net/mwan3/files/lib/mwan3/mwan3.sh

   1 #!/bin/sh
   2
   3 IP4="ip -4"
   4 IP6="ip -6"
   5 IPS="ipset"
   6 IPT4="iptables -t mangle -w"
   7 IPT6="ip6tables -t mangle -w"
   8 LOG="logger -t mwan3[$$] -p"
   9 CONNTRACK_FILE="/proc/net/nf_conntrack"
  10
  11 MWAN3_STATUS_DIR="/var/run/mwan3track"
  12
  13 # mwan3's MARKing mask (at least 3 bits should be set)
  14 MMX_MASK=0xff00
  15
  16 # counts how many bits are set to 1
  17 # n&(n-1) clears the lowest bit set to 1
  18 mwan3_count_one_bits()
  19 {
  20         local count n
  21         count=0
  22         n=$(($1))
  23         while [ "$n" -gt "0" ]; do
  24                 n=$((n&(n-1)))
  25                 count=$((count+1))
  26         done
  27         echo $count
  28 }
  29
  30 # maps the 1st parameter so it only uses the bits allowed by the bitmask (2nd parameter)
  31 # which means spreading the bits of the 1st parameter to only use the bits that are set to 1 in the 2nd parameter
  32 # 0 0 0 0 0 1 0 1 (0x05) 1st parameter
  33 # 1 0 1 0 1 0 1 0 (0xAA) 2nd parameter
  34 #     1   0   1          result
  35 mwan3_id2mask()
  36 {
  37         local bit_msk bit_val result
  38         bit_val=0
  39         result=0
  40         for bit_msk in $(seq 0 31); do
  41                 if [ $((($2>>bit_msk)&1)) = "1" ]; then
  42                         if [ $((($1>>bit_val)&1)) = "1" ]; then
  43                                 result=$((result|(1<<bit_msk)))
  44                         fi
  45                         bit_val=$((bit_val+1))
  46                 fi
  47         done
  48         printf "0x%x" $result
  49 }
  50
  51 # mark mask constants
  52 MM_BIT_CNT=$(mwan3_count_one_bits MMX_MASK)
  53 MM_DEFAULT=$(((1<<MM_BIT_CNT)-1))
  54 MM_BLACKHOLE=$(($MM_DEFAULT-2))
  55 MM_UNREACHABLE=$(($MM_DEFAULT-1))
  56
  57 # MMX_DEFAULT should equal MMX_MASK
  58 MMX_DEFAULT=$(mwan3_id2mask MM_DEFAULT MMX_MASK)
  59 MMX_BLACKHOLE=$(mwan3_id2mask MM_BLACKHOLE MMX_MASK)
  60 MMX_UNREACHABLE=$(mwan3_id2mask MM_UNREACHABLE MMX_MASK)
  61
  62 mwan3_lock() {
  63         lock /var/run/mwan3.lock
  64 }
  65
  66 mwan3_unlock() {
  67         lock -u /var/run/mwan3.lock
  68 }
  69
  70 mwan3_lock_clean() {
  71         rm -rf /var/run/mwan3.lock
  72 }
  73
  74 mwan3_get_iface_id()
  75 {
  76         local _tmp _iface _iface_count
  77
  78         _iface="$2"
  79
  80         mwan3_get_id()
  81         {
  82                 let _iface_count++
  83                 [ "$1" == "$_iface" ] && _tmp=$_iface_count
  84         }
  85         config_foreach mwan3_get_id interface
  86         export "$1=$_tmp"
  87 }
  88
  89 mwan3_set_connected_iptables()
  90 {
  91         local connected_network_v4 connected_network_v6
  92
  93         $IPS -! create mwan3_connected_v4 hash:net
  94         $IPS create mwan3_connected_v4_temp hash:net
  95
  96         for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
  97                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
  98         done
  99
 100         for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 101                 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
 102         done
 103
 104         $IPS add mwan3_connected_v4_temp 224.0.0.0/3
 105
 106         $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
 107         $IPS destroy mwan3_connected_v4_temp
 108
 109         $IPS -! create mwan3_connected_v6 hash:net family inet6
 110         $IPS create mwan3_connected_v6_temp hash:net family inet6
 111
 112         for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 113                 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
 114         done
 115
 116         $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
 117         $IPS destroy mwan3_connected_v6_temp
 118
 119         $IPS -! create mwan3_connected list:set
 120         $IPS -! add mwan3_connected mwan3_connected_v4
 121         $IPS -! add mwan3_connected mwan3_connected_v6
 122 }
 123
 124 mwan3_set_general_rules()
 125 {
 126         local IP
 127
 128         for IP in "$IP4" "$IP6"; do
 129
 130                 RULE_NO=$(($MM_BLACKHOLE+2000))
 131                 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
 132                         $IP rule add pref $RULE_NO fwmark $MMX_BLACKHOLE/$MMX_MASK blackhole
 133                 fi
 134
 135                 RULE_NO=$(($MM_UNREACHABLE+2000))
 136                 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
 137                         $IP rule add pref $RULE_NO fwmark $MMX_UNREACHABLE/$MMX_MASK unreachable
 138                 fi
 139         done
 140 }
 141
 142 mwan3_set_general_iptables()
 143 {
 144         local IPT
 145
 146         for IPT in "$IPT4" "$IPT6"; do
 147
 148                 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
 149                         $IPT -N mwan3_ifaces_in
 150                 fi
 151
 152                 if ! $IPT -S mwan3_connected &> /dev/null; then
 153                         $IPT -N mwan3_connected
 154                         $IPS -! create mwan3_connected list:set
 155                         $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 156                 fi
 157
 158                 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
 159                         $IPT -N mwan3_ifaces_out
 160                 fi
 161
 162                 if ! $IPT -S mwan3_rules &> /dev/null; then
 163                         $IPT -N mwan3_rules
 164                 fi
 165
 166                 if ! $IPT -S mwan3_hook &> /dev/null; then
 167                         $IPT -N mwan3_hook
 168                         $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
 169                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_in
 170                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_connected
