ASR_BASE
Change-Id: Icf3719cc0afe3eeb3edc7fa80a2eb5199ca9dda1
diff --git a/external/subpack/net/shadowsocks-libev/files/ss-rules b/external/subpack/net/shadowsocks-libev/files/ss-rules
new file mode 100755
index 0000000..ed033af
--- /dev/null
+++ b/external/subpack/net/shadowsocks-libev/files/ss-rules
@@ -0,0 +1,298 @@
+#!/bin/sh -e
+#
+# Copyright (C) 2017 Yousong Zhou <yszhou4tech@gmail.com>
+#
+# The design idea was derived from ss-rules by Jian Chang <aa65535@live.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+__errmsg() {
+ echo "ss-rules: $*" >&2
+}
+
+if [ "$1" = "-6" ]; then
+ if ! ip6tables -t nat -L -n &>/dev/null; then
+ __errmsg "Skipping ipv6. Requires ip6tables-mod-nat"
+ exit 1
+ fi
+ o_use_ipv6=1; shift
+fi
+
+ss_rules_usage() {
+ cat >&2 <<EOF
+Usage: ss-rules [options]
+
+ -6 Operate on address family IPv6
+ When present, must be the first argument
+ -h, --help Show this help message then exit
+ -f, --flush Flush rules, ipset then exit
+ -l <port> Local port number of ss-redir with TCP mode
+ -L <port> Local port number of ss-redir with UDP mode
+ -s <ips> List of ip addresses of remote shadowsocks server
+ --ifnames Only apply rules on packets from these ifnames
+ --src-bypass <ips|cidr>
+ --src-forward <ips|cidr>
+ --src-checkdst <ips|cidr>
+ --src-default <bypass|forward|checkdst>
+ Packets will have their src ip checked in order against
+ bypass, forward, checkdst list and will bypass, forward
+ through, or continue to have their dst ip checked
+ respectively on the first match. Otherwise, --src-default
+ decide the default action
+ --dst-bypass <ips|cidr>
+ --dst-forward <ips|cidr>
+ --dst-bypass-file <file>
+ --dst-forward-file <file>
+ --dst-default <bypass|forward>
+ Same as with their --src-xx equivalent
+ --dst-forward-recentrst
+ Forward those packets whose destinations have recently
+ sent to us multiple tcp-rst packets
+ --local-default <bypass|forward|checkdst>
+ Default action for local out TCP traffic
+
+The following ipsets will be created by ss-rules. They are also intended to be
+populated by other programs like dnsmasq with ipset support
+
+ ss_rules_src_bypass
+ ss_rules_src_forward
+ ss_rules_src_checkdst
+ ss_rules_dst_bypass
+ ss_rules_dst_forward
+EOF
+}
+
+o_dst_bypass4_="
+ 0.0.0.0/8
+ 10.0.0.0/8
+ 100.64.0.0/10
+ 127.0.0.0/8
+ 169.254.0.0/16
+ 172.16.0.0/12
+ 192.0.0.0/24
+ 192.0.2.0/24
+ 192.31.196.0/24
+ 192.52.193.0/24
+ 192.88.99.0/24
+ 192.168.0.0/16
+ 192.175.48.0/24
+ 198.18.0.0/15
+ 198.51.100.0/24
+ 203.0.113.0/24
+ 224.0.0.0/4
+ 240.0.0.0/4
+ 255.255.255.255
+"
+o_dst_bypass6_="
+ ::1/128
+ ::/128
+ ::ffff:0:0/96
+ 64:ff9b:1::/48
+ 100::/64
+ 2001:2::/48
+ 2001:db8::/32
+ fe80::/10
+ 2001::/23
+ fc00::/7
+"
+o_src_default=bypass
+o_dst_default=bypass
+o_local_default=bypass
+
+alias grep_af="sed -ne '/:/!p'"
+o_dst_bypass_="$o_dst_bypass4_"
+if [ -n "$o_use_ipv6" ]; then
+ alias grep_af="sed -ne /:/p"
+ alias iptables=ip6tables
+ alias iptables-save=ip6tables-save
+ alias iptables-restore=ip6tables-restore
+ alias ip="ip -6"
+ o_af=6
+ o_dst_bypass_="$o_dst_bypass6_"
+fi
+
+ss_rules_parse_args() {
