Browse Source
shadowsocks-libev: rewrite
- Selecting only a single or subset of all components of shadowsocks-libev is now possible (this is the main motivation behind the rewrite) - Configuring multiple instances of the same component is now also possible - Same option names as with the json config - Unified configuration generation method for each component - Add support for ss-local, ss-tunnel, ss-server - Most data validation is now done with validate_data - USE_PROCD=1 - Update ss-rules with the one from shadowsocks/luci-app-shadowsocks - Add README.md - Set myself as the maintainer Addresses #4435 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>lilik-openwrt-22.03
Yousong Zhou
7 years ago
9 changed files with 865 additions and 335 deletions
Split View
Diff Options
-
+78 -37net/shadowsocks-libev/Makefile
-
+86 -0net/shadowsocks-libev/README.md
-
+0 -6net/shadowsocks-libev/files/firewall.include
-
+2 -0net/shadowsocks-libev/files/firewall.ss-rules
-
+58 -13net/shadowsocks-libev/files/shadowsocks-libev.config
-
+298 -138net/shadowsocks-libev/files/shadowsocks-libev.init
-
+182 -141net/shadowsocks-libev/files/ss-rules
-
+10 -0net/shadowsocks-libev/files/ss-rules.defaults
-
+151 -0net/shadowsocks-libev/patches/0001-decouple-use_syslog-from-pid_flags.patch
+ 78
- 37
net/shadowsocks-libev/Makefile
View File
+ 86
- 0
net/shadowsocks-libev/README.md
View File
| @ -0,0 +1,86 @@ | |||
| ## components | |||
| `ss-local` provides SOCKS5 proxy. | |||
| socks5 ss plain | |||
| --------> tcp:udp:local_address:local_port ----> ss server -------> dest | |||
| `ss-redir`. The REDIRECT and TPROXY part are to be provided by `ss-rules` script. REDIRECT only works for tcp traffic (see also darkk/redsocks). TPROXY is used to proxy udp messages, but it's only available in the PREROUTING chain and as such cannot proxy local out traffic. | |||
| plain plain ss plain | |||
| ---------> REDIRECT ------> tcp:local_address:local_port ----> ss server -----> original dest | |||
| plain plain ss plain | |||
| ---------> TPROXY -------> udp:local_address:local_port -----> ss server -----> original dest | |||
| `ss-tunnel` provides ssh `-L` local-forwarding-like tunnel. Typically it's used to tunnel DNS traffic to the remote. | |||
| plain ss plain | |||
| ---------> tcp|udp:local_address:local_port ------> ss server -------> tunnel_address | |||
| `ss-server`, the "ss server" in the above diagram | |||
| ## uci | |||
| Option names are the same as those used in json config files. Check `validate_xxx` func definition of the [service script](files/shadowsocks-libev.init) and shadowsocks-libev's own documentation for supported options and expected value types. A [sample config file](files/shadowsocks-libev.config) is also provided for reference. | |||
| Every section have a `disabled` option to temporarily turn off the component instance or component instances referring to it. | |||
| Section type `server` is for definition of remote shadowsocks servers. They will be referred to from other component sections and as such should be named (as compared to anonymous section). | |||
| Section type `ss_local`, `ss_redir`, `ss_tunnel` are for specification of shadowsocks-libev components. They share mostly a common set of options like `local_port`, `verbose`, `fast_open`, `timeout`, etc. | |||
| We can have multiple instances of component and `server` sections. The relationship between them is many-to-one. This will have the following implications | |||
