net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="ip -4"
   4 IP6="ip -6"
   5 IPS="ipset"
   6 IPT4="iptables -t mangle -w"
   7 IPT6="ip6tables -t mangle -w"
   8 LOG="logger -t mwan3[$$] -p"
   9 CONNTRACK_FILE="/proc/net/nf_conntrack"
  10
  11 MWAN3_STATUS_DIR="/var/run/mwan3"
  12 MWAN3TRACK_STATUS_DIR="/var/run/mwan3track"
  13
  14 [ -d $MWAN3_STATUS_DIR ] || mkdir -p $MWAN3_STATUS_DIR/iface_state
  15 # mwan3's MARKing mask (at least 3 bits should be set)
  16 if [ -e "${MWAN3_STATUS_DIR}/mmx_mask" ]; then
  17         MMX_MASK=$(cat "${MWAN3_STATUS_DIR}/mmx_mask")
  18 else
  19         config_load mwan3
  20         config_get MMX_MASK globals mmx_mask '0xff00'
  21         echo "$MMX_MASK" > "${MWAN3_STATUS_DIR}/mmx_mask"
  22         $LOG notice "Using firewall mask ${MMX_MASK}"
  23 fi
  24
  25 # counts how many bits are set to 1
  26 # n&(n-1) clears the lowest bit set to 1
  27 mwan3_count_one_bits()
  28 {
  29         local count n
  30         count=0
  31         n=$(($1))
  32         while [ "$n" -gt "0" ]; do
  33                 n=$((n&(n-1)))
  34                 count=$((count+1))
  35         done
  36         echo $count
  37 }
  38
  39 # maps the 1st parameter so it only uses the bits allowed by the bitmask (2nd parameter)
  40 # which means spreading the bits of the 1st parameter to only use the bits that are set to 1 in the 2nd parameter
  41 # 0 0 0 0 0 1 0 1 (0x05) 1st parameter
  42 # 1 0 1 0 1 0 1 0 (0xAA) 2nd parameter
  43 #     1   0   1          result
  44 mwan3_id2mask()
  45 {
  46         local bit_msk bit_val result
  47         bit_val=0
  48         result=0
  49         for bit_msk in $(seq 0 31); do
  50                 if [ $((($2>>bit_msk)&1)) = "1" ]; then
  51                         if [ $((($1>>bit_val)&1)) = "1" ]; then
  52                                 result=$((result|(1<<bit_msk)))
  53                         fi
  54                         bit_val=$((bit_val+1))
  55                 fi
  56         done
  57         printf "0x%x" $result
  58 }
  59
  60 # mark mask constants
  61 MM_BIT_CNT=$(mwan3_count_one_bits MMX_MASK)
  62 MM_DEFAULT=$(((1<<MM_BIT_CNT)-1))
  63 MM_BLACKHOLE=$(($MM_DEFAULT-2))
  64 MM_UNREACHABLE=$(($MM_DEFAULT-1))
  65
  66 # MMX_DEFAULT should equal MMX_MASK
  67 MMX_DEFAULT=$(mwan3_id2mask MM_DEFAULT MMX_MASK)
  68 MMX_BLACKHOLE=$(mwan3_id2mask MM_BLACKHOLE MMX_MASK)
  69 MMX_UNREACHABLE=$(mwan3_id2mask MM_UNREACHABLE MMX_MASK)
  70
  71 mwan3_lock() {
  72         lock /var/run/mwan3.lock
  73 }
  74
  75 mwan3_unlock() {
  76         lock -u /var/run/mwan3.lock
  77 }
  78
  79 mwan3_lock_clean() {
  80         rm -rf /var/run/mwan3.lock
  81 }
  82
  83 mwan3_get_iface_id()
  84 {
  85         local _tmp _iface _iface_count
  86
  87         _iface="$2"
  88
  89         mwan3_get_id()
  90         {
  91                 let _iface_count++
  92                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  93         }
  94         config_foreach mwan3_get_id interface
  95         export "$1=$_tmp"
  96 }
  97
  98 mwan3_set_connected_iptables()
  99 {
 100         local connected_network_v4 connected_network_v6
 101
 102         $IPS -! create mwan3_connected_v4 hash:net
 103         $IPS create mwan3_connected_v4_temp hash:net
 104
 105         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 106                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
 107         done
 108
 109         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 110                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
 111         done
 112
 113         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
 114
 115         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
 116         $IPS destroy mwan3_connected_v4_temp
 117
 118         $IPS -! create mwan3_connected_v6 hash:net family inet6
 119         $IPS create mwan3_connected_v6_temp hash:net family inet6
 120
 121         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 122                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
 123         done
 124
 125         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
 126         $IPS destroy mwan3_connected_v6_temp
 127
 128         $IPS -! create mwan3_connected list:set
 129         $IPS -! add mwan3_connected mwan3_connected_v4
 130         $IPS -! add mwan3_connected mwan3_connected_v6
 131 }
 132
 133 mwan3_set_general_rules()
 134 {
 135         local IP
 136
 137         for IP in "$IP4" "$IP6"; do
 138
 139                 RULE_NO=$(($MM_BLACKHOLE+2000))
 140                 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
 141                         $IP rule add pref $RULE_NO fwmark $MMX_BLACKHOLE/$MMX_MASK blackhole
 142                 fi
 143
 144                 RULE_NO=$(($MM_UNREACHABLE+2000))
 145                 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
 146                         $IP rule add pref $RULE_NO fwmark $MMX_UNREACHABLE/$MMX_MASK unreachable
 147                 fi
 148         done
 149 }
 150
 151 mwan3_set_general_iptables()
 152 {
 153         local IPT
 154
 155         for IPT in "$IPT4" "$IPT6"; do
 156
 157                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
 158                         $IPT -N mwan3_ifaces_in
 159                 fi
 160
 161                 if ! $IPT -S mwan3_connected &> /dev/null; then
 162                         $IPT -N mwan3_connected
 163                         $IPS -! create mwan3_connected list:set
 164                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 165                 fi
 166
 167                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
 168                         $IPT -N mwan3_ifaces_out
 169                 fi
 170
 171                 if ! $IPT -S mwan3_rules &> /dev/null; then
