net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="/usr/bin/ip -4"
   4 IP6="/usr/bin/ip -6"
   5 IPS="/usr/sbin/ipset"
   6 IPT4="/usr/sbin/iptables -t mangle -w"
   7 IPT6="/usr/sbin/ip6tables -t mangle -w"
   8 LOG="/usr/bin/logger -t mwan3 -p"
   9
  10 MWAN3_STATUS_DIR="/var/run/mwan3"
  11
  12 [ -d $MWAN3_STATUS_DIR ] || mkdir -p $MWAN3_STATUS_DIR/iface_state
  13
  14 mwan3_lock() {
  15         lock /var/run/mwan3.lock
  16 }
  17
  18 mwan3_unlock() {
  19         lock -u /var/run/mwan3.lock
  20 }
  21
  22 mwan3_lock_clean() {
  23         rm -rf /var/run/mwan3.lock
  24 }
  25
  26 mwan3_get_iface_id()
  27 {
  28         local _tmp _iface _iface_count
  29
  30         _iface="$2"
  31
  32         mwan3_get_id()
  33         {
  34                 let _iface_count++
  35                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  36         }
  37         config_foreach mwan3_get_id interface
  38         export "$1=$_tmp"
  39 }
  40
  41 mwan3_set_connected_iptables()
  42 {
  43         local connected_network_v4 connected_network_v6
  44
  45         $IPS -! create mwan3_connected_v4 hash:net
  46         $IPS create mwan3_connected_v4_temp hash:net
  47
  48         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  49                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  50         done
  51
  52         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  53                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  54         done
  55
  56         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
  57
  58         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
  59         $IPS destroy mwan3_connected_v4_temp
  60
  61         $IPS -! create mwan3_connected_v6 hash:net family inet6
  62         $IPS create mwan3_connected_v6_temp hash:net family inet6
  63
  64         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
  65                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
  66         done
  67
  68         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
  69         $IPS destroy mwan3_connected_v6_temp
  70
  71         $IPS -! create mwan3_connected list:set
  72         $IPS -! add mwan3_connected mwan3_connected_v4
  73         $IPS -! add mwan3_connected mwan3_connected_v6
  74 }
  75
  76 mwan3_set_general_rules()
  77 {
  78         local IP
  79
  80         for IP in "$IP4" "$IP6"; do
  81
  82                 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
  83                         $IP rule add pref 2253 fwmark 0xfd00/0xff00 blackhole
  84                 fi
  85
  86                 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
  87                         $IP rule add pref 2254 fwmark 0xfe00/0xff00 unreachable
  88                 fi
  89         done
  90 }
  91
  92 mwan3_set_general_iptables()
  93 {
  94         local IPT
  95
  96         for IPT in "$IPT4" "$IPT6"; do
  97
  98                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
  99                         $IPT -N mwan3_ifaces_in
 100                 fi
 101
 102                 if ! $IPT -S mwan3_connected &> /dev/null; then
 103                         $IPT -N mwan3_connected
 104                         $IPS -! create mwan3_connected list:set
 105                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0xff00/0xff00
 106                 fi
 107
 108                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
 109                         $IPT -N mwan3_ifaces_out
 110                 fi
 111
 112                 if ! $IPT -S mwan3_rules &> /dev/null; then
 113                         $IPT -N mwan3_rules
 114                 fi
 115
 116                 if ! $IPT -S mwan3_hook &> /dev/null; then
 117                         $IPT -N mwan3_hook
 118                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask 0xff00 --ctmask 0xff00
 119                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_in
 120                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_connected
 121                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_out
 122                         $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_rules
 123                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
 124                         $IPT -A mwan3_hook -m mark ! --mark 0xff00/0xff00 -j mwan3_connected
 125                 fi
 126
 127                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 128                         $IPT -A PREROUTING -j mwan3_hook
 129                 fi
 130
 131                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 132                         $IPT -A OUTPUT -j mwan3_hook
 133                 fi
 134         done
 135 }
 136
 137 mwan3_create_iface_iptables()
 138 {
 139         local id family src_ip src_ipv6
 140
 141         config_get family $1 family ipv4
 142         mwan3_get_iface_id id $1
 143
 144         [ -n "$id" ] || return 0
 145
 146         if [ "$family" == "ipv4" ]; then
 147
 148                 network_get_ipaddr src_ip $1
 149
 150                 $IPS -! create mwan3_connected list:set
 151
 152                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 153                         $IPT4 -N mwan3_ifaces_in
 154                 fi
 155
 156                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 157                         $IPT4 -N mwan3_ifaces_out
 158                 fi
 159
 160                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 161                         $IPT4 -N mwan3_iface_in_$1
 162                 fi
 163
 164                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 165                         $IPT4 -N mwan3_iface_out_$1
 166                 fi
 167
 168                 $IPT4 -F mwan3_iface_in_$1
 169                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 170                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 171
 172                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 173                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 174