| - It's possible to have both `ss_local` and `ss_redir` referring to the same `server` definition | |||
| - It's possible to have multiple instances of `ss_redir` listening on the same address:port with `reuse_port` enabled referring to the same or different `server` sections | |||
| `ss_rules` section is for configuring the behaviour of `ss-rules` script. There can only exist at most one such section with the name also being `ss_rules` | |||
| redir_tcp name of ss_redir section with mode tcp_only or tcp_and_udp | |||
| redir_udp name of ss_redir section with mode udp_only or tcp_and_udp | |||
| --- incoming packets having source address in | |||
| src_ips_bypass will bypass the redir chain | |||
| src_ips_forward will always go through the redir chain | |||
| src_ips_checkdst will continue to have their destination addresses checked | |||
| --- otherwise, the default action can be specified with | |||
| src_default bypass, forward, [checkdst] | |||
| --- for local out tcp packets, the default action can be specified with | |||
| local_default [bypass], forward, checkdst | |||
| --- if the previous check result is checkdst, | |||
| --- then packets having destination address in | |||
| dst_ips_bypass_file | |||
| dst_ips_bypass will bypass the redir chain | |||
| dst_ips_forward_file | |||
| dst_ips_forward will go through the redir chain | |||
| ## notes and faq | |||
| Useful paths and commands for debugging | |||
| # check current running status | |||
| ubus call service list '{"name": "shadowsocks-libev"}' | |||
| ubus call service list '{"name": "shadowsocks-libev", "verbose": true}' | |||
| # dump validate definition | |||
| ubus call service validate '{"package": "shadowsocks-libev"}' | |||
| ubus call service validate '{"package": "shadowsocks-libev"}' \ | |||
| | jsonfilter -e '$["shadowsocks-libev"]["ss_tunnel"]' | |||
| # check json config | |||
| ls -l /var/etc/shadowsocks-libev/ | |||
| # set uci config option verbose to 1, restart the service and follow the log | |||
| logread -f | |||
| ss-redir needs to open a new socket and setsockopt IP_TRANSPARENT when sending udp reply to client. This requires `CAP_NET_ADMIN` and as such the process cannot run as `nobody` | |||
| ss-local, ss-redir, etc. supports specifying an array of remote ss server, but supporting this in uci seems to be overkill. The workaround can be defining multiple `server` sections and multiple `ss-redir` instances with `reuse_port` enabled | |||
+ 0
- 6
net/shadowsocks-libev/files/firewall.include
View File
| @ -1,6 +0,0 @@ | |||
| #!/bin/sh | |||
| if pidof ss-redir>/dev/null; then | |||
| /etc/init.d/shadowsocks-libev rules | |||
| logger -t ShadowSocks-libev "Reloading ShadowSocks-libev due to restart of firewall" | |||
| fi | |||
+ 2
- 0
net/shadowsocks-libev/files/firewall.ss-rules
View File
| @ -0,0 +1,2 @@ | |||
| #!/bin/sh | |||
| /etc/init.d/shadowsocks-libev reload | |||
+ 58
- 13
net/shadowsocks-libev/files/shadowsocks-libev.config
View File
| @ -1,15 +1,60 @@ | |||
| config shadowsocks-libev | |||
| option enable '1' | |||
| option server '127.0.0.1' | |||
| option server_port '8388' | |||
| config ss_local | |||
| option disabled 1 | |||
| option server 'sss0' | |||
| option local_address '0.0.0.0' | |||
| option local_port '1080' | |||
| option password 'barfoo!' | |||
| option timeout '30' | |||
| config ss_tunnel | |||