 172                         $IPT -N mwan3_rules
 173                 fi
 174
 175                 if ! $IPT -S mwan3_hook &> /dev/null; then
 176                         $IPT -N mwan3_hook
 177                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
 178                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_in
 179                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_connected
 180                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_out
 181                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_rules
 182                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
 183                         $IPT -A mwan3_hook -m mark ! --mark $MMX_DEFAULT/$MMX_MASK -j mwan3_connected
 184                 fi
 185
 186                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 187                         $IPT -A PREROUTING -j mwan3_hook
 188                 fi
 189
 190                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 191                         $IPT -A OUTPUT -j mwan3_hook
 192                 fi
 193         done
 194 }
 195
 196 mwan3_create_iface_iptables()
 197 {
 198         local id family src_ip src_ipv6
 199
 200         config_get family $1 family ipv4
 201         mwan3_get_iface_id id $1
 202
 203         [ -n "$id" ] || return 0
 204
 205         if [ "$family" == "ipv4" ]; then
 206
 207                 ubus call network.interface.${1}_4 status &>/dev/null
 208                 if [ "$?" -eq "0" ]; then
 209                         network_get_ipaddr src_ip ${1}_4
 210                 else
 211                         network_get_ipaddr src_ip $1
 212                 fi
 213
 214                 $IPS -! create mwan3_connected list:set
 215
 216                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 217                         $IPT4 -N mwan3_ifaces_in
 218                 fi
 219
 220                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 221                         $IPT4 -N mwan3_ifaces_out
 222                 fi
 223
 224                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 225                         $IPT4 -N mwan3_iface_in_$1
 226                 fi
 227
 228                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 229                         $IPT4 -N mwan3_iface_out_$1
 230                 fi
 231
 232                 $IPT4 -F mwan3_iface_in_$1
 233                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 234                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 235
 236                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 237                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
 238
 239                 $IPT4 -F mwan3_iface_out_$1
 240                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 241
 242                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 243                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
 244         fi
 245
 246         if [ "$family" == "ipv6" ]; then
 247
 248                 ubus call network.interface.${1}_6 status &>/dev/null
 249                 if [ "$?" -eq "0" ]; then
 250                         network_get_ipaddr6 src_ipv6 ${1}_6
 251                 else
 252                         network_get_ipaddr6 src_ipv6 $1
 253                 fi
 254
 255                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 256
 257                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 258                         $IPT6 -N mwan3_ifaces_in
 259                 fi
 260
 261                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 262                         $IPT6 -N mwan3_ifaces_out
 263                 fi
 264
 265                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 266                         $IPT6 -N mwan3_iface_in_$1
 267                 fi
 268
 269                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 270                         $IPT6 -N mwan3_iface_out_$1
 271                 fi
 272
 273                 $IPT6 -F mwan3_iface_in_$1
 274                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 275                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 276
 277                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 278                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
 279
 280                 $IPT6 -F mwan3_iface_out_$1
 281                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 282
 283                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 284                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
 285         fi
 286 }
 287
 288 mwan3_delete_iface_iptables()
 289 {
 290         config_get family $1 family ipv4
 291
 292         if [ "$family" == "ipv4" ]; then
 293
 294                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 295                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 296                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 297
 298                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 299                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 300                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 301         fi
 302
 303         if [ "$family" == "ipv6" ]; then
 304
 305                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 306                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 307                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 308
 309                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 310                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 311                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 312         fi
 313 }