 171                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_out
 172                         $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_rules
 173                         $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
 174                         $IPT -A mwan3_hook -m mark ! --mark $MMX_DEFAULT/$MMX_MASK -j mwan3_connected
 175                 fi
 176
 177                 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
 178                         $IPT -A PREROUTING -j mwan3_hook
 179                 fi
 180
 181                 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
 182                         $IPT -A OUTPUT -j mwan3_hook
 183                 fi
 184         done
 185 }
 186
 187 mwan3_create_iface_iptables()
 188 {
 189         local id family src_ip src_ipv6
 190
 191         config_get family $1 family ipv4
 192         mwan3_get_iface_id id $1
 193
 194         [ -n "$id" ] || return 0
 195
 196         if [ "$family" == "ipv4" ]; then
 197
 198                 ubus call network.interface.${1}_4 status &>/dev/null
 199                 if [ "$?" -eq "0" ]; then
 200                         network_get_ipaddr src_ip ${1}_4
 201                 else
 202                         network_get_ipaddr src_ip $1
 203                 fi
 204
 205                 $IPS -! create mwan3_connected list:set
 206
 207                 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
 208                         $IPT4 -N mwan3_ifaces_in
 209                 fi
 210
 211                 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
 212                         $IPT4 -N mwan3_ifaces_out
 213                 fi
 214
 215                 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
 216                         $IPT4 -N mwan3_iface_in_$1
 217                 fi
 218
 219                 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
 220                         $IPT4 -N mwan3_iface_out_$1
 221                 fi
 222
 223                 $IPT4 -F mwan3_iface_in_$1
 224                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 225                 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 226
 227                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 228                 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
 229
 230                 $IPT4 -F mwan3_iface_out_$1
 231                 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 232
 233                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 234                 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
 235         fi
 236
 237         if [ "$family" == "ipv6" ]; then
 238
 239                 ubus call network.interface.${1}_6 status &>/dev/null
 240                 if [ "$?" -eq "0" ]; then
 241                         network_get_ipaddr6 src_ipv6 ${1}_6
 242                 else
 243                         network_get_ipaddr6 src_ipv6 $1
 244                 fi
 245
 246                 $IPS -! create mwan3_connected_v6 hash:net family inet6
 247
 248                 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
 249                         $IPT6 -N mwan3_ifaces_in
 250                 fi
 251
 252                 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
 253                         $IPT6 -N mwan3_ifaces_out
 254                 fi
 255
 256                 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
 257                         $IPT6 -N mwan3_iface_in_$1
 258                 fi
 259
 260                 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
 261                         $IPT6 -N mwan3_iface_out_$1
 262                 fi
 263
 264                 $IPT6 -F mwan3_iface_in_$1
 265                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 266                 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 267
 268                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 269                 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
 270
 271                 $IPT6 -F mwan3_iface_out_$1
 272                 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 273
 274                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 275                 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
 276         fi
 277 }
 278
 279 mwan3_delete_iface_iptables()
 280 {
 281         config_get family $1 family ipv4
 282
 283         if [ "$family" == "ipv4" ]; then
 284
 285                 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 286                 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
 287                 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
 288
 289                 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 290                 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
 291                 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
 292         fi
 293
 294         if [ "$family" == "ipv6" ]; then
 295
 296                 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
 297                 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
 298                 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
 299
 300                 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
 301                 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
 302                 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
 303         fi
 304 }
 305
 306 mwan3_create_iface_route()
 307 {
 308         local id route_args
 309
 310         config_get family $1 family ipv4
 311         mwan3_get_iface_id id $1
 312
 313         [ -n "$id" ] || return 0
 314
 315         if [ "$family" == "ipv4" ]; then