| option disabled 1 | |||
| option server 'sss0' | |||
| option local_address '0.0.0.0' | |||
| option local_port '1090' | |||
| option tunnel_address 'example.com:80' | |||
| option mode 'tcp_and_udp' | |||
| option timeout '60' | |||
| option encrypt_method 'rc4-md5' | |||
| option ignore_list '/dev/null' | |||
| option udp_mode '0' | |||
| option tunnel_enable '1' | |||
| option tunnel_port '5300' | |||
| option tunnel_forward '8.8.4.4:53' | |||
| option lan_ac_mode '0' | |||
| config ss_redir hi | |||
| option disabled 1 | |||
| option server 'sss0' | |||
| option local_address '0.0.0.0' | |||
| option local_port '1100' | |||
| option mode 'tcp_and_udp' | |||
| option timeout '60' | |||
| option fast_open 1 | |||
| option verbose 1 | |||
| option reuse_port 1 | |||
| config ss_redir hj | |||
| option disabled 1 | |||
| option server 'sss0' | |||
| option local_address '0.0.0.0' | |||
| option local_port '1100' | |||
| option mode 'tcp_and_udp' | |||
| option timeout '60' | |||
| option fast_open 1 | |||
| option verbose 1 | |||
| option reuse_port 1 | |||
| config ss_rules 'ss_rules' | |||
| option disabled 1 | |||
| option redir_tcp 'hi' | |||
| option redir_udp 'hi' | |||
| option src_default 'bypass' | |||
| option local_default 'checkdst' | |||
| list src_ips_forward '192.168.1.4' | |||
| list dst_ips_forward '8.8.8.8' | |||
| config server 'sss0' | |||
| option disabled 1 | |||
| option server '192.168.1.3' | |||
| option server_port '9001' | |||
| option password '********' | |||
| option method 'aes-256-cfb' | |||
| config ss_server | |||
| option disabled 1 | |||
| option server_port '9001' | |||
| option password '********' | |||
| option method 'aes-256-cfb' | |||
| option bind_address '192.168.7.72' | |||
+ 298
- 138
net/shadowsocks-libev/files/shadowsocks-libev.init
View File
| @ -1,156 +1,316 @@ | |||
| #!/bin/sh /etc/rc.common | |||
| # | |||
| # Copyright (C) 2017 Yousong Zhou <yszhou4tech@gmail.com> | |||
| # | |||
| # This is free software, licensed under the GNU General Public License v3. | |||
| # See /LICENSE for more information. | |||
| # | |||
| START=90 | |||
| STOP=15 | |||
| SERVICE_USE_PID=1 | |||
| SERVICE_WRITE_PID=1 | |||
| SERVICE_DAEMONIZE=1 | |||
| EXTRA_COMMANDS="rules" | |||
| CONFIG_FILE=/var/etc/shadowsocks-libev.json | |||
| get_config() { | |||
| config_get_bool enable $1 enable | |||
| config_get server $1 server | |||
| config_get server_port $1 server_port | |||
| config_get local_port $1 local_port | |||
| config_get timeout $1 timeout | |||
| config_get password $1 password | |||
| config_get encrypt_method $1 encrypt_method | |||
| config_get ignore_list $1 ignore_list | |||
| config_get udp_mode $1 udp_mode | |||
| config_get udp_server $1 udp_server | |||
| config_get udp_server_port $1 udp_server_port | |||
| config_get udp_local_port $1 udp_local_port | |||
| config_get udp_timeout $1 udp_timeout | |||
| config_get udp_password $1 udp_password | |||
| config_get udp_encrypt_method $1 udp_encrypt_method | |||
| config_get_bool tunnel_enable $1 tunnel_enable | |||
| config_get tunnel_port $1 tunnel_port | |||
| config_get tunnel_forward $1 tunnel_forward | |||
| config_get lan_ac_mode $1 lan_ac_mode | |||
| config_get lan_ac_ip $1 lan_ac_ip | |||
| config_get wan_bp_ip $1 wan_bp_ip | |||
| config_get wan_fw_ip $1 wan_fw_ip | |||
| config_get ipt_ext $1 ipt_ext | |||
| : ${timeout:=60} | |||
| : ${udp_timeout:=60} | |||
