#!/bin/sh /etc/rc.common # # Copyright (C) 2017 openwrt-ssr # Copyright (C) 2017 yushi studio # Copyright (C) 2018 lean # # This is free software, licensed under the GNU General Public License v3. # See /LICENSE for more information. # START=90 STOP=15 SERVICE_DAEMONIZE=1 NAME=shadowsocksr EXTRA_COMMANDS=rules CONFIG_FILE=/var/etc/${NAME}.json CONFIG_UDP_FILE=/var/etc/${NAME}_u.json CONFIG_SOCK5_FILE=/var/etc/${NAME}_s.json CONFIG_NETFLIX_FILE=/var/etc/${NAME}_n.json server_count=0 redir_tcp=0 redir_udp=0 tunnel_enable=0 local_enable=0 kcp_enable_flag=0 kcp_flag=0 pdnsd_enable_flag=0 switch_enable=0 switch_server=$1 MAXFD=32768 CRON_FILE=/etc/crontabs/root threads=1 uci_get_by_name() { local ret=$(uci get $NAME.$1.$2 2>/dev/null) echo ${ret:=$3} } uci_get_by_type() { local ret=$(uci get $NAME.@$1[0].$2 2>/dev/null) echo ${ret:=$3} } uci_get_by_cfgid() { local ret=$(uci show $NAME.@$1[0].$2 | awk -F '.' '{print $2}' 2>/dev/null) echo ${ret:=$3} } add_cron() { sed -i '/shadowsocksr/d' $CRON_FILE sed -i '/ssrplus.log/d' $CRON_FILE && echo '0 1 * * * echo "" > /tmp/ssrplus.log' >>$CRON_FILE [ $(uci_get_by_type server_subscribe auto_update 0) -eq 1 ] && echo "0 $(uci_get_by_type server_subscribe auto_update_time) * * * /usr/share/shadowsocksr/ssrplusupdate.sh" >>$CRON_FILE crontab $CRON_FILE } del_cron() { sed -i '/shadowsocksr/d' $CRON_FILE sed -i '/ssrplus.log/d' $CRON_FILE /etc/init.d/cron restart } run_mode=$(uci_get_by_type global run_mode) gen_config_file() { local host=$(uci_get_by_name $1 server) if echo $host | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then hostip=$host elif [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then hostip=$host else hostip=$(ping $host -W 1 -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1) if echo $hostip | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then hostip=$hostip else hostip=$(cat /etc/ssr_ip) fi fi [ "$2" == "0" -a "$kcp_flag" == "1" ] && hostip="127.0.0.1" if [ "$2" == "0" ]; then config_file=$CONFIG_FILE elif [ "$2" == "1" ]; then config_file=$CONFIG_UDP_FILE elif [ "$2" == "2" ]; then config_file=$CONFIG_NETFLIX_FILE else config_file=$CONFIG_SOCK5_FILE fi if [ $(uci_get_by_name $1 fast_open 0) == "1" ]; then fastopen="true" else fastopen="false" fi local stype=$(uci_get_by_name $1 type) if [ "$stype" == "ss" ]; then cat <<-EOF >$config_file { "server": "$hostip", "server_port": $(uci_get_by_name $1 server_port), "local_address": "0.0.0.0", "local_port": $3, "password": "$(uci_get_by_name $1 password)", "timeout": $(uci_get_by_name $1 timeout 60), "method": "$(uci_get_by_name $1 encrypt_method_ss)", "reuse_port": true, "fast_open": $fastopen } EOF local plugin=$(uci_get_by_name $1 plugin) if [ -n "$plugin" ]; then if [ "$plugin" == "simple-obfs" ]; then plugin="obfs-local" fi if [ -x "/usr/bin/$plugin" ]; then sed -i "s@$hostip\",@$hostip\",\n\"plugin\": \"$plugin\",\n\"plugin_opts\": \"$(uci_get_by_name $1 plugin_opts)\",@" $config_file else echo "$(date "+%Y-%m-%d %H:%M:%S") Warning!!! SIP003 plugin $plugin not found!!!" >>/tmp/ssrplus.log fi fi elif [ "$stype" == "ssr" ]; then cat <<-EOF >$config_file { "server": "$hostip", "server_port": $(uci_get_by_name $1 server_port), "local_address": "0.0.0.0", "local_port": $3, "password": "$(uci_get_by_name $1 password)", "timeout": $(uci_get_by_name $1 timeout 60), "method": "$(uci_get_by_name $1 encrypt_method)", "protocol": "$(uci_get_by_name $1 protocol)", "protocol_param": "$(uci_get_by_name $1 protocol_param)", "obfs": "$(uci_get_by_name $1 obfs)", "obfs_param": "$(uci_get_by_name $1 obfs_param)", "reuse_port": true, "fast_open": $fastopen } EOF elif [ "$stype" == "v2ray" ]; then lua /usr/share/shadowsocksr/genv2config.lua $GLOBAL_SERVER tcp $(uci_get_by_name $1 local_port) >/var/etc/v2-ssr-retcp.json sed -i 's/\\//g' /var/etc/v2-ssr-retcp.json elif [ "$stype" == "trojan" ]; then lua /usr/share/shadowsocksr/gentrojanconfig.lua $GLOBAL_SERVER nat $(uci_get_by_name $1 local_port) >/var/etc/trojan-ssr-retcp.json sed -i 's/\\//g' /var/etc/trojan-ssr-retcp.json fi } get_arg_out() { case "$(uci_get_by_type access_control router_proxy 1)" in 1) echo "-o" ;; 2) echo "-O" ;; esac } start_rules() { local server=$(uci_get_by_name $GLOBAL_SERVER server) #resolve name if echo $server | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then server=$server elif [ "$server" != "${server#*:[0-9a-fA-F]}" ]; then server=$server else server=$(ping $server -W 1 -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1) if echo $server | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then echo $server >/etc/ssr_ip else server=$(cat /etc/ssr_ip) fi fi kcp_server=$server local kcp_enable=$(uci_get_by_name $GLOBAL_SERVER kcp_enable 0) if [ $kcp_enable == "1" ]; then kcp_flag=1 fi local local_port=$(uci_get_by_name $GLOBAL_SERVER local_port) local lan_ac_ips=$(uci_get_by_type access_control lan_ac_ips) local lan_ac_mode=$(uci_get_by_type access_control lan_ac_mode) local router_proxy=$(uci_get_by_type access_control router_proxy) if [ "$GLOBAL_SERVER" == "$UDP_RELAY_SERVER" -a "$kcp_flag" == "0" ]; then ARG_UDP="-u" elif [ -n "$UDP_RELAY_SERVER" ]; then ARG_UDP="-U" local udp_server=$(uci_get_by_name $UDP_RELAY_SERVER server) local udp_local_port=$(uci_get_by_name $UDP_RELAY_SERVER local_port) fi if [ -n "$lan_ac_ips" ]; then case "$lan_ac_mode" in w | W | b | B) local ac_ips="$lan_ac_mode$lan_ac_ips" ;; esac fi #deal gfw firewall rule local gfwmode="" if [ "$run_mode" == "gfw" ]; then gfwmode="-g" elif [ "$run_mode" == "router" ]; then gfwmode="-r" elif [ "$run_mode" == "oversea" ]; then gfwmode="-c" elif [ "$run_mode" == "all" ]; then gfwmode="-z" fi local dports=$(uci_get_by_type global dports 1) if [ $dports == "1" ]; then proxyport=" " else proxyport="-m