 316                 ubus call network.interface.${1}_4 status &>/dev/null
 317                 if [ "$?" -eq "0" ]; then
 318                         network_get_gateway route_args ${1}_4
 319                 else
 320                         network_get_gateway route_args $1
 321                 fi
 322
 323                 route_args="via $route_args dev $2"
 324
 325                 $IP4 route flush table $id
 326                 $IP4 route add table $id default $route_args
 327         fi
 328
 329         if [ "$family" == "ipv6" ]; then
 330
 331                 ubus call network.interface.${1}_6 status &>/dev/null
 332                 if [ "$?" -eq "0" ]; then
 333                         network_get_gateway6 route_args ${1}_6
 334                 else
 335                         network_get_gateway6 route_args $1
 336                 fi
 337
 338                 route_args="via $route_args dev $2"
 339
 340                 $IP6 route flush table $id
 341                 $IP6 route add table $id default $route_args
 342         fi
 343 }
 344
 345 mwan3_delete_iface_route()
 346 {
 347         local id
 348
 349         config_get family $1 family ipv4
 350         mwan3_get_iface_id id $1
 351
 352         [ -n "$id" ] || return 0
 353
 354         if [ "$family" == "ipv4" ]; then
 355                 $IP4 route flush table $id
 356         fi
 357
 358         if [ "$family" == "ipv6" ]; then
 359                 $IP6 route flush table $id
 360         fi
 361 }
 362
 363 mwan3_create_iface_rules()
 364 {
 365         local id family
 366
 367         config_get family $1 family ipv4
 368         mwan3_get_iface_id id $1
 369
 370         [ -n "$id" ] || return 0
 371
 372         if [ "$family" == "ipv4" ]; then
 373
 374                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 375                         $IP4 rule del pref $(($id+1000))
 376                 done
 377
 378                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 379                         $IP4 rule del pref $(($id+2000))
 380                 done
 381
 382                 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
 383                 $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
 384         fi
 385
 386         if [ "$family" == "ipv6" ]; then
 387
 388                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 389                         $IP6 rule del pref $(($id+1000))
 390                 done
 391
 392                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 393                         $IP6 rule del pref $(($id+2000))
 394                 done
 395
 396                 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
 397                 $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
 398         fi
 399 }
 400
 401 mwan3_delete_iface_rules()
 402 {
 403         local id family
 404
 405         config_get family $1 family ipv4
 406         mwan3_get_iface_id id $1
 407
 408         [ -n "$id" ] || return 0
 409
 410         if [ "$family" == "ipv4" ]; then
 411
 412                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 413                         $IP4 rule del pref $(($id+1000))
 414                 done
 415
 416                 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 417                         $IP4 rule del pref $(($id+2000))
 418                 done
 419         fi
 420
 421         if [ "$family" == "ipv6" ]; then
 422
 423                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
 424                         $IP6 rule del pref $(($id+1000))
 425                 done
 426
 427                 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
 428                         $IP6 rule del pref $(($id+2000))
 429                 done
 430         fi
 431 }
 432
 433 mwan3_delete_iface_ipset_entries()
 434 {
 435         local id setname entry
 436
 437         mwan3_get_iface_id id $1
 438
 439         [ -n "$id" ] || return 0
 440
 441         for setname in $(ipset -n list | grep ^mwan3_sticky_); do
 442                 for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
 443                         $IPS del $setname $entry
 444                 done
 445         done
 446 }
 447
 448 mwan3_track()
 449 {
 450         local track_ip track_ips
 451
 452         mwan3_list_track_ips()
 453         {
 454                 track_ips="$1 $track_ips"
 455         }
 456         config_list_foreach $1 track_ip mwan3_list_track_ips
 457
 458         kill $(pgrep -f "mwan3track $1 $2") &> /dev/null
 459         if [ -n "$track_ips" ]; then
 460                 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track "$1" "$2" "$3" "$4" $track_ips &
 461         fi
 462 }
 463
 464 mwan3_track_signal()
 465 {
 466         local pid
 467
 468         pid="$(pgrep -f "mwan3track $1 $2")"
 469         if [ "${pid}" != "" ]; then
 470                 kill -USR1 "${pid}"
 471         else
 472                 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
 473         fi
 474 }
 475
 476 mwan3_set_policy()
 477 {
 478         local iface_count id iface family metric probability weight
 479
 480         config_get iface $1 interface
 481         config_get metric $1 metric 1
 482         config_get weight $1 weight 1
 483
 484         [ -n "$iface" ] || return 0
 485
 486         mwan3_get_iface_id id $iface
 487
 488         [ -n "$id" ] || return 0
 489
 490         config_get family $iface family ipv4
 491
 492         if [ "$family" == "ipv4" ]; then
 493
 494                 if [ -n "$($IP4 route list table $id)" ]; then
 495                         if [ "$metric" -lt "$lowest_metric_v4" ]; then
 496
 497                                 total_weight_v4=$weight
 498                                 $IPT4 -F mwan3_policy_$policy