| : ${tunnel_port:=5300} | |||
| : ${tunnel_forward:=8.8.4.4:53} | |||
| } | |||
| start_rules() { | |||
| local ac_args | |||
| if [ -n "$lan_ac_ip" ]; then | |||
| case $lan_ac_mode in | |||
| 1) ac_args="w$lan_ac_ip" | |||
| ;; | |||
| 2) ac_args="b$lan_ac_ip" | |||
| ;; | |||
| esac | |||
| USE_PROCD=1 | |||
| START=99 | |||
| ss_confdir=/var/etc/shadowsocks-libev | |||
| ss_bindir=/usr/bin | |||
| q='"' | |||
| ss_mkjson() { | |||
| echo "{" >"$confjson" | |||
| if ss_mkjson_ "$@" >>$confjson; then | |||
| sed -i -e '/^\s*$/d' -e '2,$s/^/\t/' -e '$s/,$//' "$confjson" | |||
| echo "}" >>"$confjson" | |||
| else | |||
| rm -f "$confjson" | |||
| return 1 | |||
| fi | |||
| /usr/bin/ss-rules \ | |||
| -s "$server" \ | |||
| -l "$local_port" \ | |||
| -S "$udp_server" \ | |||
| -L "$udp_local_port" \ | |||
| -i "$ignore_list" \ | |||
| -a "$ac_args" \ | |||
| -b "$wan_bp_ip" \ | |||
| -w "$wan_fw_ip" \ | |||
| -e "$ipt_ext" \ | |||
| -o $udp | |||
| return $? | |||
| } | |||
| start_redir() { | |||
| cat <<-EOF >$CONFIG_FILE | |||
| { | |||
| "server": "$server", | |||
| "server_port": $server_port, | |||
| "local_address": "0.0.0.0", | |||
| "local_port": $local_port, | |||
| "password": "$password", | |||
| "timeout": $timeout, | |||
| "method": "$encrypt_method" | |||
| } | |||
| EOF | |||
| if [ "$udp_mode" = 2 ]; then | |||
| /usr/bin/ss-redir \ | |||
| -c $CONFIG_FILE \ | |||
| -f /var/run/ss-redir_t.pid | |||
| cat <<-EOF >$CONFIG_FILE | |||
| { | |||
| "server": "$udp_server", | |||
| "server_port": $udp_server_port, | |||
| "local_address": "0.0.0.0", | |||
| "local_port": $udp_local_port, | |||
| "password": "$udp_password", | |||
| "timeout": $udp_timeout, | |||
| "method": "$udp_encrypt_method" | |||
| } | |||
| EOF | |||
| } | |||
| ss_mkjson_() { | |||
| local func | |||
| for func in "$@"; do | |||
| if ! "$func"; then | |||
| return 1 | |||
| fi | |||
| done | |||
| } | |||
| ss_mkjson_server_conf() { | |||
| local cfgserver | |||
| config_get cfgserver "$cfg" server | |||
| [ -n "$cfgserver" ] || return 1 | |||
| eval "$(validate_server_section "$cfg" ss_validate_mklocal)" | |||
| validate_server_section "$cfgserver" || return 1 | |||
| [ "$disabled" = 0 ] || return 1 | |||
| ss_mkjson_server_conf_ "$cfgserver" | |||
| } | |||
| ss_mkjson_server_conf_() { | |||
| [ -n "$server_port" ] || return 1 | |||
| cat <<-EOF | |||
| ${server:+${q}server${q}: ${q}$server${q},} | |||
| "server_port": $server_port, | |||
| ${method:+${q}method${q}: ${q}$method${q},} | |||
| ${key:+${q}key${q}: ${q}$key${q},} | |||
| ${password:+${q}password${q}: ${q}$password${q},} | |||
| EOF | |||
| } | |||
| ss_mkjson_common_conf() { | |||
| [ "$fast_open" = 0 ] && fast_open=false || fast_open=true | |||
| [ "$reuse_port" = 0 ] && reuse_port=false || reuse_port=true | |||
| cat <<-EOF | |||
| "use_syslog": true, | |||
| "fast_open": $fast_open, | |||
| "reuse_port": $reuse_port, | |||
| ${local_address:+${q}local_address${q}: ${q}$local_address${q},} | |||
| ${local_port:+${q}local_port${q}: $local_port,} | |||
| ${mode:+${q}mode${q}: ${q}$mode${q},} | |||
| ${mtu:+${q}mtu${q}: $mtu,} | |||
| ${timeout:+${q}timeout${q}: $timeout,} | |||
| ${user:+${q}user${q}: ${q}$user${q},} | |||
| EOF | |||
| } | |||
| ss_mkjson_ss_local_conf() { | |||
| ss_mkjson_server_conf | |||
| } | |||
| ss_mkjson_ss_redir_conf() { | |||
| ss_mkjson_server_conf | |||
| } | |||
| ss_mkjson_ss_server_conf() { | |||