multiport --dports 22,53,587,465,995,993,143,80,443" fi if [ "$NETFLIX_SERVER" != "same" ]; then netflix="1" else netflix="0" fi /usr/bin/ssr-rules \ -s "$server" \ -l "$local_port" \ -S "$udp_server" \ -L "$udp_local_port" \ -a "$ac_ips" \ -i "$(uci_get_by_type access_control wan_bp_list)" \ -b "$(uci_get_by_type access_control wan_bp_ips)" \ -w "$(uci_get_by_type access_control wan_fw_ips)" \ -B "$(uci_get_by_type access_control lan_bp_ips)" \ -p "$(uci_get_by_type access_control lan_fp_ips)" \ -G "$(uci_get_by_type access_control lan_gm_ips)" \ -D "$proxyport" \ -F "$netflix" \ $(get_arg_out) $gfwmode $ARG_UDP return $? } start_pdnsd() { local usr_dns="$1" local usr_port="$2" local tcp_dns_list="208.67.222.222, 208.67.220.220" [ -z "$usr_dns" ] && usr_dns="8.8.8.8" [ -z "$usr_port" ] && usr_port="53" [ -d /var/etc ] || mkdir -p /var/etc if [ ! -d /var/pdnsd ]; then mkdir -p /var/pdnsd echo -ne "pd13\000\000\000\000" >/var/pdnsd/pdnsd.cache chown -R nobody:nogroup /var/pdnsd fi cat <<-EOF >/var/etc/pdnsd.conf global{ perm_cache=1024; cache_dir="/var/pdnsd"; pid_file="/var/run/pdnsd.pid"; run_as="nobody"; server_ip=127.0.0.1; server_port=5335; status_ctl=on; query_method=tcp_only; min_ttl=1h; max_ttl=1w; timeout=10; neg_domain_pol=on; proc_limit=2; procq_limit=8; par_queries=1; } server{ label="ssr-usrdns"; ip=$usr_dns; port=$usr_port; timeout=6; uptest=none; interval=10m; purge_cache=off; } EOF /usr/sbin/pdnsd -c /var/etc/pdnsd.conf -d & } start_redir() { case "$(uci_get_by_name $GLOBAL_SERVER auth_enable)" in 1 | on | true | yes | enabled) ARG_OTA="-A" ;; *) ARG_OTA="" ;; esac #deal kcp local kcp_enable=$(uci_get_by_name $GLOBAL_SERVER kcp_enable 0) if [ "$kcp_enable" == "1" ]; then [ ! -f "/usr/bin/kcptun-client" ] && return 1 local kcp_str=$(/usr/bin/kcptun-client -v | grep kcptun | wc -l) [ "0" == "$kcp_str" ] && return 1 local kcp_port=$(uci_get_by_name $GLOBAL_SERVER kcp_port) local server_port=$(uci_get_by_name $GLOBAL_SERVER server_port) local password=$(uci_get_by_name $GLOBAL_SERVER kcp_password) local kcp_param=$(uci_get_by_name $GLOBAL_SERVER kcp_param) [ "$password" != "" ] && password="--key "$password service_start /usr/bin/kcptun-client \ -r $kcp_server:$kcp_port \ -l :$server_port $password $kcp_param kcp_enable_flag=1 fi gen_config_file $GLOBAL_SERVER 0 $(uci_get_by_name $GLOBAL_SERVER local_port 1234) local stype=$(uci_get_by_name $GLOBAL_SERVER type) if [ "$stype" == "ss" ]; then sscmd="/usr/bin/ss-redir" elif [ "$stype" == "ssr" ]; then sscmd="/usr/bin/ssr-redir" elif [ "$stype" == "v2ray" ]; then sscmd="/usr/bin/v2ray/v2ray" [ ! -f "$sscmd" ] && sscmd="/usr/bin/v2ray" elif [ "$stype" == "trojan" ]; then sscmd="/usr/sbin/trojan" elif [ "$stype" == "socks5" ]; then sscmd="/usr/sbin/redsocks2" elif [ "$stype" == "tun" ]; then sscmd="/usr/sbin/redsocks2" fi local ntype=$(uci_get_by_name $NETFLIX_SERVER type) if [ "$ntype" == "ss" ]; then ncmd="/usr/bin/ss-redir" sssock="/usr/bin/ss-local" elif [ "$ntype" == "ssr" ]; then ncmd="/usr/bin/ssr-redir" sssock="/usr/bin/ssr-local" elif [ "$ntype" == "v2ray" ]; then ncmd="/usr/bin/v2ray/v2ray" [ ! -f "$ncmd" ] && ncmd="/usr/bin/v2ray" elif [ "$ntype" == "trojan" ]; then ncmd="/usr/sbin/trojan" elif [ "$ntype" == "socks5" ]; then ncmd="/usr/sbin/redsocks2" elif [ "$ntype" == "tun" ]; then ncmd="/usr/sbin/redsocks2" fi local utype=$(uci_get_by_name $UDP_RELAY_SERVER type) if [ "$utype" == "ss" ]; then ucmd="/usr/bin/ss-redir" elif [ "$utype" == "ssr" ]; then ucmd="/usr/bin/ssr-redir" elif [ "$utype" == "v2ray" ]; then ucmd="/usr/bin/v2ray/v2ray" [ ! -f "$ucmd" ] && ucmd="/usr/bin/v2ray" elif [ "$utype" == "trojan" ]; then ucmd="/usr/sbin/trojan" elif [ "$stype" == "socks5" ]; then ucmd="/usr/sbin/redsocks2" elif [ "$stype" == "tun" ]; then ucmd="/usr/sbin/redsocks2" fi if [ "$(uci_get_by_type global threads 0)" == "0" ]; then threads=$(cat /proc/cpuinfo | grep 'processor' | wc -l) else threads=$(uci_get_by_type global threads) fi redir_tcp=1 if [ "$stype" == "ss" -o "$stype" == "ssr" ]; then local last_config_file=$CONFIG_FILE local pid_file="/var/run/ssr-retcp.pid" for i in $(seq 1 $threads); do $sscmd -c $CONFIG_FILE $ARG_OTA -f /var/run/ssr-retcp_$i.pid >/dev/null 2>&1 done echo "$(date "+%Y-%m-%d %H:%M:%S") Shadowsocks/ShadowsocksR $threads Threads Started!" >>/tmp/ssrplus.log elif [ "$stype" == "v2ray" ]; then $sscmd -config /var/etc/v2-ssr-retcp.json >/dev/null 2>&1 & echo "$(date "+%Y-%m-%d %H:%M:%S") $($sscmd -version | head -1) Started!" >>/tmp/ssrplus.log elif [ "$stype" == "trojan" ]; then for i in $(seq 1 $threads); do $sscmd --config /var/etc/trojan-ssr-retcp.json >/dev/null 2>&1 & done echo "$(date "+%Y-%m-%d %H:%M:%S") $($sscmd --version 2>&1 | head -1) , $threads Threads Started!" >>/tmp/ssrplus.log elif [ "$stype" == "socks5" ]; then /usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-retcp.conf" socks5 tcp $(uci_get_by_name $GLOBAL_SERVER local_port) \ $(uci_get_by_name $GLOBAL_SERVER server) $(uci_get_by_name $GLOBAL_SERVER server_port) \ $(uci_get_by_name $GLOBAL_SERVER auth_enable 0) $(uci_get_by_name $GLOBAL_SERVER username) $(uci_get_by_name $GLOBAL_SERVER password) for i in $(seq 1 $threads); do $sscmd -c /var/etc/redsocks-ssr-retcp.conf >/dev/null 2>&1 done echo "$(date "+%Y-%m-%d %H:%M:%S") Socks5 REDIRECT/TPROXY $threads Threads Started!" >>/tmp/ssrplus.log elif [ "$stype" == "tun" ]; then /usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-retcp.conf" vpn $(uci_get_by_name $GLOBAL_SERVER iface "br-lan") $(uci_get_by_name $GLOBAL_SERVER local_port) for i in $(seq 1 $threads); do $sscmd -c /var/etc/redsocks-ssr-retcp.conf >/dev/null 2>&1 done echo "$(date "+%Y-%m-%d %H:%M:%S") Network Tunnel REDIRECT $threads Threads Started!" >>/tmp/ssrplus.log fi if [ "$NETFLIX_SERVER" != "same" ]; then