-
Notifications
You must be signed in to change notification settings - Fork 6
/
script
executable file
·248 lines (215 loc) · 6.72 KB
/
script
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
#!/bin/sh
APP_NAME="ShadowsocksR-X"
APP_DIR="/etc/$APP_NAME"
DNSMASQ_RULE="/tmp/dnsmasq.d/00-$APP_NAME.conf"
DNSMASQ_RULE_WHITE_LIST="$APP_DIR/config/white_list.conf"
DNSMASQ_RULE_GFW_LIST="$APP_DIR/config/gfw_list.conf"
DNS_PORT='1053'
LOCAL_PORT='1090'
FIREWALL_RULE_FILE="/etc/firewall.d/20-$APP_NAME"
user_echo() { echo "<User-Echo>$@"; }
install() {
mkdir -p $APP_DIR
cp ./$APP_NAME.conf $APP_DIR/$APP_NAME.conf
tar -xzf files.tgz -C $APP_DIR
local arch
arch=$(opkg info libc| grep -F Architecture | awk '{print $2}')
case $arch in
mediatek|ralink|mtmips*)
rm $APP_DIR/bin/ssr-redir_arm $APP_DIR/bin/ssr-local_arm -f
mv $APP_DIR/bin/ssr-redir_mips $APP_DIR/bin/ssr-redir -f
mv $APP_DIR/bin/ssr-local_mips $APP_DIR/bin/ssr-local -f
;;
ipq806x)
rm $APP_DIR/bin/ssr-redir_mips $APP_DIR/bin/ssr-local_mips -f
mv $APP_DIR/bin/ssr-redir_arm $APP_DIR/bin/ssr-redir -f
mv $APP_DIR/bin/ssr-local_arm $APP_DIR/bin/ssr-local -f
;;
*)
user_echo "Unsupported Architecture: $arch"
return 1
;;
esac
chmod +x $APP_DIR/bin/*
gen_config
cat > /etc/init.d/$APP_NAME <<EOF
#!/bin/sh /etc/rc.common
START=98
start() {
(. /etc/market/$APP_NAME.script && start)
}
EOF
chmod +x /etc/init.d/$APP_NAME
/etc/init.d/$APP_NAME enable
start
return 0
}
uninstall() {
stop
/etc/init.d/$APP_NAME disable
rm -rf $APP_DIR
rm -rf $FIREWALL_RULE_FILE
return 0
}
start() {
read_configs
$APP_DIR/bin/ssr-redir -c $APP_DIR/config/config.json -b 0.0.0.0 -f /var/run/$APP_NAME-redir.pid
$APP_DIR/bin/ssr-local -c $APP_DIR/config/config.json -u -l $DNS_PORT -L 8.8.8.8:53 -f /var/run/$APP_NAME-local.pid
#reload firewall
chmod +x $FIREWALL_RULE_FILE
/etc/init.d/firewall restart
#config dnsmasq
case $MODE in
GFW_list|foreign_ip)
cat > $DNSMASQ_RULE <<EOF
ipset=/hiwifi.com/hiwifi_ignore
server=/hiwifi.com/114.114.114.114#53
ipset=/hiwifi.tw/hiwifi_ignore
server=/hiwifi.tw/114.114.114.114#53
EOF
cat $DNSMASQ_RULE_GFW_LIST $DNSMASQ_RULE_WHITE_LIST >> $DNSMASQ_RULE
;;
all)
cat > $DNSMASQ_RULE <<EOF
no-resolv
no-poll
no-negcache
max-ttl=10
ipset=/.hiwifi.com/hiwifi_ignore
server=/.hiwifi.com/114.114.114.114#53
ipset=/.hiwifi.tw/hiwifi_ignore
server=/.hiwifi.tw/114.114.114.114#53
server=127.0.0.1#$DNS_PORT
EOF
;;
esac
#reload dnsmasq
/etc/init.d/dnsmasq reload
#wait firewall
sleep 2
return 0
}
stop() {
kill -2 $(pidof ssr-redir)
kill -2 $(pidof ssr-local)
sleep 1
killall -9 ssr-local ssr-local &> /dev/null
rm -f /var/run/$APP_NAME-redir.pid
rm -f /var/run/$APP_NAME-local.pid
rm -f $DNSMASQ_RULE
/etc/init.d/dnsmasq reload
/etc/init.d/firewall restart
ipset -F hiwifi_ignore
ipset -X hiwifi_ignore
ipset -F gfw_list &>/dev/null
ipset -X gfw_list &>/dev/null
#wait firewall
sleep 2
return 0
}
restart() {
stop
start
return 0
}
status() {
local stat
stat="unknown"
local=$(pgrep ssr-local | wc -l)