| ss_mkjson_server_conf_ | |||
| } | |||
| ss_mkjson_ss_tunnel_conf() { | |||
| ss_mkjson_server_conf || return 1 | |||
| [ -n "$tunnel_address" ] || return 1 | |||
| cat <<-EOF | |||
| ${tunnel_address:+${q}tunnel_address${q}: ${q}$tunnel_address${q},} | |||
| EOF | |||
| } | |||
| ss_xxx() { | |||
| local cfg="$1" | |||
| local cfgtype="$2" | |||
| local bin="$ss_bindir/${cfgtype/_/-}" | |||
| local confjson="$ss_confdir/$cfgtype.$cfg.json" | |||
| [ -x "$bin" ] || return | |||
| eval "$("validate_${cfgtype}_section" "$cfg" ss_validate_mklocal)" | |||
| "validate_${cfgtype}_section" "$cfg" | |||
| [ "$disabled" = 0 ] || return | |||
| if ss_mkjson \ | |||
| ss_mkjson_common_conf \ | |||
| ss_mkjson_${cfgtype}_conf \ | |||
| ; then | |||
| procd_open_instance "$cfgtype.$cfg" | |||
| procd_set_param command "$bin" -c "$confjson" | |||
| [ "$verbose" = 0 ] || procd_append_param command -v | |||
| [ -z "$bind_address" ] || procd_append_param command -b "$bind_address" | |||
| [ -z "$manager_address" ] || procd_append_param command --manager-address "$manager_address" | |||
| procd_set_param file "$confjson" | |||
| procd_set_param respawn | |||
| procd_close_instance | |||
| ss_rules_cb "$cfg" | |||
| fi | |||
| /usr/bin/ss-redir \ | |||
| -c $CONFIG_FILE \ | |||
| -f /var/run/ss-redir.pid \ | |||
| $udp | |||
| return $? | |||
| } | |||
| start_tunnel() { | |||
| : ${udp:="-u"} | |||
| /usr/bin/ss-tunnel \ | |||
| -c $CONFIG_FILE \ | |||
| -l $tunnel_port \ | |||
| -L $tunnel_forward \ | |||
| -f /var/run/ss-tunnel.pid \ | |||
| $udp | |||
| return $? | |||
| ss_rules_cb() { | |||
| local cfgserver | |||
| local server | |||
| [ "$cfgtype" != ss_server ] || return | |||
| config_get cfgserver "$cfg" server | |||
| config_get server "$cfgserver" server | |||
| ss_rules_servers="$ss_rules_servers $server" | |||
| if [ "$cfgtype" = ss_redir ]; then | |||
| if [ "$mode" = tcp_only -o "$mode" = "tcp_and_udp" ]; then | |||
| eval "ss_rules_redir_tcp_$cfg=$local_port" | |||
| fi | |||
| if [ "$mode" = udp_only -o "$mode" = "tcp_and_udp" ]; then | |||
| eval "ss_rules_redir_udp_$cfg=$local_port" | |||
| eval "ss_rules_redir_server_udp_$cfg=$server" | |||
| fi | |||
| fi | |||
| } | |||
| rules() { | |||
| config_load shadowsocks-libev | |||
| config_foreach get_config shadowsocks-libev | |||
| [ "$enable" = 1 ] || exit 0 | |||
| mkdir -p /var/run /var/etc | |||
| : ${server:?} | |||
| : ${server_port:?} | |||
| : ${local_port:?} | |||
| : ${password:?} | |||
| : ${encrypt_method:?} | |||
| case $udp_mode in | |||
| 1) udp="-u" | |||
| ;; | |||
| 2) | |||
| udp="-U" | |||
| : ${udp_server:?} | |||
| : ${udp_server_port:?} | |||
| : ${udp_local_port:?} | |||
| : ${udp_password:?} | |||
| : ${udp_encrypt_method:?} | |||
| ;; | |||
| ss_rules() { | |||
| local cfg="ss_rules" | |||
| local bin="$ss_bindir/ss-rules" | |||
| local cfgtype | |||
| local args local_port_tcp local_port_udp server_udp | |||
| local i a_args d_args | |||
| [ -x "$bin" ] || return 1 | |||
| config_get cfgtype "$cfg" TYPE | |||
| [ "$cfgtype" = ss_rules ] || return 1 | |||
| eval "$(validate_ss_rules_section "$cfg" ss_validate_mklocal)" | |||
| validate_ss_rules_section "$cfg" | |||
| [ "$disabled" = 0 ] || return 1 | |||
| eval local_port_tcp="\$ss_rules_redir_tcp_$redir_tcp" | |||
| eval local_port_udp="\$ss_rules_redir_udp_$redir_udp" | |||
| eval server_udp="\$ss_rules_redir_server_udp_$redir_udp" | |||