if [ "$ntype" == "ss" -o "$ntype" == "ssr" ]; then gen_config_file $NETFLIX_SERVER 2 4321 gen_config_file $NETFLIX_SERVER 3 1088 $sssock -c /var/etc/shadowsocksr_s.json $ARG_OTA -f /var/run/ssr-socksdns.pid >/dev/null 2>&1 dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 & $ncmd -c /var/etc/shadowsocksr_n.json $ARG_OTA -f /var/run/ssr-netflix.pid >/dev/null 2>&1 elif [ "$ntype" == "v2ray" ]; then lua /usr/share/shadowsocksr/genv2nfconfig.lua $NETFLIX_SERVER tcp 4321 >/var/etc/v2-ssr-netflix.json $ncmd -config /var/etc/v2-ssr-netflix.json >/dev/null 2>&1 & dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 & elif [ "$ntype" == "trojan" ]; then lua /usr/share/shadowsocksr/gentrojanconfig.lua $NETFLIX_SERVER nat 4321 >/var/etc/trojan-ssr-netflix.json sed -i 's/\\//g' /var/etc/trojan-ssr-netflix.json $ncmd --config /var/etc/trojan-ssr-netflix.json >/dev/null 2>&1 & lua /usr/share/shadowsocksr/gentrojanconfig.lua $NETFLIX_SERVER client 1088 >/var/etc/trojan-ssr-socksdns.json sed -i 's/\\//g' /var/etc/trojan-ssr-socksdns.json $ncmd --config /var/etc/trojan-ssr-socksdns.json >/dev/null 2>&1 & dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 & elif [ "$ntype" == "socks5" ]; then /usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-netflix.conf" socks5 tcp 4321 \ $(uci_get_by_name $NETFLIX_SERVER server) $(uci_get_by_name $NETFLIX_SERVER server_port) \ $(uci_get_by_name $NETFLIX_SERVER auth_enable 0) $(uci_get_by_name $NETFLIX_SERVER username) $(uci_get_by_name $NETFLIX_SERVER password) $ncmd -c /var/etc/redsocks-ssr-netflix.conf >/dev/null 2>&1 microsocks -i 127.0.0.1 -p 1088 ssr-socksdns >/dev/null 2>&1 & dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 & elif [ "$ntype" == "tun" ]; then /usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-netflix.conf" vpn $(uci_get_by_name $NETFLIX_SERVER iface "br-lan") 4321 $ncmd -c /var/etc/redsocks-ssr-netflix.conf >/dev/null 2>&1 microsocks -i 127.0.0.1 -p 1088 ssr-socksdns >/dev/null 2>&1 & dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 & fi fi if [ -n "$UDP_RELAY_SERVER" ]; then redir_udp=1 if [ "$utype" == "ss" -o "$utype" == "ssr" ]; then case "$(uci_get_by_name $UDP_RELAY_SERVER auth_enable)" in 1 | on | true | yes | enabled) ARG_OTA="-A" ;; *) ARG_OTA="" ;; esac gen_config_file $UDP_RELAY_SERVER 1 $(uci_get_by_name $UDP_RELAY_SERVER local_port 1234) last_config_file=$CONFIG_UDP_FILE pid_file="/var/run/ssr-reudp.pid" $ucmd -c $last_config_file $ARG_OTA -U -f /var/run/ssr-reudp.pid >/dev/null 2>&1 elif [ "$utype" == "v2ray" ]; then lua /usr/share/shadowsocksr/genv2config.lua $UDP_RELAY_SERVER udp $(uci_get_by_name $UDP_RELAY_SERVER local_port) >/var/etc/v2-ssr-reudp.json sed -i 's/\\//g' /var/etc/v2-ssr-reudp.json $ucmd -config /var/etc/v2-ssr-reudp.json >/dev/null 2>&1 & elif [ "$stype" == "trojan" ]; then lua /usr/share/shadowsocksr/gentrojanconfig.lua $GLOBAL_SERVER client 10801 >/var/etc/trojan-ssr-reudp.json sed -i 's/\\//g' /var/etc/trojan-ssr-reudp.json $ucmd --config /var/etc/trojan-ssr-reudp.json >/dev/null 2>&1 & ipt2socks -U -b 0.0.0.0 -4 -s 127.0.0.1 -p 10801 -l $(uci_get_by_name $UDP_RELAY_SERVER local_port) >/dev/null 2>&1 & elif [ "$utype" == "socks5" ]; then /usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-reudp.conf" socks5 udp $(uci_get_by_name $UDP_RELAY_SERVER local_port) \ $(uci_get_by_name $UDP_RELAY_SERVER server) $(uci_get_by_name $UDP_RELAY_SERVER server_port) \ $(uci_get_by_name $UDP_RELAY_SERVER auth_enable 0) $(uci_get_by_name $UDP_RELAY_SERVER username) $(uci_get_by_name $UDP_RELAY_SERVER password) $ucmd -c /var/etc/redsocks-ssr-reudp.conf >/dev/null 2>&1 elif [ "$stype" == "tun" ]; then redir_udp=0 echo "$(date "+%Y-%m-%d %H:%M:%S") Network Tunnel UDP TPROXY Relay not supported!" >>/tmp/ssrplus.log fi fi #deal with dns local ssr_dns="$(uci_get_by_type global pdnsd_enable 0)" local dnsstr="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)" local dnsserver=$(echo "$dnsstr" | awk -F ':' '{print $1}') local dnsport=$(echo "$dnsstr" | awk -F ':' '{print $2}') if [ "$ssr_dns" != "0" ]; then # not use custom dns service if [ "$run_mode" == "gfw" ]; then ipset add gfwlist $dnsserver 2>/dev/null elif [ "$run_mode" == "oversea" ]; then ipset add oversea $dnsserver 2>/dev/null else ipset add ss_spec_wan_ac $dnsserver nomatch 2>/dev/null fi fi if [ "$ssr_dns" == "1" ]; then start_pdnsd $dnsserver $dnsport pdnsd_enable_flag=1 elif [ "$ssr_dns" == "2" ]; then microsocks -i 127.0.0.1 -p 10802 ssr-dns >/dev/null 2>&1 & dns2socks 127.0.0.1:10802 $dnsserver:$dnsport 127.0.0.1:5335 -q >/dev/null 2>&1 & pdnsd_enable_flag=2 fi if [ "$(uci_get_by_type global enable_switch)" == "1" ]; then if [ "$(uci_get_by_name $GLOBAL_SERVER switch_enable 1)" == "1" ]; then if [ -z "$switch_server" ]; then local switch_time=$(uci_get_by_type global switch_time) local switch_timeout=$(uci_get_by_type global switch_timeout) service_start /usr/bin/ssr-switch start $switch_time $switch_timeout switch_enable=1 fi fi fi add_cron return $? } gen_service_file() { if [ $(uci_get_by_name $1 fast_open) == "1" ]; then fastopen="true" else fastopen="false" fi cat <<-EOF >$2 { "server": "0.0.0.0", "server_port": $(uci_get_by_name $1 server_port), "password": "$(uci_get_by_name $1 password)", "timeout": $(uci_get_by_name $1 timeout 60), "method": "$(uci_get_by_name $1 encrypt_method)", "protocol": "$(uci_get_by_name $1 protocol)", "protocol_param": "$(uci_get_by_name $1 protocol_param)", "obfs": "$(uci_get_by_name $1 obfs)", "obfs_param": "$(uci_get_by_name $1 obfs_param)", "fast_open": $fastopen } EOF } start_service() { [ $(uci_get_by_name $1 enable 0) == "0" ] && return 1 let server_count=server_count+1 if [ "$server_count" == "1" ]; then if ! (iptables-save -t filter | grep