 499                                 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 500
 501                                 lowest_metric_v4=$metric
 502
 503                         elif [ "$metric" -eq "$lowest_metric_v4" ]; then
 504
 505                                 total_weight_v4=$(($total_weight_v4+$weight))
 506                                 probability=$(($weight*1000/$total_weight_v4))
 507
 508                                 if [ "$probability" -lt 10 ]; then
 509                                         probability="0.00$probability"
 510                                 elif [ $probability -lt 100 ]; then
 511                                         probability="0.0$probability"
 512                                 elif [ $probability -lt 1000 ]; then
 513                                         probability="0.$probability"
 514                                 else
 515                                         probability="1"
 516                                 fi
 517
 518                                 probability="-m statistic --mode random --probability $probability"
 519
 520                                 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 521                         fi
 522                 fi
 523         fi
 524
 525         if [ "$family" == "ipv6" ]; then
 526
 527                 if [ -n "$($IP6 route list table $id)" ]; then
 528                         if [ "$metric" -lt "$lowest_metric_v6" ]; then
 529
 530                                 total_weight_v6=$weight
 531                                 $IPT6 -F mwan3_policy_$policy
 532                                 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 533
 534                                 lowest_metric_v6=$metric
 535
 536                         elif [ "$metric" -eq "$lowest_metric_v6" ]; then
 537
 538                                 total_weight_v6=$(($total_weight_v6+$weight))
 539                                 probability=$(($weight*1000/$total_weight_v6))
 540
 541                                 if [ "$probability" -lt 10 ]; then
 542                                         probability="0.00$probability"
 543                                 elif [ $probability -lt 100 ]; then
 544                                         probability="0.0$probability"
 545                                 elif [ $probability -lt 1000 ]; then
 546                                         probability="0.$probability"
 547                                 else
 548                                         probability="1"
 549                                 fi
 550
 551                                 probability="-m statistic --mode random --probability $probability"
 552
 553                                 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 554                         fi
 555                 fi
 556         fi
 557 }
 558
 559 mwan3_create_policies_iptables()
 560 {
 561         local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
 562
 563         policy="$1"
 564
 565         config_get last_resort $1 last_resort unreachable
 566
 567         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 568                 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
 569         fi
 570
 571         for IPT in "$IPT4" "$IPT6"; do
 572
 573                 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
 574                         $IPT -N mwan3_policy_$1
 575                 fi
 576
 577                 $IPT -F mwan3_policy_$1
 578
 579                 case "$last_resort" in
 580                         blackhole)
 581                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "blackhole" -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
 582                         ;;
 583                         default)
 584                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
 585                         ;;
 586                         *)
 587                                 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "unreachable" -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
 588                         ;;
 589                 esac
 590         done
 591
 592         lowest_metric_v4=256
 593         total_weight_v4=0
 594
 595         lowest_metric_v6=256
 596         total_weight_v6=0
 597
 598         config_list_foreach $1 use_member mwan3_set_policy
 599 }
 600
 601 mwan3_set_policies_iptables()
 602 {
 603         config_foreach mwan3_create_policies_iptables policy
 604 }
 605
 606 mwan3_set_sticky_iptables()
 607 {
 608         local id iface
 609
 610         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 611
 612                 if [ "$iface" == "$1" ]; then
 613
 614                         mwan3_get_iface_id id $1
 615
 616                         [ -n "$id" ] || return 0
 617
 618                         for IPT in "$IPT4" "$IPT6"; do
 619                                 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
 620                                         $IPT -I mwan3_rule_$rule -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/$MMX_MASK
 621                                         $IPT -I mwan3_rule_$rule -m mark --mark 0/$MMX_MASK -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 622                                 fi
 623                         done
 624                 fi
 625         done
 626 }
 627
 628 mwan3_set_user_iptables_rule()
 629 {
 630         local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
 631
 632         rule="$1"
 633
 634         config_get sticky $1 sticky 0
 635         config_get timeout $1 timeout 600
 636         config_get ipset $1 ipset
 637         config_get proto $1 proto all
 638         config_get src_ip $1 src_ip 0.0.0.0/0
 639         config_get src_port $1 src_port 0:65535
 640         config_get dest_ip $1 dest_ip 0.0.0.0/0