 314
 315 mwan3_create_iface_route()
 316 {
 317         local id route_args
 318
 319         config_get family $1 family ipv4
 320         mwan3_get_iface_id id $1
 321
 322         [ -n "$id" ] || return 0
 323
 324         if [ "$family" == "ipv4" ]; then
 325                 ubus call network.interface.${1}_4 status &>/dev/null
 326                 if [ "$?" -eq "0" ]; then
 327                         network_get_gateway route_args ${1}_4
 328                 else
 329                         network_get_gateway route_args $1
 330                 fi
 331
 332                 route_args="via $route_args dev $2"
 333
 334                 $IP4 route flush table $id
 335                 $IP4 route add table $id default $route_args
 336         fi
 337
 338         if [ "$family" == "ipv6" ]; then
 339
 340                 ubus call network.interface.${1}_6 status &>/dev/null
 341                 if [ "$?" -eq "0" ]; then
 342                         network_get_gateway6 route_args ${1}_6
 343                 else
 344                         network_get_gateway6 route_args $1
 345                 fi
 346
 347                 route_args="via $route_args dev $2"
 348
 349                 $IP6 route flush table $id
 350                 $IP6 route add table $id default $route_args
 351         fi
 352 }
 353
 354 mwan3_delete_iface_route()
 355 {
 356         local id
 357
 358         config_get family $1 family ipv4
 359         mwan3_get_iface_id id $1
 360
 361         [ -n "$id" ] || return 0
 362
 363         if [ "$family" == "ipv4" ]; then
 364                 $IP4 route flush table $id
 365         fi
 366
 367         if [ "$family" == "ipv6" ]; then
 368                 $IP6 route flush table $id
 369         fi
 370 }
 371
 372 mwan3_create_iface_rules()
 373 {
 374         local id family
 375
 376         config_get family $1 family ipv4
 377         mwan3_get_iface_id id $1
 378
 379         [ -n "$id" ] || return 0
 380
 381         if [ "$family" == "ipv4" ]; then
 382
 383                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 384                         $IP4 rule del pref $(($id+1000))
 385                 done
 386
 387                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 388                         $IP4 rule del pref $(($id+2000))
 389                 done
 390
 391                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 392                 $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
 393         fi
 394
 395         if [ "$family" == "ipv6" ]; then
 396
 397                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 398                         $IP6 rule del pref $(($id+1000))
 399                 done
 400
 401                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 402                         $IP6 rule del pref $(($id+2000))
 403                 done
 404
 405                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 406                 $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
 407         fi
 408 }
 409
 410 mwan3_delete_iface_rules()
 411 {
 412         local id family
 413
 414         config_get family $1 family ipv4
 415         mwan3_get_iface_id id $1
 416
 417         [ -n "$id" ] || return 0
 418
 419         if [ "$family" == "ipv4" ]; then
 420
 421                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 422                         $IP4 rule del pref $(($id+1000))
 423                 done
 424
 425                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 426                         $IP4 rule del pref $(($id+2000))
 427                 done
 428         fi
 429
 430         if [ "$family" == "ipv6" ]; then
 431
 432                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 433                         $IP6 rule del pref $(($id+1000))
 434                 done
 435
 436                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 437                         $IP6 rule del pref $(($id+2000))
 438                 done
 439         fi
 440 }
 441
 442 mwan3_delete_iface_ipset_entries()
 443 {
 444         local id setname entry
 445
 446         mwan3_get_iface_id id $1
 447
 448         [ -n "$id" ] || return 0
 449
 450         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 451                 for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 452                         $IPS del $setname $entry
 453                 done
 454         done
 455 }
 456
 457 mwan3_track()
 458 {
 459         local track_ip track_ips
 460
 461         mwan3_list_track_ips()
 462         {
 463                 track_ips="$track_ips $1"
 464         }
 465         config_list_foreach $1 track_ip mwan3_list_track_ips
 466
 467         kill $(pgrep -f "mwan3track $1 $2") &> /dev/null
 468         if [ -n "$track_ips" ]; then
 469                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track "$1" "$2" "$3" "$4" $track_ips &
 470         fi
 471 }
 472
 473 mwan3_track_signal()
 474 {
 475         local pid
 476
 477         pid="$(pgrep -f "mwan3track $1 $2")"
 478         if [ "${pid}" != "" ]; then
 479                 kill -USR1 "${pid}"
 480         else
 481                 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
 482         fi
 483 }
 484
 485 mwan3_set_policy()
 486 {
 487         local iface_count id iface family metric probability weight
 488
 489         config_get iface $1 interface
 490         config_get metric $1 metric 1
 491         config_get weight $1 weight 1
 492
 493         [ -n "$iface" ] || return 0
 494
 495         mwan3_get_iface_id id $iface
 496
 497         [ -n "$id" ] || return 0
 498
 499         config_get family $iface family ipv4
 500
 501         if [ "$family" == "ipv4" ]; then
 502
 503                 if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