+ while [ "$#" -gt 0 ]; do
+ case "$1" in
+ -h|--help) ss_rules_usage; exit 0;;
+ -f|--flush) ss_rules_flush; exit 0;;
+ -l) o_redir_tcp_port="$2"; shift 2;;
+ -L) o_redir_udp_port="$2"; shift 2;;
+ -s) o_remote_servers="$2"; shift 2;;
+ --ifnames) o_ifnames="$2"; shift 2;;
+ --ipt-extra) o_ipt_extra="$2"; shift 2;;
+ --src-default) o_src_default="$2"; shift 2;;
+ --dst-default) o_dst_default="$2"; shift 2;;
+ --local-default) o_local_default="$2"; shift 2;;
+ --src-bypass) o_src_bypass="$2"; shift 2;;
+ --src-forward) o_src_forward="$2"; shift 2;;
+ --src-checkdst) o_src_checkdst="$2"; shift 2;;
+ --dst-bypass) o_dst_bypass="$2"; shift 2;;
+ --dst-forward) o_dst_forward="$2"; shift 2;;
+ --dst-forward-recentrst) o_dst_forward_recentrst=1; shift 1;;
+ --dst-bypass-file) o_dst_bypass_file="$2"; shift 2;;
+ --dst-forward-file) o_dst_forward_file="$2"; shift 2;;
+ *) __errmsg "unknown option $1"; return 1;;
+ esac
+ done
+
+ if [ -z "$o_redir_tcp_port" -a -z "$o_redir_udp_port" ]; then
+ __errmsg "Requires at least -l or -L option"
+ return 1
+ fi
+ if [ -n "$o_dst_forward_recentrst" ] && ! iptables -m recent -h >/dev/null; then
+ __errmsg "Please install iptables-mod-conntrack-extra"
+ return 1
+ fi
+ o_remote_servers="$(for s in $o_remote_servers; do resolveip "$s" | grep_af; done)"
+}
+
+ss_rules_flush() {
+ local setname
+
+ iptables-save --counters | grep -v ss_rules_ | iptables-restore --counters
+ while ip rule del fwmark 1 lookup 100 2>/dev/null; do true; done
+ ip route flush table 100 2>/dev/null || true
+ for setname in $(ipset -n list | grep "ss_rules${o_af}_"); do
+ ipset destroy "$setname" 2>/dev/null || true
+ done
+}
+
+ss_rules_ipset_init() {
+ ipset --exist restore <<-EOF
+ create ss_rules${o_af}_src_bypass hash:net family inet$o_af hashsize 64
+ create ss_rules${o_af}_src_forward hash:net family inet$o_af hashsize 64
+ create ss_rules${o_af}_src_checkdst hash:net family inet$o_af hashsize 64
+ create ss_rules${o_af}_dst_bypass hash:net family inet$o_af hashsize 64
+ create ss_rules${o_af}_dst_bypass_ hash:net family inet$o_af hashsize 64
+ create ss_rules${o_af}_dst_forward hash:net family inet$o_af hashsize 64
+ create ss_rules${o_af}_dst_forward_rrst_ hash:ip family inet$o_af hashsize 8 timeout 3600
+ $(ss_rules_ipset_mkadd ss_rules${o_af}_dst_bypass_ "$o_dst_bypass_ $o_remote_servers")
+ $(ss_rules_ipset_mkadd ss_rules${o_af}_src_bypass "$o_src_bypass")
+ $(ss_rules_ipset_mkadd ss_rules${o_af}_src_forward "$o_src_forward")
+ $(ss_rules_ipset_mkadd ss_rules${o_af}_src_checkdst "$o_src_checkdst")
+ $(ss_rules_ipset_mkadd ss_rules${o_af}_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null)")
+ $(ss_rules_ipset_mkadd ss_rules${o_af}_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null)")
+ EOF
+}
+
+ss_rules_ipset_mkadd() {
+ local setname="$1"; shift
+ local i
+
+ for i in $*; do
+ echo "add $setname $i"
+ done | grep_af
+}
+
+ss_rules_iptchains_init() {
+ ss_rules_iptchains_init_tcp
+ ss_rules_iptchains_init_udp
+}
+
+ss_rules_iptchains_init_tcp() {
+ local local_target
+
+ [ -n "$o_redir_tcp_port" ] || return 0
+