 175                 $IPT4 -F mwan3_iface_out_$1
 176                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 177
 178                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 179                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 180         fi
 181
 182         if [ "$family" == "ipv6" ]; then
 183
 184                 network_get_ipaddr6 src_ipv6 $1
 185
 186                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 187
 188                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 189                         $IPT6 -N mwan3_ifaces_in
 190                 fi
 191
 192                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 193                         $IPT6 -N mwan3_ifaces_out
 194                 fi
 195
 196                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 197                         $IPT6 -N mwan3_iface_in_$1
 198                 fi
 199
 200                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 201                         $IPT6 -N mwan3_iface_out_$1
 202                 fi
 203
 204                 $IPT6 -F mwan3_iface_in_$1
 205                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 206                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 207
 208                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 209                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
 210
 211                 $IPT6 -F mwan3_iface_out_$1
 212                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
 213
 214                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 215                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
 216         fi
 217 }
 218
 219 mwan3_delete_iface_iptables()
 220 {
 221         config_get family $1 family ipv4
 222
 223         if [ "$family" == "ipv4" ]; then
 224
 225                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 226                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 227                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 228
 229                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 230                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 231                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 232         fi
 233
 234         if [ "$family" == "ipv6" ]; then
 235
 236                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
 237                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 238                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 239
 240                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
 241                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 242                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 243         fi
 244 }
 245
 246 mwan3_create_iface_route()
 247 {
 248         local id route_args
 249
 250         config_get family $1 family ipv4
 251         mwan3_get_iface_id id $1
 252
 253         [ -n "$id" ] || return 0
 254
 255         if [ "$family" == "ipv4" ]; then
 256
 257                 network_get_gateway route_args $1
 258                 route_args="via $route_args dev $2"
 259
 260                 $IP4 route flush table $id
 261                 $IP4 route add table $id default $route_args
 262         fi
 263
 264         if [ "$family" == "ipv6" ]; then
 265
 266                 network_get_gateway6 route_args $1
 267                 route_args="via $route_args dev $2"
 268
 269                 $IP6 route flush table $id
 270                 $IP6 route add table $id default $route_args
 271         fi
 272 }
 273
 274 mwan3_delete_iface_route()
 275 {
 276         local id
 277
 278         config_get family $1 family ipv4
 279         mwan3_get_iface_id id $1
 280
 281         [ -n "$id" ] || return 0
 282
 283         if [ "$family" == "ipv4" ]; then
 284                 $IP4 route flush table $id
 285         fi
 286
 287         if [ "$family" == "ipv6" ]; then
 288                 $IP6 route flush table $id
 289         fi
 290 }
 291
 292 mwan3_create_iface_rules()
 293 {
 294         local id family
 295
 296         config_get family $1 family ipv4
 297         mwan3_get_iface_id id $1
 298
 299         [ -n "$id" ] || return 0
 300
 301         if [ "$family" == "ipv4" ]; then
 302
 303                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 304                         $IP4 rule del pref $(($id+1000))
 305                 done
 306
 307                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 308                         $IP4 rule del pref $(($id+2000))
 309                 done
 310
 311                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 312                 $IP4 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 313         fi
 314
 315         if [ "$family" == "ipv6" ]; then
 316
 317                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 318                         $IP6 rule del pref $(($id+1000))
 319                 done
 320
 321                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 322                         $IP6 rule del pref $(($id+2000))
 323                 done
 324
 325                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 326                 $IP6 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
 327         fi
 328 }
 329
 330 mwan3_delete_iface_rules()
 331 {
 332         local id family
 333
 334         config_get family $1 family ipv4
 335         mwan3_get_iface_id id $1
 336
 337         [ -n "$id" ] || return 0
 338
 339         if [ "$family" == "ipv4" ]; then
 340
 341                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 342                         $IP4 rule del pref $(($id+1000))
 343                 done
 344
 345                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 346                         $IP4 rule del pref $(($id+2000))
 347                 done
 348         fi
 349
