Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(init): cleanup script #34

Merged
merged 1 commit into from
Nov 2, 2021
Merged

chore(init): cleanup script #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk

PKG_NAME:=UA2F
PKG_VERSION:=3.7
PKG_RELEASE:=15
PKG_RELEASE:=16

PKG_LICENSE:=GPL-3.0-only
PKG_LICENSE_FILE:=LICENSE
Expand All @@ -15,7 +15,8 @@ define Package/ua2f
SUBMENU:=Routing and Redirection
TITLE:=Change User-Agent to Fwords
URL:=https://github.com/Zxilly/UA2F
DEPENDS:=+ipset +iptables-mod-nfqueue +libnetfilter-conntrack +libnetfilter-queue
DEPENDS:=+ipset +iptables-mod-conntrack-extra +iptables-mod-nfqueue \
+libnetfilter-conntrack +libnetfilter-queue
endef

define Package/ua2f/description
Expand Down
104 changes: 54 additions & 50 deletions files/ua2f.init
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,79 +5,83 @@
USE_PROCD=1

START=99
STOP=10

NAME="ua2f"
PROG="/usr/bin/$NAME"
IPT_M="iptables -t mangle"

FW_DIR="/var/etc"
FW_CONF="$FW_DIR/ua2f.include"

start_service() {
config_load "$NAME"

local enabled
config_get enabled "enabled" "enabled" "0"
config_get_bool enabled "enabled" "enabled" "0"
[ "$enabled" -eq "1" ] || exit 1

local handle_fw
local handle_tls
local handle_intranet
config_get handle_fw "firewall" "handle_fw"
config_get handle_tls "firewall" "handle_tls"
config_get handle_intranet "firewall" "handle_intranet"
local handle_fw handle_tls handle_intranet
config_get_bool handle_fw "firewall" "handle_fw"
config_get_bool handle_tls "firewall" "handle_tls"
config_get_bool handle_intranet "firewall" "handle_intranet"

procd_open_instance "$NAME"
procd_set_param command "$NAME"
procd_set_param stdout 1
procd_set_param stderr 1
procd_set_param respawn
procd_close_instance

local wan
wan=$(route -n | grep UG | awk '{print $2}')
procd_set_param command "$PROG"

[ "$handle_fw" -eq "1" ] && {
ipset create nohttp hash:ip,port hashsize 16384 timeout 300
iptables -t mangle -N ua2f
iptables -t mangle -A ua2f -d 10.0.0.0/8 -j RETURN
iptables -t mangle -A ua2f -d 172.16.0.0/12 -j RETURN
iptables -t mangle -A ua2f -d 192.168.0.0/16 -j RETURN
$IPT_M -N ua2f
$IPT_M -A ua2f -d 10.0.0.0/8 -j RETURN
$IPT_M -A ua2f -d 172.16.0.0/12 -j RETURN
$IPT_M -A ua2f -d 192.168.0.0/16 -j RETURN
$IPT_M -A ua2f -d 0.0.0.0/8 -j RETURN
$IPT_M -A ua2f -d 127.0.0.0/8 -j RETURN
$IPT_M -A ua2f -d 169.254.0.0/16 -j RETURN
$IPT_M -A ua2f -d 224.0.0.0/4 -j RETURN
$IPT_M -A ua2f -d 240.0.0.0/4 -j RETURN # 不处理流向保留地址的包
$IPT_M -A ua2f -p tcp --dport 443 -j RETURN
$IPT_M -A ua2f -p tcp --dport 22 -j RETURN # 不处理 SSH
[ "$handle_tls" -eq "1" ] || $IPT_M -A ua2f -p tcp --dport 443 -j RETURN # 不处理 HTTPS
$IPT_M -A ua2f -p tcp --dport 80 -j CONNMARK --set-mark 44
$IPT_M -A ua2f -m connmark --mark 43 -j RETURN # 不处理标记为非 http 的流 (实验性)
$IPT_M -A ua2f -m set --match-set nohttp dst,dst -j RETURN
$IPT_M -A ua2f -j NFQUEUE --queue-num 10010
$IPT_M -A FORWARD -p tcp -m conntrack --ctdir ORIGINAL -j ua2f
$IPT_M -A FORWARD -p tcp -m conntrack --ctdir REPLY

[ "$handle_intranet" -eq "1" ] && {
[[ $wan =~ ^10. ]] && {
iptables -t mangle -D ua2f 1
}
( echo "$wan" | grep -Eq "^172\.((1[6-9])|(2[0-9])|(3[0-1]))\." ) && {
iptables -t mangle -D ua2f 2
}
[[ $wan =~ ^192.168 ]] && {
iptables -t mangle -D ua2f 3
}
local wan="$(route -n | grep UG | awk '{print $2}')"

if [[ "$wan" =~ ^"10." ]]; then
$IPT_M -D ua2f 1
elif echo "$wan" | grep -Eq "^172\.((1[6-9])|(2[0-9])|(3[0-1]))\."; then
$IPT_M -D ua2f 2
elif [[ "$wan" =~ ^"192.168" ]]; then
$IPT_M -D ua2f 3
fi
}
iptables -t mangle -A ua2f -d 0.0.0.0/8 -j RETURN
iptables -t mangle -A ua2f -d 127.0.0.0/8 -j RETURN
iptables -t mangle -A ua2f -d 169.254.0.0/16 -j RETURN
iptables -t mangle -A ua2f -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A ua2f -d 240.0.0.0/4 -j RETURN # 不处理流向保留地址的包
iptables -t mangle -A ua2f -p tcp --dport 443 -j RETURN
iptables -t mangle -A ua2f -p tcp --dport 22 -j RETURN # 不处理 SSH
[ "$handle_tls" -eq "1" ] || iptables -t mangle -A ua2f -p tcp --dport 443 -j RETURN # 不处理 HTTPS
iptables -t mangle -A ua2f -p tcp --dport 80 -j CONNMARK --set-mark 44
iptables -t mangle -A ua2f -m connmark --mark 43 -j RETURN # 不处理标记为非 http 的流 (实验性)
iptables -t mangle -A ua2f -m set --set nohttp dst,dst -j RETURN
iptables -t mangle -A ua2f -j NFQUEUE --queue-num 10010
iptables -t mangle -A FORWARD -p tcp -m conntrack --ctdir ORIGINAL -j ua2f
iptables -t mangle -A FORWARD -p tcp -m conntrack --ctdir REPLY

mkdir -p "$FW_DIR"
echo -e "/etc/init.d/$NAME restart" > "$FW_CONF"
}

mkdir -p "$FW_DIR"
echo -e "/etc/init.d/$NAME restart" > "$FW_CONF"
procd_set_param stdout 1
procd_set_param stderr 1
procd_set_param respawn

procd_close_instance
}

stop_service() {
iptables -t mangle -D FORWARD -p tcp -m conntrack --ctdir ORIGINAL -j ua2f
iptables -t mangle -D FORWARD -p tcp -m conntrack --ctdir REPLY
iptables -t mangle -F ua2f
iptables -t mangle -X ua2f
ipset destroy nohttp
rm -f "$FW_CONF"
(
$IPT_M -D FORWARD -p tcp -m conntrack --ctdir ORIGINAL -j ua2f
$IPT_M -D FORWARD -p tcp -m conntrack --ctdir REPLY
$IPT_M -F ua2f
$IPT_M -X ua2f
ipset destroy nohttp
echo > "$FW_CONF"
) 2>"/dev/null"
}

reload_service() {
Expand Down