+ ss_rules_iptchains_init_ nat tcp
+
+ case "$o_local_default" in
+ checkdst) local_target=ss_rules_dst ;;
+ forward) local_target=ss_rules_forward ;;
+ bypass|*) return 0;;
+ esac
+
+ iptables-restore --noflush <<-EOF
+ *nat
+ :ss_rules_local_out -
+ -I OUTPUT 1 -p tcp -j ss_rules_local_out
+ -A ss_rules_local_out -m set --match-set ss_rules${o_af}_dst_bypass_ dst -j RETURN
+ -A ss_rules_local_out $o_ipt_extra -j $local_target
+ COMMIT
+ EOF
+}
+
+ss_rules_iptchains_init_udp() {
+ [ -n "$o_redir_udp_port" ] || return 0
+ ss_rules_iptchains_init_ mangle udp
+}
+
+ss_rules_iptchains_init_() {
+ local table="$1"
+ local proto="$2"
+ local forward_rules
+ local src_default_target dst_default_target
+ local recentrst_mangle_rules recentrst_addset_rules
+
+ case "$proto" in
+ tcp)
+ forward_rules="-A ss_rules_forward -p tcp -j REDIRECT --to-ports $o_redir_tcp_port"
+ if [ -n "$o_dst_forward_recentrst" ]; then
+ recentrst_mangle_rules="
+ *mangle
+ -I PREROUTING 1 -p tcp -m tcp --tcp-flags RST RST -m recent --name ss_rules_recentrst --set --rsource
+ COMMIT
+ "
+ recentrst_addset_rules="
+ -A ss_rules_dst -m recent --name ss_rules_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules${o_af}_dst_forward_rrst_ dst --exist
+ -A ss_rules_dst -m set --match-set ss_rules${o_af}_dst_forward_rrst_ dst -j ss_rules_forward
+ "
+ fi
+ ;;
+ udp)
+ ip rule add fwmark 1 lookup 100
+ ip route add local default dev lo table 100
+ forward_rules="-A ss_rules_forward -p udp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01"
+ ;;
+ esac
+ case "$o_src_default" in
+ forward) src_default_target=ss_rules_forward ;;
+ checkdst) src_default_target=ss_rules_dst ;;
+ bypass|*) src_default_target=RETURN ;;
+ esac
+ case "$o_dst_default" in
+ forward) dst_default_target=ss_rules_forward ;;
+ bypass|*) dst_default_target=RETURN ;;
+ esac
+ sed -e '/^\s*$/d' -e 's/^\s\+//' <<-EOF | iptables-restore --noflush
+ *$table
+ :ss_rules_pre_src -
+ :ss_rules_src -
+ :ss_rules_dst -
+ :ss_rules_forward -
+ $(ss_rules_iptchains_mkprerules "$proto")
+ -A ss_rules_pre_src -m set --match-set ss_rules${o_af}_dst_bypass_ dst -j RETURN
+ -A ss_rules_pre_src $o_ipt_extra -j ss_rules_src
+ -A ss_rules_src -m set --match-set ss_rules${o_af}_src_bypass src -j RETURN
+ -A ss_rules_src -m set --match-set ss_rules${o_af}_src_forward src -j ss_rules_forward
+ -A ss_rules_src -m set --match-set ss_rules${o_af}_src_checkdst src -j ss_rules_dst
+ -A ss_rules_src -j $src_default_target
+ -A ss_rules_dst -m set --match-set ss_rules${o_af}_dst_bypass dst -j RETURN
+ -A ss_rules_dst -m set --match-set ss_rules${o_af}_dst_forward dst -j ss_rules_forward
+ $recentrst_addset_rules
+ -A ss_rules_dst -j $dst_default_target
+ $forward_rules
+ COMMIT
+ $recentrst_mangle_rules
+ EOF
+}
+
+ss_rules_iptchains_mkprerules() {
+ local proto="$1"
+
+ if [ -z "$o_ifnames" ]; then
+ echo "-I PREROUTING 1 -p $proto -j ss_rules_pre_src"
+ else
+ echo $o_ifnames \
+ | tr ' ' '\n' \
+ | sed "s/.*/-I PREROUTING 1 -i \\0 -p $proto -j ss_rules_pre_src/"
+ fi
+}
+
+ss_rules_parse_args "$@"
+ss_rules_flush
+ss_rules_ipset_init
+ss_rules_iptchains_init