bump version to 2.2.0

This version requires these packages:
 * ip
 * ipset
 * resolveip
 * kmod-ipt-ipset
 * kmod-ipt-tproxy
 * iptables-mod-tproxy
 * libopenssl or libpolarssl

Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=shadowsocks-libev
-PKG_VERSION:=2.1.4
+PKG_VERSION:=2.2.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/shadowsocks/openwrt-shadowsocks/releases/download/v$(PKG_VERSION)
-PKG_MD5SUM:=f772a750580243cfcac4649d7b9171b1
+PKG_MD5SUM:=43431a5f627ddaabeaefeb5972b5cafb
 
 PKG_LICENSE:=GPLv3
 PKG_LICENSE_FILES:=LICENSE
@@ -38,9 +38,9 @@ define Package/shadowsocks-libev/Default
 endef
 
 Package/shadowsocks-libev = $(call Package/shadowsocks-libev/Default,openssl,(OpenSSL),+libopenssl)
-Package/shadowsocks-libev-spec = $(call Package/shadowsocks-libev/Default,openssl,(OpenSSL),+libopenssl +resolveip)
+Package/shadowsocks-libev-spec = $(call Package/shadowsocks-libev/Default,openssl,(OpenSSL),+libopenssl +resolveip +ipset +ip +iptables-mod-tproxy)
 Package/shadowsocks-libev-polarssl = $(call Package/shadowsocks-libev/Default,polarssl,(PolarSSL),+libpolarssl)
-Package/shadowsocks-libev-spec-polarssl = $(call Package/shadowsocks-libev/Default,polarssl,(PolarSSL),+libpolarssl +resolveip)
+Package/shadowsocks-libev-spec-polarssl = $(call Package/shadowsocks-libev/Default,polarssl,(PolarSSL),+libpolarssl +resolveip +ipset +ip +iptables-mod-tproxy)
 
 define Package/shadowsocks-libev/description
 Shadowsocks-libev is a lightweight secured scoks5 proxy for embedded devices and low end boxes.

README.md

@@ -5,7 +5,7 @@ Shadowsocks-libev for OpenWrt
 ---
 
  本项目是 [shadowsocks-libev][1] 在 OpenWrt 上的移植  
- 当前版本: 2.1.4-1  
+ 当前版本: 2.2.0-1  
  [预编译 IPK 下载][2]  
 
 特性
@@ -24,7 +24,7 @@ Shadowsocks-libev for OpenWrt
    > 针对 OpenWrt 的优化版本  
    > 可执行文件 `ss-{redir,rules,tunnel}`  
    > 默认启动:  
-   > `ss-redir` 提供透明代理  
+   > `ss-redir` 提供透明代理, 从 v2.2.0 开始支持 UDP  
    > `ss-rules` 生成代理转发规则  
    > `ss-tunnel` 提供 UDP 转发, 用于 DNS 查询  
 

files/shadowsocks.rule

@@ -16,6 +16,7 @@ usage() {
 		    -w <wan_ips>            wan ip of will be forwarded
 		    -e <extra_options>      extra options for iptables
 		    -o                      apply the rules to the OUTPUT chain
+		    -u                      enable udprelay mode, TPROXY is required
 		    -f                      flush the rules
 EOF
 }
@@ -25,106 +26,110 @@ loger() {
 	logger -st ss-rules[$$] -p$1 $2
 }
 
-ipt="iptables -t nat"
+ipt_n="iptables -t nat"
+ipt_m="iptables -t mangle"
 
 flush_r() {
-	local IPT=$(iptables-save -t nat)
+	local IPT
 
+	IPT=$(iptables-save -t nat)
 	eval $(echo "$IPT" | grep "_SS_SPEC_RULE_" | \
-		sed -e 's/^-A/$ipt -D/' -e 's/$/;/')
+		sed -e 's/^-A/$ipt_n -D/' -e 's/$/;/')
 
 	for chain in $(echo "$IPT" | awk '/^:SS_SPEC/{print $1}'); do
-		$ipt -F ${chain:1} 2>/dev/null && $ipt -X ${chain:1}
+		$ipt_n -F ${chain:1} 2>/dev/null && $ipt_n -X ${chain:1}
 	done
 