 641         config_get dest_port $1 dest_port 0:65535
 642         config_get use_policy $1 use_policy
 643         config_get family $1 family any
 644
 645         if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
 646                 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
 647         fi
 648
 649         if [ -n "$ipset" ]; then
 650                 ipset="-m set --match-set $ipset dst"
 651         fi
 652
 653         if [ -n "$use_policy" ]; then
 654                 if [ "$use_policy" == "default" ]; then
 655                         policy="MARK --set-xmark $MMX_DEFAULT/$MMX_MASK"
 656                 elif [ "$use_policy" == "unreachable" ]; then
 657                         policy="MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK"
 658                 elif [ "$use_policy" == "blackhole" ]; then
 659                         policy="MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK"
 660                 else
 661                         if [ "$sticky" -eq 1 ]; then
 662
 663                                 policy="mwan3_policy_$use_policy"
 664
 665                                 for IPT in "$IPT4" "$IPT6"; do
 666                                         if ! $IPT -S $policy &> /dev/null; then
 667                                                 $IPT -N $policy
 668                                         fi
 669
 670                                         if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
 671                                                 $IPT -N mwan3_rule_$1
 672                                         fi
 673
 674                                         $IPT -F mwan3_rule_$1
 675                                 done
 676
 677                                 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout
 678                                 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout family inet6
 679                                 $IPS -! create mwan3_sticky_$rule list:set
 680                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
 681                                 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
 682
 683                                 config_foreach mwan3_set_sticky_iptables interface
 684
 685                                 for IPT in "$IPT4" "$IPT6"; do
 686                                         $IPT -A mwan3_rule_$1 -m mark --mark 0/$MMX_MASK -j $policy
 687                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
 688                                         $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
 689                                 done
 690
 691                                 policy="mwan3_rule_$1"
 692                         else
 693                                 policy="mwan3_policy_$use_policy"
 694
 695                                 for IPT in "$IPT4" "$IPT6"; do
 696                                         if ! $IPT -S $policy &> /dev/null; then
 697                                                 $IPT -N $policy
 698                                         fi
 699                                 done
 700
 701                         fi
 702                 fi
 703
 704                 if [ "$family" == "any" ]; then
 705
 706                         for IPT in "$IPT4" "$IPT6"; do
 707                                 case $proto in
 708                                         tcp|udp)
 709                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 710                                         ;;
 711                                         *)
 712                                         $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 713                                         ;;
 714                                 esac
 715                         done
 716
 717                 elif [ "$family" == "ipv4" ]; then
 718
 719                         case $proto in
 720                                 tcp|udp)
 721                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 722                                 ;;
 723                                 *)
 724                                 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 725                                 ;;
 726                         esac
 727
 728                 elif [ "$family" == "ipv6" ]; then
 729
 730                         case $proto in
 731                                 tcp|udp)
 732                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 733                                 ;;
 734                                 *)
 735                                 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
 736                                 ;;
 737                         esac
 738                 fi
 739         fi
 740 }
 741
 742 mwan3_set_user_rules()
 743 {
 744         local IPT
 745
 746         for IPT in "$IPT4" "$IPT6"; do
 747
 748                 if ! $IPT -S mwan3_rules &> /dev/null; then
 749                         $IPT -N mwan3_rules
 750                 fi
 751
 752                 $IPT -F mwan3_rules
 753         done
 754
 755         config_foreach mwan3_set_user_iptables_rule rule
 756 }
 757
 758 mwan3_report_iface_status()
 759 {
 760         local device result track_ips tracking IP IPT
 761
 762         mwan3_get_iface_id id $1
 763         network_get_device device $1
 764         config_get enabled "$1" enabled 0
 765         config_get family "$1" family ipv4
 766
 767         if [ "$family" == "ipv4" ]; then
 768                 IP="$IP4"
 769                 IPT="$IPT4"
 770         fi
 771
 772         if [ "$family" == "ipv6" ]; then
 773                 IP="$IP6"
 774                 IPT="$IPT6"
 775         fi
 776
 777         if [ -z "$id" -o -z "$device" ]; then
 778                 result="unknown"
