nft mode * bugfix: use iptPrefix, not nftPrefix in iptables commands * implement Tor support in nft mode * bugfix: fix spelling for User File Syntax error * restart service fully (instead of quick reload) for OpenVPN interface events, as the order/number of supported interfaces * more verbose output (showing handles) of status in nft mode * improve `icmp_interface`, `ignored_interface`, `supported_interface` validation regexes * improve `interface`, validation regex Signed-off-by: Stan Grishin <stangri@melmac.ca>
59 lines
1.8 KiB
Bash
59 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# shellcheck disable=SC1091,SC3037,SC3043
|
|
|
|
readonly packageName='pbr'
|
|
readonly __OK__='\033[0;32m[\xe2\x9c\x93]\033[0m'
|
|
|
|
# shellcheck disable=SC2317
|
|
pbr_iface_setup() {
|
|
local iface="${1}"
|
|
local proto
|
|
config_get proto "${iface}" proto
|
|
case "${iface}" in
|
|
(lan|loopback) return 0 ;;
|
|
esac
|
|
case "${proto}" in
|
|
(gre*|nebula|relay|vti*|vxlan|xfrm) return 0 ;;
|
|
(none)
|
|
uci -q set "network.${iface}_rt=route"
|
|
uci -q set "network.${iface}_rt.interface=${iface}"
|
|
uci -q set "network.${iface}_rt.target=0.0.0.0/0"
|
|
uci -q set "network.${iface}_rt6=route6"
|
|
uci -q set "network.${iface}_rt6.interface=${iface}"
|
|
uci -q set "network.${iface}_rt6.target=::/0"
|
|
;;
|
|
esac
|
|
echo -en "Setting up ${packageName} routing tables for ${iface}... "
|
|
uci -q set "network.${iface}.ip4table=${packageName}_${iface%6}"
|
|
uci -q set "network.${iface}.ip6table=${packageName}_${iface%6}"
|
|
if ! grep -q -E -e "^[0-9]+\s+${packageName}_${iface%6}$" /etc/iproute2/rt_tables; then
|
|
sed -i -e "\$a $(($(sort -r -n /etc/iproute2/rt_tables | grep -o -E -m 1 "^[0-9]+")+1))\t${packageName}_${iface%6}" \
|
|
/etc/iproute2/rt_tables
|
|
fi
|
|
echo -e "${__OK__}"
|
|
}
|
|
|
|
. /lib/functions.sh
|
|
. /lib/functions/network.sh
|
|
config_load network
|
|
config_foreach pbr_iface_setup interface
|
|
network_flush_cache
|
|
network_find_wan iface
|
|
network_find_wan6 iface6
|
|
# shellcheck disable=SC2154
|
|
[ -n "$iface" ] && uci -q batch << EOF
|
|
set network.default='rule'
|
|
set network.default.lookup='${packageName}_${iface%6}'
|
|
set network.default.priority='80000'
|
|
EOF
|
|
[ -n "$iface6" ] && uci -q batch << EOF
|
|
set network.default6='rule6'
|
|
set network.default6.lookup='${packageName}_${iface6%6}'
|
|
set network.default6.priority='80000'
|
|
EOF
|
|
uci commit network
|
|
echo -en "Restarting network... "
|
|
/etc/init.d/network restart
|
|
echo -e "${__OK__}"
|
|
|
|
exit 0
|