 504                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 505
 506                                 total_weight_v4=$weight
 507                                 $IPT4 -F mwan3_policy_$policy
 508                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 509
 510                                 lowest_metric_v4=$metric
 511
 512                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 513
 514                                 total_weight_v4=$(($total_weight_v4+$weight))
 515                                 probability=$(($weight*1000/$total_weight_v4))
 516
 517                                 if [ "$probability" -lt 10 ]; then
 518                                         probability="0.00$probability"
 519                                 elif [ $probability -lt 100 ]; then
 520                                         probability="0.0$probability"
 521                                 elif [ $probability -lt 1000 ]; then
 522                                         probability="0.$probability"
 523                                 else
 524                                         probability="1"
 525                                 fi
 526
 527                                 probability="-m statistic --mode random --probability $probability"
 528
 529                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 530                         fi
 531                 fi
 532         fi
 533
 534         if [ "$family" == "ipv6" ]; then
 535
 536                 if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
 537                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 538
 539                                 total_weight_v6=$weight
 540                                 $IPT6 -F mwan3_policy_$policy
 541                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 542
 543                                 lowest_metric_v6=$metric
 544
 545                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 546
 547                                 total_weight_v6=$(($total_weight_v6+$weight))
 548                                 probability=$(($weight*1000/$total_weight_v6))
 549
 550                                 if [ "$probability" -lt 10 ]; then
 551                                         probability="0.00$probability"
 552                                 elif [ $probability -lt 100 ]; then
 553                                         probability="0.0$probability"
 554                                 elif [ $probability -lt 1000 ]; then
 555                                         probability="0.$probability"
 556                                 else
 557                                         probability="1"
 558                                 fi
 559
 560                                 probability="-m statistic --mode random --probability $probability"
 561
 562                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 563                         fi
 564                 fi
 565         fi
 566 }
 567
 568 mwan3_create_policies_iptables()
 569 {
 570         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 571
 572         policy="$1"
 573
 574         config_get last_resort $1 last_resort unreachable
 575
 576         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 577                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 578         fi
 579
 580         for IPT in "$IPT4" "$IPT6"; do
 581
 582                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 583                         $IPT -N mwan3_policy_$1
 584                 fi
 585
 586                 $IPT -F mwan3_policy_$1
 587
 588                 case "$last_resort" in
 589                         blackhole)
 590                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "blackhole" -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
 591                         ;;
 592                         default)
 593                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 594                         ;;
 595                         *)
 596                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "unreachable" -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
 597                         ;;
 598                 esac
 599         done
 600
 601         lowest_metric_v4=256
 602         total_weight_v4=0
 603
 604         lowest_metric_v6=256
 605         total_weight_v6=0
 606
 607         config_list_foreach $1 use_member mwan3_set_policy
 608 }
 609
 610 mwan3_set_policies_iptables()
 611 {
 612         config_foreach mwan3_create_policies_iptables policy
 613 }
 614
 615 mwan3_set_sticky_iptables()
 616 {
 617         local id iface
 618
 619         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 620
 621                 if [ "$iface" == "$1" ]; then
 622
 623                         mwan3_get_iface_id id $1
 624
 625                         [ -n "$id" ] || return 0
 626
 627                         for IPT in "$IPT4" "$IPT6"; do
 628                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 629                                         $IPT -I mwan3_rule_$rule -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/$MMX_MASK
 630                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/$MMX_MASK -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 631                                 fi
 632                         done
 633                 fi
 634         done
 635 }
 636
 637 mwan3_set_user_iptables_rule()
 638 {
 639         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 640
 641         rule="$1"
 642
 643         config_get sticky $1 sticky 0
 644         config_get timeout $1 timeout 600
 645         config_get ipset $1 ipset
 646         config_get proto $1 proto all
 647         config_get src_ip $1 src_ip 0.0.0.0/0