SSR-SERVER-RULE >/dev/null); then iptables -N SSR-SERVER-RULE && \ iptables -t filter -I INPUT -j SSR-SERVER-RULE fi fi gen_service_file $1 /var/etc/${NAME}_$server_count.json /usr/bin/ssr-server -c /var/etc/${NAME}_$server_count.json -u -f /var/run/ssr-server$server_count.pid >/dev/null 2>&1 iptables -t filter -A SSR-SERVER-RULE -p tcp --dport $(uci_get_by_name $1 server_port) -j ACCEPT iptables -t filter -A SSR-SERVER-RULE -p udp --dport $(uci_get_by_name $1 server_port) -j ACCEPT return 0 } gen_serv_include() { FWI=$(uci get firewall.shadowsocksr.path 2>/dev/null) [ -n "$FWI" ] || return 0 if [ ! -f $FWI ]; then echo '#!/bin/sh' >$FWI fi extract_rules() { echo "*filter" iptables-save -t filter | grep SSR-SERVER-RULE | sed -e "s/^-A INPUT/-I INPUT/" echo 'COMMIT' } cat <<-EOF >>$FWI iptables-save -c | grep -v "SSR-SERVER" | iptables-restore -c iptables-restore -n <<-EOT $(extract_rules) EOT EOF } start_server() { SERVER_ENABLE=$(uci_get_by_type server_global enable_server 0) [ "$SERVER_ENABLE" == "0" ] && return 0 mkdir -p /var/run /var/etc config_load $NAME config_foreach start_service server_config gen_serv_include return 0 } start_local() { local local_server=$(uci_get_by_type socks5_proxy socks 0) [ "$local_server" == "0" ] && return 0 local auth_enable=$(uci_get_by_type socks5_proxy auth_enable 0) local socks_port=$(uci_get_by_type socks5_proxy local_port 1080) if [ "$auth_enable" == "1" ]; then microsocks -i :: -p $socks_port -1 -u $(uci_get_by_type socks5_proxy username) -P $(uci_get_by_type socks5_proxy password) ssr-socks >/dev/null 2>&1 & else microsocks -i :: -p $socks_port ssr-socks >/dev/null 2>&1 & fi local_enable=1 if [ "$(uci_get_by_type socks5_proxy wan_enable 0)" == "1" ]; then if ! (iptables-save -t filter | grep SSR-SERVER-RULE >/dev/null); then iptables -N SSR-SERVER-RULE && \ iptables -t filter -I INPUT -j SSR-SERVER-RULE fi iptables -t filter -A SSR-SERVER-RULE -p tcp --dport $socks_port -j ACCEPT iptables -t filter -A SSR-SERVER-RULE -p udp --dport $socks_port -j ACCEPT gen_serv_include fi } rules() { [ "$GLOBAL_SERVER" == "nil" ] && return 1 mkdir -p /var/run /var/etc UDP_RELAY_SERVER=$(uci_get_by_type global udp_relay_server) [ "$UDP_RELAY_SERVER" == "same" ] && UDP_RELAY_SERVER=$GLOBAL_SERVER if start_rules; then return 0 else return 1 fi } start() { if [ -z "$switch_server" ]; then GLOBAL_SERVER=$(uci_get_by_type global global_server) else GLOBAL_SERVER=$switch_server switch_enable=1 fi NETFLIX_SERVER=$(uci_get_by_type global netflix_server same) if [ "$NETFLIX_SERVER" == "same" ]; then NETFLIX_SERVER=$GLOBAL_SERVER fi if rules; then start_redir mkdir -p /tmp/dnsmasq.d && cp -a /etc/dnsmasq.ssr /tmp/ && cp -a /etc/dnsmasq.oversea /tmp/ if ! [ "$run_mode" == "oversea" ]; then cat <<-EOF >/tmp/dnsmasq.d/dnsmasq-ssr.conf conf-dir=/tmp/dnsmasq.ssr EOF else cat <<-EOF >/tmp/dnsmasq.d/dnsmasq-ssr.conf conf-dir=/tmp/dnsmasq.oversea EOF fi if [ $(uci_get_by_type global adblock 0) == "0" ]; then rm -f /tmp/dnsmasq.ssr/ad.conf fi /usr/share/shadowsocksr/gfw2ipset.sh if [ "$NETFLIX_SERVER" != "same" ]; then cat /etc/config/netflix.list | while read line || [ -n "$line" ]; do sed -i "/$line/d" /tmp/dnsmasq.ssr/gfw_list.conf done awk '!