+	IPT=$(iptables-save -t mangle)
+	eval $(echo "$IPT" | grep "_SS_SPEC_RULE_" | \
+		sed -e 's/^-A/$ipt_m -D/' -e 's/$/;/')
+
+	for chain in $(echo "$IPT" | awk '/^:SS_SPEC/{print $1}'); do
+		$ipt_m -F ${chain:1} 2>/dev/null && $ipt_m -X ${chain:1}
+	done
+
+	ip rule del fwmark 0x01/0x01 table 100 2>/dev/null
+	ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
+	ipset -X ss_spec_lan_ac 2>/dev/null
 	ipset -X ss_spec_wan_ac 2>/dev/null
 	return 0
 }
 
-iptab_r() {
-	iptables-restore -n <<-EOF
-		*nat
-		:SS_SPEC_WAN_AC - [0:0]
-		$(for ip in $WAN_FW_IP; do
-			echo "-A SS_SPEC_WAN_AC -d $ip -j SS_SPEC_WAN_FW"; done)
-		$(echo -e "$IPLIST" | \
-			sed -e "s/^/-A SS_SPEC_WAN_AC -d /" -e "s/$/ -j RETURN/")
-		-A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
-		COMMIT
-EOF
-	return $?
-}
-
 ipset_r() {
 	ipset -! -R <<-EOF || return 1
 		create ss_spec_wan_ac hash:net
 		$(echo -e "$IPLIST" | sed -e "s/^/add ss_spec_wan_ac /")
 		$(for ip in $WAN_FW_IP; do echo "add ss_spec_wan_ac $ip nomatch"; done)
 EOF
-	$ipt -N SS_SPEC_WAN_AC
-	$ipt -A SS_SPEC_WAN_AC -m set --match-set ss_spec_wan_ac dst -j RETURN
-	$ipt -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
+	$ipt_n -N SS_SPEC_WAN_AC
+	$ipt_n -A SS_SPEC_WAN_AC -m set --match-set ss_spec_wan_ac dst -j RETURN
+	$ipt_n -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
 	return $?
 }
 
 fw_rule() {
-	$ipt -N SS_SPEC_WAN_FW
-	$ipt -A SS_SPEC_WAN_FW -p tcp \
+	$ipt_n -N SS_SPEC_WAN_FW
+	$ipt_n -A SS_SPEC_WAN_FW -p tcp \
 		-j REDIRECT --to-ports $LOCAL_PORT 2>/dev/null || {
 		LOCAL_IP=$(uci get network.lan.ipaddr 2>/dev/null)
 		[ -n "$LOCAL_IP" ] && \
-		$ipt -A SS_SPEC_WAN_FW -p tcp \
+		$ipt_n -A SS_SPEC_WAN_FW -p tcp \
 			-j DNAT --to-destination $LOCAL_IP:$LOCAL_PORT
 	} || {
 		loger 3 "Can't redirect, please check the iptables."
 		exit 1
 	}
-	command -v ipset >/dev/null
 	return $?
 }
 
 ac_rule() {
-	local S1 S2 ROUTECHAIN
+	local TAG ROUTECHAIN
 
-	if [ -z "$LAN_AC_IP" -o "${LAN_AC_IP:0:1}" = "b" ]; then
-		S1=RETURN
-		S2=SS_SPEC_WAN_AC
-	else
+	if [ -n "$LAN_AC_IP" ]; then
 		if [ "${LAN_AC_IP:0:1}" = "w" ]; then
-			S1=SS_SPEC_WAN_AC
-			S2=RETURN
+			TAG="nomatch"
+		else
+			if [ "${LAN_AC_IP:0:1}" != "b" ]; then
+				loger 3 "Bad argument \`-a $LAN_AC_IP\`."
+				return 2
+			fi
 		fi
 	fi
 
-	if [ -z "$S2" ]; then
-		loger 3 "Bad argument \`-a $LAN_AC_IP\`."
-		return 2
-	fi
-
 	ROUTECHAIN=PREROUTING
 	if iptables-save -t nat | grep -q "^:zone_lan_prerouting"; then
 		ROUTECHAIN=zone_lan_prerouting
 	fi
 