| [ -z "$local_port_udp" ] || args="$args -U" | |||
| case "$local_default" in | |||
| forward) args="$args -O" ;; | |||
| checkdst) args="$args -o" ;; | |||
| esac | |||
| case "$src_default" in | |||
| bypass) d_args=RETURN ;; | |||
| forward) d_args=SS_SPEC_WAN_FW ;; | |||
| checkdst) d_args=SS_SPEC_WAN_AC ;; | |||
| esac | |||
| ss_rules_servers="$(echo "$ss_rules_servers" | tr ' ' '\n' | sort -u)" | |||
| for i in $src_ips_bypass; do a_args="b,$i $a_args"; done | |||
| for i in $src_ips_forward; do a_args="g,$i $a_args"; done | |||
| for i in $src_ips_checkdst; do a_args="n,$i $a_args"; done | |||
| "$bin" \ | |||
| -s "$ss_rules_servers" \ | |||
| -l "$local_port_tcp" \ | |||
| -S "$server_udp" \ | |||
| -L "$local_port_udp" \ | |||
| -B "$dst_ips_bypass_file" \ | |||
| -W "$dst_ips_forward_file" \ | |||
| -b "$dst_ips_bypass" \ | |||
| -w "$dst_ips_forward" \ | |||
| -e "$ipt_args" \ | |||
| -a "$a_args" \ | |||
| -d "$d_args" \ | |||
| $args \ | |||
| || "$bin" -f | |||
| } | |||
| start_service() { | |||
| local cfgtype="$1" | |||
| mkdir -p "$ss_confdir" | |||
| config_load shadowsocks-libev | |||
| for cfgtype in ss_local ss_redir ss_server ss_tunnel; do | |||
| config_foreach ss_xxx "$cfgtype" "$cfgtype" | |||
| done | |||
| ss_rules | |||
| } | |||
| stop_service() { | |||
| local bin="$ss_bindir/ss-rules" | |||
| [ -x "$bin" ] && "$bin" -f | |||
| rm -rf "$ss_confdir" | |||
| } | |||
| start_rules | |||
| service_triggers() { | |||
| procd_add_reload_interface_trigger wan | |||
| procd_add_reload_trigger shadowsocks-libev | |||
| procd_open_validate | |||
| validate_server_section | |||
| validate_ss_local_section | |||
| validate_ss_redir_section | |||
| validate_ss_rules_section | |||
| validate_ss_server_section | |||
| validate_ss_tunnel_section | |||
| procd_close_validate | |||
| } | |||
| boot() { | |||
| until iptables-save -t nat | grep -q "^:zone_lan_prerouting"; do | |||
| sleep 1 | |||
| ss_validate_mklocal() { | |||
| local tuple opts | |||
| shift 2 | |||
| for tuple in "$@"; do | |||
| opts="${tuple%%:*} $opts" | |||
| done | |||
| start | |||
| [ -z "$opts" ] || echo "local $opts" | |||
| } | |||
| ss_validate() { | |||
| uci_validate_section shadowsocks-libev "$@" | |||
| } | |||
| validate_common_server_options_() { | |||
| local cfgtype="$1"; shift | |||
| local cfg="$1"; shift | |||
| local func="$1"; shift | |||
| local stream_methods='"table", "rc4", "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr", "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb", "camellia-192-cfb", "camellia-256-cfb", "salsa20", "chacha20", "chacha20-ietf"' | |||
| local aead_methods='"aes-128-gcm", "aes-192-gcm", "aes-256-gcm"' | |||
| "${func:-ss_validate}" "$cfgtype" "$cfg" "$@" \ | |||
| 'disabled:bool:false' \ | |||
| 'server:host' \ | |||
| 'server_port:port' \ | |||
| 'password:string' \ | |||
| 'key:string' \ | |||
| "method:or($stream_methods, $aead_methods)" | |||
| } | |||
| validate_common_client_options_() { | |||
| validate_common_options_ "$@" \ | |||
| 'server:uci("shadowsocks-libev", "@server")' \ | |||
| 'local_address:host:0.0.0.0' \ | |||
| 'local_port:port' | |||
| } | |||
| validate_common_options_() { | |||
| local cfgtype="$1"; shift | |||
| local cfg="$1"; shift | |||
| local func="$1"; shift | |||
| "${func:-ss_validate}" "$cfgtype" "$cfg" "$@" \ | |||
| 'disabled:bool:false' \ | |||
| 'verbose:bool:false' \ | |||