 648         config_get src_port $1 src_port 0:65535
 649         config_get dest_ip $1 dest_ip 0.0.0.0/0
 650         config_get dest_port $1 dest_port 0:65535
 651         config_get use_policy $1 use_policy
 652         config_get family $1 family any
 653
 654         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 655                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 656         fi
 657
 658         if [ -n "$ipset" ]; then
 659                 ipset="-m set --match-set $ipset dst"
 660         fi
 661
 662         if [ -n "$use_policy" ]; then
 663                 if [ "$use_policy" == "default" ]; then
 664                         policy="MARK --set-xmark $MMX_DEFAULT/$MMX_MASK"
 665                 elif [ "$use_policy" == "unreachable" ]; then
 666                         policy="MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK"
 667                 elif [ "$use_policy" == "blackhole" ]; then
 668                         policy="MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK"
 669                 else
 670                         if [ "$sticky" -eq 1 ]; then
 671
 672                                 policy="mwan3_policy_$use_policy"
 673
 674                                 for IPT in "$IPT4" "$IPT6"; do
 675                                         if ! $IPT -S $policy &> /dev/null; then
 676                                                 $IPT -N $policy
 677                                         fi
 678
 679                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 680                                                 $IPT -N mwan3_rule_$1
 681                                         fi
 682
 683                                         $IPT -F mwan3_rule_$1
 684                                 done
 685
 686                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout
 687                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout family inet6
 688                                 $IPS -! create mwan3_sticky_$rule list:set
 689                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 690                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 691
 692                                 config_foreach mwan3_set_sticky_iptables interface
 693
 694                                 for IPT in "$IPT4" "$IPT6"; do
 695                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/$MMX_MASK -j $policy
 696                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 697                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 698                                 done
 699
 700                                 policy="mwan3_rule_$1"
 701                         else
 702                                 policy="mwan3_policy_$use_policy"
 703
 704                                 for IPT in "$IPT4" "$IPT6"; do
 705                                         if ! $IPT -S $policy &> /dev/null; then
 706                                                 $IPT -N $policy
 707                                         fi
 708                                 done
 709
 710                         fi
 711                 fi
 712
 713                 if [ "$family" == "any" ]; then
 714
 715                         for IPT in "$IPT4" "$IPT6"; do
 716                                 case $proto in
 717                                         tcp|udp)
 718                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 719                                         ;;
 720                                         *)
 721                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 722                                         ;;
 723                                 esac
 724                         done
 725
 726                 elif [ "$family" == "ipv4" ]; then
 727
 728                         case $proto in
 729                                 tcp|udp)
 730                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 731                                 ;;
 732                                 *)
 733                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 734                                 ;;
 735                         esac
 736
 737                 elif [ "$family" == "ipv6" ]; then
 738
 739                         case $proto in
 740                                 tcp|udp)
 741                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 742                                 ;;
 743                                 *)
 744                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 745                                 ;;
 746                         esac
 747                 fi
 748         fi
 749 }
 750
 751 mwan3_set_user_rules()
 752 {
 753         local IPT
 754
 755         for IPT in "$IPT4" "$IPT6"; do
 756
 757                 if ! $IPT -S mwan3_rules &> /dev/null; then
 758                         $IPT -N mwan3_rules
 759                 fi
 760
 761                 $IPT -F mwan3_rules
 762         done
 763
 764         config_foreach mwan3_set_user_iptables_rule rule
 765 }
 766
 767 mwan3_set_iface_hotplug_state() {
 768         local iface=$1
 769         local state=$2
 770
 771         echo -n $state > $MWAN3_STATUS_DIR/iface_state/$iface
 772 }
 773
 774 mwan3_get_iface_hotplug_state() {
 775         local iface=$1
 776
 777         cat $MWAN3_STATUS_DIR/iface_state/$iface 2>/dev/null || echo "unknown"
 778 }
 779
 780 mwan3_report_iface_status()
 781 {
 782         local device result track_ips tracking IP IPT
 783
 784         mwan3_get_iface_id id $1
 785         network_get_device device $1
 786         config_get enabled "$1" enabled 0
 787         config_get family "$1" family ipv4
 788
 789         if [ "$family" == "ipv4" ]; then
 790                 IP="$IP4"
 791                 IPT="$IPT4"
 792         fi
