redsocks

#!/bin/sh /etc/rc.common
# Copyright (C) 2007 OpenWrt.org

START=90
USE_PROCD=1

# Load configuration helpers
. /lib/functions.sh

generate_config() {
	local ip port type login password local_ip local_port
	
	config_load redsocks
	
	config_get ip connection ip
	config_get port connection port
	config_get type connection type "socks5"
	config_get login connection login
	config_get password connection password
	config_get local_ip connection local_ip "0.0.0.0"
	config_get local_port connection local_port "1337"

	# Require basic parameters to start
	[ -z "$ip" ] || [ -z "$port" ] && return 1

	mkdir -p /var/etc

	# Generate redsocks.conf dynamically.
	# We set daemon = off because procd manages daemonization/monitoring.
	cat <<EOF > /var/etc/redsocks.conf
base {
	log_debug = off;
	log_info = on;
	log = "syslog:local7";
	daemon = off;
	redirector = iptables;
}

redsocks {
	local_ip = $local_ip;
	local_port = $local_port;
	ip = $ip;
	port = $port;
	type = $type;
EOF

	if [ -n "$login" ]; then
		echo "	login = \"$login\";" >> /var/etc/redsocks.conf
	fi
	if [ -n "$password" ]; then
		echo "	password = \"$password\";" >> /var/etc/redsocks.conf
	fi

	echo "}" >> /var/etc/redsocks.conf
	return 0
}

add_bypass_rule() {
	[ -n "$1" ] && iptables -t nat -A REDSOCKS -d "$1" -j RETURN
}

iptable_start() {
	local local_port interface
	config_load redsocks
	config_get local_port connection local_port "1337"
	config_get interface connection interface "br-lan"

	/bin/echo -n "running proxy bypass iptables ..."

	# Create a new chain for Redsocks
	iptables -t nat -N REDSOCKS 2>/dev/null

	# Clean the Redsocks chain in case it already exists
	iptables -t nat -F REDSOCKS 2>/dev/null

	# Ignore private/local IP addresses
	iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
	iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
	iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
	iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
	iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
	iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
	iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
	iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN

	# Custom direct connections (bypass rules)
	config_list_foreach connection bypass_domain add_bypass_rule
	config_list_foreach connection bypass_ip add_bypass_rule

	# Redirect everything else to local redsocks port
	iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports "$local_port"

	# Apply Redsocks chain to PREROUTING for incoming packets on interface
	# First, delete if it already exists to avoid duplicates
	iptables -t nat -D PREROUTING -i "$interface" -p tcp -j REDSOCKS 2>/dev/null
	iptables -t nat -A PREROUTING -i "$interface" -p tcp -j REDSOCKS

	# Accept connections to the redsocks port from the LAN interface
	iptables -D INPUT -i "$interface" -p tcp --dport "$local_port" -j ACCEPT 2>/dev/null
	iptables -A INPUT -i "$interface" -p tcp --dport "$local_port" -j ACCEPT

	/bin/echo " done"
}

iptable_stop() {
	local local_port interface
	config_load redsocks
	config_get local_port connection local_port "1337"
	config_get interface connection interface "br-lan"

	/bin/echo -n "cleaning proxy bypass iptables ..."

	# Safely remove references to REDSOCKS chain instead of flushing general chains
	iptables -t nat -D PREROUTING -i "$interface" -p tcp -j REDSOCKS 2>/dev/null
	iptables -D INPUT -i "$interface" -p tcp --dport "$local_port" -j ACCEPT 2>/dev/null

	# Flush and delete the REDSOCKS chain
	iptables -t nat -F REDSOCKS 2>/dev/null
	iptables -t nat -X REDSOCKS 2>/dev/null

	/bin/echo " done"
}

start_service() {
	generate_config || return 1

	procd_open_instance
	procd_set_param command /usr/sbin/redsocks -c /var/etc/redsocks.conf -p /var/run/redsocks.pid
	procd_set_param respawn
	procd_close_instance

	iptable_start
}

stop_service() {
	iptable_stop
}

service_triggers() {
	procd_add_reload_trigger "redsocks"
}