| 'fast_open:bool:false' \ | |||
| 'reuse_port:bool:false' \ | |||
| 'mode:or("tcp_only", "udp_only", "tcp_and_udp")' \ | |||
| 'mtu:uinteger' \ | |||
| 'timeout:uinteger' \ | |||
| 'user:string' | |||
| } | |||
| validate_server_section() { | |||
| validate_common_server_options_ server "$1" "${2}" | |||
| } | |||
| validate_ss_local_section() { | |||
| validate_common_client_options_ ss_local "$1" "${2}" | |||
| } | |||
| validate_ss_redir_section() { | |||
| validate_common_client_options_ ss_redir "$1" "${2}" | |||
| } | |||
| validate_ss_rules_section() { | |||
| "${2:-ss_validate}" ss_rules "$1" \ | |||
| 'disabled:bool:false' \ | |||
| 'redir_tcp:uci("shadowsocks-libev", "@ss_redir")' \ | |||
| 'redir_udp:uci("shadowsocks-libev", "@ss_redir")' \ | |||
| 'src_ips_bypass:list(ipaddr)' \ | |||
| 'src_ips_forward:list(ipaddr)' \ | |||
| 'src_ips_checkdst:list(ipaddr)' \ | |||
| 'dst_ips_bypass_file:file' \ | |||
| 'dst_ips_bypass:list(ipaddr)' \ | |||
| 'dst_ips_forward_file:file' \ | |||
| 'dst_ips_forward:list(ipaddr)' \ | |||
| 'src_default:or("bypass", "forward", "checkdst")' \ | |||
| 'local_default:or("bypass", "forward", "checkdst")' \ | |||
| 'ipt_args:string' | |||
| } | |||
| start() { | |||
| rules && start_redir | |||
| [ "$tunnel_enable" = 1 ] && start_tunnel | |||
| validate_ss_server_section() { | |||
| validate_common_server_options_ ss_server "$1" \ | |||
| validate_common_options_ \ | |||
| "${2}" \ | |||
| 'bind_address:ipaddr' \ | |||
| 'manager_address:host' | |||
| } | |||
| stop() { | |||
| /usr/bin/ss-rules -f | |||
| killall -q -9 ss-redir | |||
| killall -q -9 ss-tunnel | |||
| validate_ss_tunnel_section() { | |||
| validate_common_client_options_ ss_tunnel "$1" \ | |||
| "${2}" \ | |||
| 'tunnel_address:regex(".+\:[0-9]+")' | |||
| } | |||
+ 182
- 141
net/shadowsocks-libev/files/ss-rules
View File
+ 10
- 0
net/shadowsocks-libev/files/ss-rules.defaults
View File
| @ -0,0 +1,10 @@ | |||
| #!/bin/sh | |||
| s=firewall.ss_rules | |||
| uci get "$s" >/dev/null && exit 0 | |||
| uci batch <<-EOF | |||
| set $s=include | |||
| set $s.path=/etc/firewall.ss-rules | |||
| set $s.reload=1 | |||
| commit firewall | |||
| EOF | |||
+ 151
- 0
net/shadowsocks-libev/patches/0001-decouple-use_syslog-from-pid_flags.patch
View File
| @ -0,0 +1,151 @@ | |||
| From ea18a4ffcd9a8de4c5b888d9dc58a2b173c5ff8e Mon Sep 17 00:00:00 2001 | |||
| From: Yousong Zhou <yszhou4tech@gmail.com> | |||
| Date: Mon, 26 Jun 2017 14:49:36 +0800 | |||
| Subject: [PATCH] decouple use_syslog from pid_flags | |||
| Sometimes we need processes to run in the foreground to be supervised | |||
| and at the same time use syslog facility instead of logging its stdout, | |||
| stderr output | |||
| --- | |||
| src/jconf.c | 6 ++++++ | |||
| src/local.c | 2 +- | |||
| src/manager.c | 2 +- | |||
| src/redir.c | 2 +- | |||
| src/server.c | 2 +- | |||
| src/tunnel.c | 2 +- | |||
| src/utils.h | 18 +++++++++++------- | |||
| 7 files changed, 22 insertions(+), 12 deletions(-) | |||
| diff --git a/src/jconf.c b/src/jconf.c | |||
| index 3c58148..05445c3 100644 | |||
| --- a/src/jconf.c | |||
| +++ b/src/jconf.c | |||
| @@ -313,6 +313,12 @@ read_jconf(const char *file) | |||
| check_json_value_type(value, json_boolean, | |||
| "invalid config file: option 'ipv6_first' must be a boolean"); | |||
| conf.ipv6_first = value->u.boolean; | |||
| +#ifdef HAS_SYSLOG | |||
| + } else if (strcmp(name, "use_syslog") == 0) { | |||