redir=$(pgrep ssr-redir | wc -l)
if [ $local == '1' -a $redir == '1' ]; then
stat="running"
else
stat="stopped"
fi
echo "{ \"status\" : \"$stat\" }"
return 0
}
reconfigure() {
cp ./$APP_NAME.conf $APP_DIR/$APP_NAME.conf
gen_config
restart
return 0
}
read_configs() {
source "$APP_DIR/$APP_NAME.conf"
SERVER_ADDR=$SERVERADDR
SERVER_PORT=$SERVERPORT
PASSWORD=$SERVERPASSWD
METHOD=$SERVERMETHOD
SERVER_PROTOCOL=$SERVERPROTOCOL
SERVER_PROTOCOL_PARAM=$SERVERPROTOCOLPARAM
SERVER_OBFS=$SERVEROBFS
SERVER_OBFS_PARAM=$SERVEROBFSPARAM
MODE=$PMODE
return 0
}
gen_config(){
read_configs
#generate ssr config file
echo "{\"server\":\"$SERVER_ADDR\",\"server_port\":$SERVER_PORT,\"local_port\":$LOCAL_PORT,\"local_addr\":\"0.0.0.0\",\"password\":\"$PASSWORD\",\"timeout\":600,\"method\":\"$METHOD\",\"protocol\":\"$SERVER_PROTOCOL\",\"obfs\":\"$SERVER_OBFS\",\"protocol_param\":\"$SERVER_PROTOCOL_PARAM\",\"obfs_param\":\"$SERVER_OBFS_PARAM\"}" > $APP_DIR/config/config.json
#generate firewall file
cat > $FIREWALL_RULE_FILE <<EOF
#!/bin/sh
! \`pidof ssr-redir >/dev/null\` && return
! \`pidof ssr-local >/dev/null\` && return
ipset -N hiwifi_ignore hash:ip
iptables -t nat -N $APP_NAME
iptables -t nat -Z $APP_NAME
iptables -t nat -A $APP_NAME -m set --match-set local dst -j RETURN
iptables -t nat -A $APP_NAME -m set --match-set hiwifi_ignore dst -j RETURN
#-------mode start---------#
EOF
case $MODE in
GFW_list)
cat >> $FIREWALL_RULE_FILE <<EOF
ipset -N gfw_list hash:ip
#-------Telegram ip range---------#
ipset add gfw_list 91.108.4.0/22
ipset add gfw_list 91.108.8.0/21
ipset add gfw_list 91.108.16.0/21
ipset add gfw_list 91.108.36.0/23
ipset add gfw_list 91.108.38.0/23
ipset add gfw_list 91.108.56.0/22
ipset add gfw_list 109.239.140.0/24
ipset add gfw_list 149.154.160.0/20
iptables -t nat -A $APP_NAME -p tcp -j REDIRECT --to-port $LOCAL_PORT
iptables -t nat -A PREROUTING -p tcp -m set --match-set gfw_list dst -j $APP_NAME
EOF
;;
foreign_ip)
cat >> $FIREWALL_RULE_FILE <<EOF
iptables -t nat -A $APP_NAME -m set --match-set china dst -j RETURN
iptables -t nat -A $APP_NAME -p tcp -j REDIRECT --to-port $LOCAL_PORT
iptables -t nat -I PREROUTING -p tcp -j $APP_NAME
EOF
;;
all)
cat >> $FIREWALL_RULE_FILE <<EOF
iptables -t nat -A $APP_NAME -p tcp -j REDIRECT --to-port $LOCAL_PORT
iptables -t nat -I PREROUTING -p tcp -j $APP_NAME
EOF
;;
esac
#whitelist
: > $DNSMASQ_RULE_WHITE_LIST
if [ -f WHITELIST ]; then
local host ip
tr -d '\r' < WHITELIST > WHITELIST.tmp
grep -E '^([a-zA-Z0-9\-]+\.)+[a-zA-Z0-9]+$' WHITELIST.tmp | while read host; do
if [ x"${host##*hiwifi.com}" == x'' ]; then
continue
fi
if [ x"${host##*hiwifi.tw}" == x'' ]; then
continue
fi
echo "server=/.$host/127.0.0.1#$DNS_PORT" >> $DNSMASQ_RULE_WHITE_LIST
echo "ipset=/.$host/gfw_list" >> $DNSMASQ_RULE_WHITE_LIST
done
grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' WHITELIST.tmp | while read ip; do
echo "add gfw_list $ip" >> $FIREWALL_RULE_FILE
done
rm WHITELIST.tmp
fi
return 0
}