/^$/&&!/^#/{printf("ipset=/.%s/'"netflix"'\n",$0)}' /etc/config/netflix.list > /tmp/dnsmasq.ssr/netflix_forward.conf awk '!/^$/&&!/^#/{printf("server=/.%s/'"127.0.0.1#5555"'\n",$0)}' /etc/config/netflix.list >> /tmp/dnsmasq.ssr/netflix_forward.conf else rm -f /tmp/dnsmasq.ssr/netflix_forward.conf fi /etc/init.d/dnsmasq restart >/dev/null 2>&1 fi start_server start_local if [ $(uci_get_by_type global monitor_enable 0) == "1" ]; then let total_count=server_count+redir_tcp+redir_udp+tunnel_enable+kcp_enable_flag+local_enable+pdnsd_enable_flag+switch_enable if [ $total_count -gt 0 ]; then #param:server(count) redir_tcp(0:no,1:yes) redir_udp tunnel kcp local gfw service_start /usr/bin/ssr-monitor $server_count $redir_tcp $redir_udp $tunnel_enable $kcp_enable_flag $local_enable $pdnsd_enable_flag $switch_enable fi fi ENABLE_SERVER=$(uci_get_by_type global global_server nil) if [ "$ENABLE_SERVER" == "nil" ]; then return 1 else STYPE=$(uci_get_by_name $ENABLE_SERVER type nil) if [ "$STYPE" == "nil" ]; then CFGID=$(uci_get_by_cfgid servers type nil) if [ "$CFGID" == "nil" ]; then uci set shadowsocksr.@global[0].global_server='nil' else uci set shadowsocksr.@global[0].global_server=$CFGID fi uci commit shadowsocksr /etc/init.d/shadowsocksr restart fi fi } boot() { (/usr/share/shadowsocksr/chinaipset.sh && sleep 3 && start >/dev/null 2>&1) & } stop() { /usr/bin/ssr-rules -f srulecount=$(iptables -L | grep SSR-SERVER-RULE | wc -l) if [ $srulecount -gt 0 ]; then iptables -F SSR-SERVER-RULE iptables -t filter -D INPUT -j SSR-SERVER-RULE iptables -X SSR-SERVER-RULE 2>/dev/null fi if [ -z "$switch_server" ]; then kill -9 $(busybox ps -w | grep ssr-switch | grep -v grep | awk '{print $1}') >/dev/null 2>&1 fi if [ $(uci_get_by_type global monitor_enable 0) == "1" ]; then kill -9 $(busybox ps -w | grep ssr-monitor | grep -v grep | awk '{print $1}') >/dev/null 2>&1 fi killall -q -9 ssr-monitor killall -q -9 ss-redir killall -q -9 obfs-local killall -q -9 v2ray-plugin killall -q -9 ssr-redir killall -q -9 v2ray killall -q -9 trojan killall -q -9 ipt2socks killall -q -9 ssr-server killall -q -9 ssr-local killall -q -9 ss-local killall -q -9 kcptun-client killall -q -9 dns2socks killall -q -9 microsocks killall -q -9 redsocks2 if [ -f /var/run/pdnsd.pid ]; then kill $(cat /var/run/pdnsd.pid) >/dev/null 2>&1 else kill -9 $(busybox ps -w | grep pdnsd | grep -v grep | awk '{print $1}') >/dev/null 2>&1 fi if [ -f "/tmp/dnsmasq.d/dnsmasq-ssr.conf" ]; then rm -f /tmp/dnsmasq.d/dnsmasq-ssr.conf /etc/init.d/dnsmasq restart >/dev/null 2>&1 fi del_cron }