 350         if [ "$family" == "ipv6" ]; then
 351
 352                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 353                         $IP6 rule del pref $(($id+1000))
 354                 done
 355
 356                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 357                         $IP6 rule del pref $(($id+2000))
 358                 done
 359         fi
 360 }
 361
 362 mwan3_delete_iface_ipset_entries()
 363 {
 364         local id setname entry
 365
 366         mwan3_get_iface_id id $1
 367
 368         [ -n "$id" ] || return 0
 369
 370         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 371                 for entry in $(ipset list $setname | grep "$(echo $(($id*256)) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 372                         $IPS del $setname $entry
 373                 done
 374         done
 375 }
 376
 377 mwan3_track()
 378 {
 379         local track_ip track_ips reliability count timeout interval down up
 380
 381         mwan3_list_track_ips()
 382         {
 383                 track_ips="$1 $track_ips"
 384         }
 385         config_list_foreach $1 track_ip mwan3_list_track_ips
 386
 387         if [ -e /var/run/mwan3track-$1.pid ] ; then
 388                 kill $(cat /var/run/mwan3track-$1.pid) &> /dev/null
 389                 rm /var/run/mwan3track-$1.pid &> /dev/null
 390         fi
 391
 392         if [ -n "$track_ips" ]; then
 393                 config_get reliability $1 reliability 1
 394                 config_get count $1 count 1
 395                 config_get timeout $1 timeout 4
 396                 config_get interval $1 interval 10
 397                 config_get down $1 down 5
 398                 config_get up $1 up 5
 399
 400                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track $1 $2 $reliability $count $timeout $interval $down $up $track_ips &
 401         fi
 402 }
 403
 404 mwan3_set_policy()
 405 {
 406         local iface_count id iface family metric probability weight
 407
 408         config_get iface $1 interface
 409         config_get metric $1 metric 1
 410         config_get weight $1 weight 1
 411
 412         [ -n "$iface" ] || return 0
 413
 414         mwan3_get_iface_id id $iface
 415
 416         [ -n "$id" ] || return 0
 417
 418         config_get family $iface family ipv4
 419
 420         if [ "$family" == "ipv4" ]; then
 421
 422                 if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
 423                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 424
 425                                 total_weight_v4=$weight
 426                                 $IPT4 -F mwan3_policy_$policy
 427                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 428
 429                                 lowest_metric_v4=$metric
 430
 431                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 432
 433                                 total_weight_v4=$(($total_weight_v4+$weight))
 434                                 probability=$(($weight*1000/$total_weight_v4))
 435
 436                                 if [ "$probability" -lt 10 ]; then
 437                                         probability="0.00$probability"
 438                                 elif [ $probability -lt 100 ]; then
 439                                         probability="0.0$probability"
 440                                 elif [ $probability -lt 1000 ]; then
 441                                         probability="0.$probability"
 442                                 else
 443                                         probability="1"
 444                                 fi
 445
 446                                 probability="-m statistic --mode random --probability $probability"
 447
 448                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(($id*256))/0xff00
 449                         fi
 450                 fi
 451         fi
 452
 453         if [ "$family" == "ipv6" ]; then
 454
 455                 if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
 456                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 457
 458                                 total_weight_v6=$weight
 459                                 $IPT6 -F mwan3_policy_$policy
 460                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
 461
 462                                 lowest_metric_v6=$metric
 463
 464                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 465
 466                                 total_weight_v6=$(($total_weight_v6+$weight))
 467                                 probability=$(($weight*1000/$total_weight_v6))
 468
 469                                 if [ "$probability" -lt 10 ]; then
 470                                         probability="0.00$probability"
 471                                 elif [ $probability -lt 100 ]; then
 472                                         probability="0.0$probability"
 473                                 elif [ $probability -lt 1000 ]; then
 474                                         probability="0.$probability"
 475                                 else
 476                                         probability="1"
 477                                 fi
 478
 479                                 probability="-m statistic --mode random --probability $probability"
 480
 481                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(($id*256))/0xff00
 482                         fi
 483                 fi
 484         fi
 485 }
 486
 487 mwan3_create_policies_iptables()
 488 {
 489         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 490
 491         policy="$1"
 492
 493         config_get last_resort $1 last_resort unreachable
 494
 495         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 496                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 497         fi
 498
 499         for IPT in "$IPT4" "$IPT6"; do
 500
 501                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 502                         $IPT -N mwan3_policy_$1
 503                 fi
 504