-	iptables-restore -n <<-EOF || return 1
-		*nat
-		:SS_SPEC_LAN_AC - [0:0]
-		$(for ip in ${LAN_AC_IP:1}; do
-			echo "-A SS_SPEC_LAN_AC -s $ip -j $S1"; done)
-		-A SS_SPEC_LAN_AC -j $S2
-		COMMIT
+	ipset -! -R <<-EOF || return 1
+		create ss_spec_lan_ac hash:ip
+		$(for ip in ${LAN_AC_IP:1}; do echo "add ss_spec_lan_ac $ip $TAG"; done)
 EOF
-	$ipt -A $ROUTECHAIN -p tcp $EXT_ARGS \
-		-m comment --comment "_SS_SPEC_RULE_" -j SS_SPEC_LAN_AC
+	$ipt_n -A $ROUTECHAIN -p tcp $EXT_ARGS \
+		-m set ! --match-set ss_spec_lan_ac src \
+		-m comment --comment "_SS_SPEC_RULE_" -j SS_SPEC_WAN_AC
 
 	if [ "$OUTPUT" = 1 ]; then
-		$ipt -A OUTPUT -p tcp $EXT_ARGS \
+		$ipt_n -A OUTPUT -p tcp $EXT_ARGS \
 			-m comment --comment "_SS_SPEC_RULE_" -j SS_SPEC_WAN_AC
 	fi
 	return $?
 }
 
-while getopts ":s:l:c:i:e:a:b:w:of" arg; do
+tp_rule() {
+	[ "$TPROXY" = 1 ] || return 0
+	ip rule add fwmark 0x01/0x01 table 100
+	ip route add local 0.0.0.0/0 dev lo table 100
+	$ipt_m -N SS_SPEC_TPROXY
+	$ipt_m -A SS_SPEC_TPROXY -p udp -m set ! --match-set ss_spec_wan_ac dst \
+		-j TPROXY --on-port $LOCAL_PORT --tproxy-mark 0x01/0x01
+	$ipt_m -A PREROUTING -p udp $EXT_ARGS \
+		-m set ! --match-set ss_spec_lan_ac src \
+		-m comment --comment "_SS_SPEC_RULE_" -j SS_SPEC_TPROXY
+	return $?
+}
+
+while getopts ":s:l:c:i:e:a:b:w:ouf" arg; do
 	case $arg in
 		s)
 			SERVER=$OPTARG
@@ -153,6 +158,9 @@ while getopts ":s:l:c:i:e:a:b:w:of" arg; do
 		o)
 			OUTPUT=1
 			;;
+		u)
+			TPROXY=1
+			;;
 		f)
 			flush_r
 			exit 0
@@ -209,6 +217,6 @@ IPLIST=$(cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
 EOF
 )
 
-flush_r && fw_rule && ipset_r || iptab_r && ac_rule
+flush_r && fw_rule && ipset_r && ac_rule && tp_rule
 
 exit $?

files/shadowsocks.spec

@@ -21,6 +21,7 @@ get_config() {
 	config_get timeout $1 timeout
 	config_get encrypt_method $1 encrypt_method
 	config_get ignore_list $1 ignore_list
+	config_get udp_relay $1 udp_relay
 	config_get_bool tunnel_enable $1 tunnel_enable
 	config_get tunnel_port $1 tunnel_port
 	config_get tunnel_forward $1 tunnel_forward
@@ -30,6 +31,7 @@ get_config() {
 	config_get wan_fw_ip $1 wan_fw_ip
 	config_get ipt_ext $1 ipt_ext
 	: ${timeout:=60}
+	: ${udp_relay:=1}
 	: ${local:=0.0.0.0}
 	: ${local_port:=1080}
 	: ${tunnel_port:=5300}
@@ -55,14 +57,14 @@ start_rules() {
 		-b "$wan_bp_ip" \
 		-w "$wan_fw_ip" \
 		-e "$ipt_ext" \
-		-o
+		-o $udp
 	return $?
 }
 
 start_redir() {
 	service_start /usr/bin/ss-redir \
 		-c "$CONFIG_FILE" \
-		-b "$local"
+		-b "$local" $udp
 	return $?
 }
 
@@ -80,6 +82,7 @@ rules() {
 	config_load shadowsocks
 	config_foreach get_config shadowsocks
 	[ "$enable" = 1 ] || exit 0
+	[ "$udp_relay" = 1 ] && udp="-u"
 	mkdir -p $(dirname $CONFIG_FILE)
 
 	if [ "$use_conf_file" = 1 ]; then