 793
 794         if [ "$family" == "ipv6" ]; then
 795                 IP="$IP6"
 796                 IPT="$IPT6"
 797         fi
 798
 799         if [ -z "$id" -o -z "$device" ]; then
 800                 result="unknown"
 801         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 802                 result="$(mwan3_get_iface_hotplug_state $1)"
 803         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 804                 result="error"
 805         elif [ "$enabled" == "1" ]; then
 806                 result="offline"
 807         else
 808                 result="disabled"
 809         fi
 810
 811         mwan3_list_track_ips()
 812         {
 813                 track_ips="$1 $track_ips"
 814         }
 815         config_list_foreach $1 track_ip mwan3_list_track_ips
 816
 817         if [ -n "$track_ips" ]; then
 818                 if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
 819                         tracking="active"
 820                 else
 821                         tracking="down"
 822                 fi
 823         else
 824                 tracking="not enabled"
 825         fi
 826
 827         echo " interface $1 is $result and tracking is $tracking"
 828 }
 829
 830 mwan3_report_policies_v4()
 831 {
 832         local percent policy share total_weight weight iface
 833
 834         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 835                 echo "$policy:" | sed 's/mwan3_policy_//'
 836
 837                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 838
 839                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 840                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 841                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 842                                 percent=$(($weight*100/$total_weight))
 843                                 echo " $iface ($percent%)"
 844                         done
 845                 else
 846                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 847                 fi
 848
 849                 unset total_weight
 850
 851                 echo -e
 852         done
 853 }
 854
 855 mwan3_report_policies_v6()
 856 {
 857         local percent policy share total_weight weight iface
 858
 859         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 860                 echo "$policy:" | sed 's/mwan3_policy_//'
 861
 862                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 863
 864                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 865                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 866                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 867                                 percent=$(($weight*100/$total_weight))
 868                                 echo " $iface ($percent%)"
 869                         done
 870                 else
 871                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 872                 fi
 873
 874                 unset total_weight
 875
 876                 echo -e
 877         done
 878 }
 879
 880 mwan3_report_connected_v4()
 881 {
 882         local address
 883
 884         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 885                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 886                         echo " $address"
 887                 done
 888         fi
 889 }
 890
 891 mwan3_report_connected_v6()
 892 {
 893         local address
 894
 895         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 896                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 897                         echo " $address"
 898                 done
 899         fi
 900 }
 901
 902 mwan3_report_rules_v4()
 903 {
 904         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 905                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 906         fi
 907 }
 908
 909 mwan3_report_rules_v6()
 910 {
 911         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 912                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 913         fi
 914 }
 915
 916 mwan3_flush_conntrack()
 917 {
 918         local flush_conntrack
 919
 920         config_get flush_conntrack $1 flush_conntrack never
 921
 922         if [ -e "$CONNTRACK_FILE" ]; then
 923                 case $flush_conntrack in
 924                         ifup)
 925                                 [ "$3" = "ifup" ] && {
 926                                         echo f > ${CONNTRACK_FILE}
 927                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 928                                 }
 929                                 ;;
 930                         ifdown)
 931                                 [ "$3" = "ifdown" ] && {
 932                                         echo f > ${CONNTRACK_FILE}
 933                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 934                                 }
 935                                 ;;
 936                         always)
 937                                 echo f > ${CONNTRACK_FILE}
 938                                 $LOG info "connection tracking flushed on interface $1 ($2) $3"
 939                                 ;;
 940                         never)
 941                                 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
 942                                 ;;
 943                 esac
 944         else
 945                 $LOG warning "connection tracking not enabled"
 946         fi
 947 }
 948
 949 mwan3_track_clean()
 950 {
 951         rm -rf "$MWAN3_STATUS_DIR/${1}" &> /dev/null
 952         [ -d "$MWAN3_STATUS_DIR" ] && {
 953                 if [ -z "$(ls -A "$MWAN3_STATUS_DIR")" ]; then
 954                         rm -rf "$MWAN3_STATUS_DIR"
 955                 fi
 956         }
 957 }