 505                 $IPT -F mwan3_policy_$1
 506
 507                 case "$last_resort" in
 508                         blackhole)
 509                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "blackhole" -j MARK --set-xmark 0xfd00/0xff00
 510                         ;;
 511                         default)
 512                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
 513                         ;;
 514                         *)
 515                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "unreachable" -j MARK --set-xmark 0xfe00/0xff00
 516                         ;;
 517                 esac
 518         done
 519
 520         lowest_metric_v4=256
 521         total_weight_v4=0
 522
 523         lowest_metric_v6=256
 524         total_weight_v6=0
 525
 526         config_list_foreach $1 use_member mwan3_set_policy
 527 }
 528
 529 mwan3_set_policies_iptables()
 530 {
 531         config_foreach mwan3_create_policies_iptables policy
 532 }
 533
 534 mwan3_set_sticky_iptables()
 535 {
 536         local id iface
 537
 538         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 539
 540                 if [ "$iface" == "$1" ]; then
 541
 542                         mwan3_get_iface_id id $1
 543
 544                         [ -n "$id" ] || return 0
 545
 546                         for IPT in "$IPT4" "$IPT6"; do
 547                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 548                                         $IPT -I mwan3_rule_$rule -m mark --mark $(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/0xff00
 549                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/0xff00 -j MARK --set-xmark $(($id*256))/0xff00
 550                                 fi
 551                         done
 552                 fi
 553         done
 554 }
 555
 556 mwan3_set_user_iptables_rule()
 557 {
 558         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 559
 560         rule="$1"
 561
 562         config_get sticky $1 sticky 0
 563         config_get timeout $1 timeout 600
 564         config_get ipset $1 ipset
 565         config_get proto $1 proto all
 566         config_get src_ip $1 src_ip 0.0.0.0/0
 567         config_get src_port $1 src_port 0:65535
 568         config_get dest_ip $1 dest_ip 0.0.0.0/0
 569         config_get dest_port $1 dest_port 0:65535
 570         config_get use_policy $1 use_policy
 571         config_get family $1 family any
 572
 573         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 574                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 575         fi
 576
 577         if [ -n "$ipset" ]; then
 578                 ipset="-m set --match-set $ipset dst"
 579         fi
 580
 581         if [ -n "$use_policy" ]; then
 582                 if [ "$use_policy" == "default" ]; then
 583                         policy="MARK --set-xmark 0xff00/0xff00"
 584                 elif [ "$use_policy" == "unreachable" ]; then
 585                         policy="MARK --set-xmark 0xfe00/0xff00"
 586                 elif [ "$use_policy" == "blackhole" ]; then
 587                         policy="MARK --set-xmark 0xfd00/0xff00"
 588                 else
 589                         if [ "$sticky" -eq 1 ]; then
 590
 591                                 policy="mwan3_policy_$use_policy"
 592
 593                                 for IPT in "$IPT4" "$IPT6"; do
 594                                         if ! $IPT -S $policy &> /dev/null; then
 595                                                 $IPT -N $policy
 596                                         fi
 597
 598                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 599                                                 $IPT -N mwan3_rule_$1
 600                                         fi
 601
 602                                         $IPT -F mwan3_rule_$1
 603                                 done
 604
 605                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask 0xff00 timeout $timeout
 606                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask 0xff00 timeout $timeout family inet6
 607                                 $IPS -! create mwan3_sticky_$rule list:set
 608                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 609                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 610
 611                                 config_foreach mwan3_set_sticky_iptables interface
 612
 613                                 for IPT in "$IPT4" "$IPT6"; do
 614                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/0xff00 -j $policy
 615                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 616                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 617                                 done
 618
 619                                 policy="mwan3_rule_$1"
 620                         else
 621                                 policy="mwan3_policy_$use_policy"
 622
 623                                 for IPT in "$IPT4" "$IPT6"; do
 624                                         if ! $IPT -S $policy &> /dev/null; then
 625                                                 $IPT -N $policy
 626                                         fi
 627                                 done
 628
 629                         fi
 630                 fi
 631
 632                 if [ "$family" == "any" ]; then
 633
 634                         for IPT in "$IPT4" "$IPT6"; do
 635                                 case $proto in
 636                                         tcp|udp)
 637                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 638                                         ;;
 639                                         *)
 640                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 641                                         ;;
 642                                 esac
 643                         done
 644
 645                 elif [ "$family" == "ipv4" ]; then
 646
 647                         case $proto in
 648                                 tcp|udp)
