aboutsummaryrefslogtreecommitdiff
path: root/net/shadowsocks-libev/files/ss-rules
Commit message (Collapse)AuthorAge
* shadowsocks-libev: add remote server ips to dst bypass ipsetYousong Zhou2024-03-12
| | | | | | | | | | | To align with old iptables-based ss-rules implementation. Supersedes openwrt/packages#20239 Link: https://github.com/openwrt/packages/pull/20239 Signed-off-by: Luis Liou <liouluis@gmail.com> [minor fixup on commit title, version bump, etc.] Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: Add 'auto-merge' flag to avoid conflictsLi Xin2023-01-28
| | | | | | | Link: https://github.com/openwrt/packages/pull/19872 Signed-off-by: Li Xin <i@crzidea.com> (squash commits) Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: setup policy rules for udp/ip6Yousong Zhou2022-08-11
| | | | | | Supersedes: https://github.com/openwrt/packages/pull/18852 Fixes: https://github.com/openwrt/packages/issues/18850 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: add nft_tcp_extra/nft_udp_extra optionsZhong Jianxin2022-03-07
| | | | | | | | | | | | | | | | | To add extra statement to tcp/udp forward rule, example: ``` config ss_rules 'ss_rules' ... option nft_tcp_extra 'tcp dport { 80, 443 }' # tcp only forward connections with dport 80 or 443 option nft_udp_extra 'udp dport { 53 }' # udp only forward connections with dport 53 ``` This somewhat restores the old ipt_args functionality. Signed-off-by: Zhong Jianxin <azuwis@gmail.com> Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> (Amend README.md a bit)
* shadowsocks-libev: convert to using nftYousong Zhou2022-03-01
| | | | | | | | | | | | | | | It will be mostly implemented with ucode templates installed at /usr/share/ss-rules and called from init script. The generated nftables rules will be stored at /etc/nftables.d/ Incompatible changes were introduced as described in the README.md file - Netfilter ipset was replaced with nftables sets - UCI options ipt_args and dst_forward_recentrst of section ss_rules are now deprecated. The former does not apply to nftables. The later not yet implemented with nftables. Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ignore error from flushing route tableYousong Zhou2020-05-06
| | | | | | | | | | | | | | | | | | | | | | | | Linux kernel and iproute2 together now implement strict checking of the existence of route tables. Previously kernel does not support filtering by table id, now it does and will error with nlmsgerr "ipv4: FIB table does not exist". Previously iproute2 dump all routes and filter by table id in userspace, now this has changed with iproute2 commit c7e6371bc4af ("ip route: Add protocol, table id and device to dump request") Error scene root@OpenWrt:/# ip route flush table 100 Error: ipv4: FIB table does not exist. Flush terminated root@OpenWrt:/# echo $? 2 Fixes: https://github.com/openwrt/packages/issues/12095 Ref: https://lists.openwall.net/netdev/2019/05/02/105 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: tweak for readabilityYousong Zhou2019-02-12
| | | | | | | - quash errors on detection of ipv6 nat - remove unnecessary rule args "--comment ..." and "-p ..." Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: simplify grep_afYousong Zhou2019-01-22
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: add ipv6 supportYousong Zhou2019-01-21
| | | | | | | | | | | | | | | It will require support from ip6tables-mod-nat. The added functionality will be skipped otherwise. For $o_dst_bypass6_, include only address blocks in link [1] whose "Globally Reachable" field are explicitly "False" Closes openwrt/packages#7508 [1] IANA IPv6 Special-Purpose Address Registry, https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: eliminiate not needed local varYousong Zhou2017-09-18
|
* shadowsocks-libev: ss-rules: query resolveip only for ipv4 addressesYousong Zhou2017-08-30
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: fix multiple continous \x20 in $o_ifnamesYousong Zhou2017-08-30
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: resolve server names before adding to ipsetYousong Zhou2017-08-30
| | | | | | | | | | ipset command line utility supports ranges of address: IP-IP, but the dash character is also valid character in host names. If we have a remote server ss-00.example.com, ipset may complain that ipset v6.32: Syntax error: cannot parse ss: resolving to IPv4 address failed Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: new bool option --dst-forward-recentrstYousong Zhou2017-08-22
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: rename usage funcYousong Zhou2017-08-22
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: rewrite ss-rulesYousong Zhou2017-08-20
| | | | | | | | | | | | - New UCI options ifnames, dst_default - UCI options src_ips_xxx now accept cidr as their values - Export ipset names as part of the interface so that it can be depended on and used by other programs - Bypass only remote servers used ss-redir instances, so that it's possible to let other servers to go through existing re-redir instances Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: ss-rules: add executable bitsYousong Zhou2017-07-23
|
* shadowsocks-libev: rewriteYousong Zhou2017-07-02
| | | | | | | | | | | | | | | | | | - Selecting only a single or subset of all components of shadowsocks-libev is now possible (this is the main motivation behind the rewrite) - Configuring multiple instances of the same component is now also possible - Same option names as with the json config - Unified configuration generation method for each component - Add support for ss-local, ss-tunnel, ss-server - Most data validation is now done with validate_data - USE_PROCD=1 - Update ss-rules with the one from shadowsocks/luci-app-shadowsocks - Add README.md - Set myself as the maintainer Addresses #4435 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* shadowsocks-libev: bump versionJian Chang2015-07-22
| | | | | | | Fix the multiple UDP source port issue. Allow using different IP and ports for TCP and UDP Signed-off-by: Jian Chang <aa65535@live.com>
* shadowsocks-libev: add packageaa655352015-07-03
Shadowsocks-libev is a lightweight secured socks5 proxy for embedded devices and low end boxes. Signed-off-by: aa65535 <aa65535@live.com>
Powered by cgit, Themed by Ted Yin.