| + check_json_value_type(value, json_boolean, | |||
| + "invalid config file: option 'use_syslog' must be a boolean"); | |||
| + use_syslog = value->u.boolean; | |||
| +#endif | |||
| } | |||
| } | |||
| } else { | |||
| diff --git a/src/local.c b/src/local.c | |||
| index aa69205..d123516 100644 | |||
| --- a/src/local.c | |||
| +++ b/src/local.c | |||
| @@ -1519,8 +1519,8 @@ main(int argc, char **argv) | |||
| local_addr = "127.0.0.1"; | |||
| } | |||
| + USE_SYSLOG(argv[0], pid_flags); | |||
| if (pid_flags) { | |||
| - USE_SYSLOG(argv[0]); | |||
| daemonize(pid_path); | |||
| } | |||
| diff --git a/src/manager.c b/src/manager.c | |||
| index 6e7197c..338ab85 100644 | |||
| --- a/src/manager.c | |||
| +++ b/src/manager.c | |||
| @@ -1149,8 +1149,8 @@ main(int argc, char **argv) | |||
| timeout = "60"; | |||
| } | |||
| + USE_SYSLOG(argv[0], pid_flags); | |||
| if (pid_flags) { | |||
| - USE_SYSLOG(argv[0]); | |||
| daemonize(pid_path); | |||
| } | |||
| diff --git a/src/redir.c b/src/redir.c | |||
| index 4856007..88660f8 100644 | |||
| --- a/src/redir.c | |||
| +++ b/src/redir.c | |||
| @@ -1137,8 +1137,8 @@ main(int argc, char **argv) | |||
| #endif | |||
| } | |||
| + USE_SYSLOG(argv[0], pid_flags); | |||
| if (pid_flags) { | |||
| - USE_SYSLOG(argv[0]); | |||
| daemonize(pid_path); | |||
| } | |||
| diff --git a/src/server.c b/src/server.c | |||
| index 747f0e5..7e3df9e 100644 | |||
| --- a/src/server.c | |||
| +++ b/src/server.c | |||
| @@ -1726,8 +1726,8 @@ main(int argc, char **argv) | |||
| } | |||
| #endif | |||
| + USE_SYSLOG(argv[0], pid_flags); | |||
| if (pid_flags) { | |||
| - USE_SYSLOG(argv[0]); | |||
| daemonize(pid_path); | |||
| } | |||
| diff --git a/src/tunnel.c b/src/tunnel.c | |||
| index 77c7380..2419fa0 100644 | |||
| --- a/src/tunnel.c | |||
| +++ b/src/tunnel.c | |||
| @@ -1022,8 +1022,8 @@ main(int argc, char **argv) | |||
| local_addr = "127.0.0.1"; | |||
| } | |||
| + USE_SYSLOG(argv[0], pid_flags); | |||
| if (pid_flags) { | |||
| - USE_SYSLOG(argv[0]); | |||
| daemonize(pid_path); | |||
| } | |||
| diff --git a/src/utils.h b/src/utils.h | |||
| index 2603e85..53f3983 100644 | |||
| --- a/src/utils.h | |||
| +++ b/src/utils.h | |||
| @@ -35,7 +35,7 @@ | |||
| #include <android/log.h> | |||
| #define USE_TTY() | |||
| -#define USE_SYSLOG(ident) | |||
| +#define USE_SYSLOG(ident, _cond) | |||
| #define LOGI(...) \ | |||
| ((void)__android_log_print(ANDROID_LOG_DEBUG, "shadowsocks", \ | |||
| __VA_ARGS__)) | |||
| @@ -53,7 +53,7 @@ | |||
| extern FILE *logfile; | |||
| #define TIME_FORMAT "%Y-%m-%d %H:%M:%S" | |||
| #define USE_TTY() | |||
| -#define USE_SYSLOG(ident) | |||
| +#define USE_SYSLOG(ident, _cond) | |||
| #define USE_LOGFILE(ident) \ | |||
| do { \ | |||
| if (ident != NULL) { logfile = fopen(ident, "w+"); } } \ | |||
| @@ -99,11 +99,15 @@ extern int use_syslog; | |||
| use_tty = isatty(STDERR_FILENO); \ | |||
| } while (0) | |||
| -#define USE_SYSLOG(ident) \ | |||
| - do { \ | |||
| - use_syslog = 1; \ | |||
| - openlog((ident), LOG_CONS | LOG_PID, 0); } \ | |||
| - while (0) | |||
| +#define USE_SYSLOG(_ident, _cond) \ | |||
| + do { \ | |||
| + if (!use_syslog && (_cond)) { \ | |||
| + use_syslog = 1; \ | |||
| + } \ | |||
| + if (use_syslog) { \ | |||
| + openlog((_ident), LOG_CONS | LOG_PID, 0); \ | |||
| + } \ | |||
| + } while (0) | |||
| #define LOGI(format, ...) \ | |||
| do { \ | |||
| -- | |||
| 2.12.2 | |||