 649                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 650                                 ;;
 651                                 *)
 652                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 653                                 ;;
 654                         esac
 655
 656                 elif [ "$family" == "ipv6" ]; then
 657
 658                         case $proto in
 659                                 tcp|udp)
 660                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 661                                 ;;
 662                                 *)
 663                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
 664                                 ;;
 665                         esac
 666                 fi
 667         fi
 668 }
 669
 670 mwan3_set_user_rules()
 671 {
 672         local IPT
 673
 674         for IPT in "$IPT4" "$IPT6"; do
 675
 676                 if ! $IPT -S mwan3_rules &> /dev/null; then
 677                         $IPT -N mwan3_rules
 678                 fi
 679
 680                 $IPT -F mwan3_rules
 681         done
 682
 683         config_foreach mwan3_set_user_iptables_rule rule
 684 }
 685
 686 mwan3_set_iface_hotplug_state() {
 687         local iface=$1
 688         local state=$2
 689
 690         echo -n $state > $MWAN3_STATUS_DIR/iface_state/$iface
 691 }
 692
 693 mwan3_get_iface_hotplug_state() {
 694         local iface=$1
 695
 696         cat $MWAN3_STATUS_DIR/iface_state/$iface 2>/dev/null || echo "unknown"
 697 }
 698
 699 mwan3_report_iface_status()
 700 {
 701         local device result track_ips tracking IP IPT
 702
 703         mwan3_get_iface_id id $1
 704         network_get_device device $1
 705         config_get enabled "$1" enabled 0
 706         config_get family "$1" family ipv4
 707
 708         if [ "$family" == "ipv4" ]; then
 709                 IP="$IP4"
 710                 IPT="$IPT4"
 711         fi
 712
 713         if [ "$family" == "ipv6" ]; then
 714                 IP="$IP6"
 715                 IPT="$IPT6"
 716         fi
 717
 718         if [ -z "$id" -o -z "$device" ]; then
 719                 result="unknown"
 720         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 721                 result="$(mwan3_get_iface_hotplug_state $1)"
 722         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 723                 result="error"
 724         elif [ "$enabled" == "1" ]; then
 725                 result="offline"
 726         else
 727                 result="disabled"
 728         fi
 729
 730         mwan3_list_track_ips()
 731         {
 732                 track_ips="$1 $track_ips"
 733         }
 734         config_list_foreach $1 track_ip mwan3_list_track_ips
 735
 736         if [ -n "$track_ips" ]; then
 737                 if [ -n "$(ps -w | grep mwan3track | grep -v grep | sed '/.*\/usr\/sbin\/mwan3track \([^ ]*\) .*$/!d;s//\1/' | awk '$1 == "'$1'"')" ]; then
 738                         tracking="active"
 739                 else
 740                         tracking="down"
 741                 fi
 742         else
 743                 tracking="not enabled"
 744         fi
 745
 746         echo " interface $1 is $result and tracking is $tracking"
 747 }
 748
 749 mwan3_report_policies_v4()
 750 {
 751         local percent policy share total_weight weight iface
 752
 753         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 754                 echo "$policy:" | sed 's/mwan3_policy_//'
 755
 756                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 757
 758                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 759                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 760                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 761                                 percent=$(($weight*100/$total_weight))
 762                                 echo " $iface ($percent%)"
 763                         done
 764                 else
 765                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 766                 fi
 767
 768                 unset total_weight
 769
 770                 echo -e
 771         done
 772 }
 773
 774 mwan3_report_policies_v6()
 775 {
 776         local percent policy share total_weight weight iface
 777
 778         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 779                 echo "$policy:" | sed 's/mwan3_policy_//'
 780
 781                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 782
 783                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 784                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 785                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 786                                 percent=$(($weight*100/$total_weight))
 787                                 echo " $iface ($percent%)"
 788                         done
 789                 else
 790                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 791                 fi
 792
 793                 unset total_weight
 794
 795                 echo -e
 796         done
 797 }
 798
 799 mwan3_report_connected_v4()
 800 {
 801         local address
 802
 803         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 804                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 805                         echo " $address"
 806                 done
 807         fi
 808 }
 809
 810 mwan3_report_connected_v6()
 811 {
 812         local address
 813
 814         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 815                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 816                         echo " $address"
 817                 done
 818         fi
 819 }
 820
 821 mwan3_report_rules_v4()
 822 {
 823         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 824                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 825         fi
 826 }
 827
 828 mwan3_report_rules_v6()
 829 {
 830         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 831                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 832         fi
 833 }