 779         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 780                 result="online"
 781         elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
 782                 result="error"
 783         else
 784                 if [ "$enabled" == "1" ]; then
 785                         result="offline"
 786                 else
 787                         result="disabled"
 788                 fi
 789         fi
 790
 791         mwan3_list_track_ips()
 792         {
 793                 track_ips="$1 $track_ips"
 794         }
 795         config_list_foreach $1 track_ip mwan3_list_track_ips
 796
 797         if [ -n "$track_ips" ]; then
 798                 if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
 799                         tracking="active"
 800                 else
 801                         tracking="down"
 802                 fi
 803         else
 804                 tracking="not enabled"
 805         fi
 806
 807         echo " interface $1 is $result and tracking is $tracking"
 808 }
 809
 810 mwan3_report_policies_v4()
 811 {
 812         local percent policy share total_weight weight iface
 813
 814         for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 815                 echo "$policy:" | sed 's/mwan3_policy_//'
 816
 817                 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 818
 819                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 820                         for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 821                                 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 822                                 percent=$(($weight*100/$total_weight))
 823                                 echo " $iface ($percent%)"
 824                         done
 825                 else
 826                         echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 827                 fi
 828
 829                 unset total_weight
 830
 831                 echo -e
 832         done
 833 }
 834
 835 mwan3_report_policies_v6()
 836 {
 837         local percent policy share total_weight weight iface
 838
 839         for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
 840                 echo "$policy:" | sed 's/mwan3_policy_//'
 841
 842                 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 843
 844                 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
 845                         for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
 846                                 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
 847                                 percent=$(($weight*100/$total_weight))
 848                                 echo " $iface ($percent%)"
 849                         done
 850                 else
 851                         echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
 852                 fi
 853
 854                 unset total_weight
 855
 856                 echo -e
 857         done
 858 }
 859
 860 mwan3_report_connected_v4()
 861 {
 862         local address
 863
 864         if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
 865                 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
 866                         echo " $address"
 867                 done
 868         fi
 869 }
 870
 871 mwan3_report_connected_v6()
 872 {
 873         local address
 874
 875         if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
 876                 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
 877                         echo " $address"
 878                 done
 879         fi
 880 }
 881
 882 mwan3_report_rules_v4()
 883 {
 884         if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
 885                 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 886         fi
 887 }
 888
 889 mwan3_report_rules_v6()
 890 {
 891         if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
 892                 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
 893         fi
 894 }
 895
 896 mwan3_flush_conntrack()
 897 {
 898         local flush_conntrack
 899
 900         config_get flush_conntrack $1 flush_conntrack never
 901
 902         if [ -e "$CONNTRACK_FILE" ]; then
 903                 case $flush_conntrack in
 904                         ifup)
 905                                 [ "$3" = "ifup" ] && {
 906                                         echo f > ${CONNTRACK_FILE}
 907                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 908                                 }
 909                                 ;;
 910                         ifdown)
 911                                 [ "$3" = "ifdown" ] && {
 912                                         echo f > ${CONNTRACK_FILE}
 913                                         $LOG info "connection tracking flushed on interface $1 ($2) $3"
 914                                 }
 915                                 ;;
 916                         always)
 917                                 echo f > ${CONNTRACK_FILE}
 918                                 $LOG info "connection tracking flushed on interface $1 ($2) $3"
 919                                 ;;
 920                         never)
 921                                 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
 922                                 ;;
 923                 esac
 924         else
 925                 $LOG warning "connection tracking not enabled"
 926         fi
 927 }
 928
 929 mwan3_track_clean()
 930 {
 931         rm -rf "$MWAN3_STATUS_DIR/${1}" &> /dev/null
 932         [ -d "$MWAN3_STATUS_DIR" ] && {
 933                 if [ -z "$(ls -A "$MWAN3_STATUS_DIR")" ]; then
 934                         rm -rf "$MWAN3_STATUS_DIR"
 935                 fi
 936         }
 937 }