feat: nftables support via ucode

Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-xray
-PKG_VERSION:=1.11.0
+PKG_VERSION:=1.12.0
 PKG_RELEASE:=1
 
 PKG_LICENSE:=MPLv2
@@ -15,7 +15,7 @@ define Package/$(PKG_NAME)
 	SECTION:=Custom
 	CATEGORY:=Extra packages
 	TITLE:=LuCI Support for Xray
-	DEPENDS:=+luci-base +xray-core +dnsmasq +ipset +firewall +iptables +iptables-mod-tproxy +ca-bundle
+	DEPENDS:=+luci-base +xray-core +dnsmasq +ca-bundle +PACKAGE_firewall4:kmod-nft-tproxy +PACKAGE_firewall3:ipset +PACKAGE_firewall3:iptables +PACKAGE_firewall3:iptables-mod-tproxy
 	PKGARCH:=all
 endef
 
@@ -88,7 +88,6 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_DATA) ./root/etc/config/xray $(1)/tmp/xray.conf
 	$(INSTALL_DIR) $(1)/etc/luci-uploads/xray
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
-	$(INSTALL_BIN) ./root/etc/hotplug.d/iface/01-transparent-proxy-ipset $(1)/etc/hotplug.d/iface/01-transparent-proxy-ipset
 	$(INSTALL_DIR) $(1)/etc/ssl/certs
 ifdef CONFIG_PACKAGE_XRAY_INCLUDE_CLOUDFLARE_ORIGIN_ROOT_CA
 	$(INSTALL_DATA) ./root/etc/ssl/certs/origin_ca_ecc_root.pem $(1)/etc/ssl/certs/origin_ca_ecc_root.pem
@@ -114,10 +113,21 @@ endif
 ifdef CONFIG_PACKAGE_XRAY_RLIMIT_DATA_LARGE
 	$(INSTALL_DATA) ./root/usr/share/xray/rlimit_data_large $(1)/usr/share/xray/rlimit_data
 endif
+ifdef CONFIG_PACKAGE_firewall
+	$(INSTALL_BIN) ./root/etc/hotplug.d/iface/01-transparent-proxy-ipset.fw3 $(1)/etc/hotplug.d/iface/01-transparent-proxy-ipset
 	$(INSTALL_BIN) ./root/usr/share/xray/gen_ipset_rules.lua $(1)/usr/share/xray/gen_ipset_rules.lua
 	$(INSTALL_BIN) ./root/usr/share/xray/gen_ipset_rules_extra_normal.lua $(1)/usr/share/xray/gen_ipset_rules_extra.lua
-	$(INSTALL_BIN) ./root/usr/share/xray/gen_config.lua $(1)/usr/share/xray/gen_config.lua
 	$(INSTALL_BIN) ./root/usr/share/xray/firewall_include.lua $(1)/usr/share/xray/firewall_include.lua
+	$(INSTALL_DATA) ./root/usr/share/xray/init.fw3 $(1)/usr/share/xray/init.firewall
+endif
+ifdef CONFIG_PACKAGE_firewall4
+	$(INSTALL_BIN) ./root/etc/hotplug.d/iface/01-transparent-proxy-ipset.fw4 $(1)/etc/hotplug.d/iface/01-transparent-proxy-ipset
+	$(INSTALL_DIR) $(1)/etc/nftables.d
+	$(INSTALL_DATA) ./root/etc/nftables.d/99-xray.nft $(1)/etc/nftables.d/99-xray.nft
+	$(INSTALL_BIN) ./root/usr/share/xray/firewall_include.uc $(1)/usr/share/xray/firewall_include.uc
+	$(INSTALL_DATA) ./root/usr/share/xray/init.fw4 $(1)/usr/share/xray/init.firewall
+endif
+	$(INSTALL_BIN) ./root/usr/share/xray/gen_config.lua $(1)/usr/share/xray/gen_config.lua
 	$(INSTALL_DIR) $(1)/usr/libexec/rpcd
 	$(INSTALL_BIN) ./root/usr/libexec/rpcd/xray $(1)/usr/libexec/rpcd/xray
 endef

README.md

@@ -6,6 +6,10 @@ Focus on making the most of Xray (HTTP/HTTPS/Socks/TProxy inbounds, multiple pro
 
 ## Warnings
 
+* Support for nftables / firewall4 is **experimental** and
+    * only works with OpenWrt 22.03 versions or master branch with firewall4 as the only firewall implementation
+    * may **NOT** be as stable as the old implementation using iptables and fw3 due to the lack of hooking facilities in fw4. However it should be good enough for daily use so if you encounter problems please report.
+    * currently only tested with a proper buildroot environment. Building ipk with OpenWrt SDK is **NOT** tested and is **NOT** likely to work right now. If you are building ipks yourself, use the proper version of buildroot toolchain which matches the firewall implementation (fw3 or fw4) you are using.
 * There will be a series of **BREAKING CHANGES** in the following months due to some major refactor of DNS module. Please read changelog carefully to know about breaking changes and always backup your configuration files before updating.
 * If you see `WARNING: at least one of asset files (geoip.dat, geosite.dat) is not found under /usr/share/xray. Xray may not work properly` and don't know what to do:
     * try `opkg update && opkg install xray-geodata` (at least OpenWrt 21.02 releases)
@@ -31,6 +35,8 @@ Focus on making the most of Xray (HTTP/HTTPS/Socks/TProxy inbounds, multiple pro
 * 2022-02-20 fix: return a discarded address instead of nxdomain to let dnsmasq cache these queries
 * 2022-03-25 feat: remove web and add metrics configurations (recommended to use with [metrics support](https://github.com/XTLS/Xray-core/pull/1000))
 * 2022-04-24 feat: metrics is now out of optional features; add basic ubus wrapper for xray apis
+* 2022-05-13 feat: shadowsocks-2022 protocols support
+* 2022-06-04 feat: nftables support (experimental)
 
 ## Changelog 2021
 

root/etc/hotplug.d/iface/01-transparent-proxy-ipset.fw4

@@ -0,0 +1,12 @@
+#!/bin/sh
+DEFAULT_GATEWAY=$(ip route get 1.1.1.1 | grep -Eoe "src (\d+.\d+.\d+.\d+)" | awk '{print $NF}')
+if [ -n "$DEFAULT_GATEWAY" ] ; then
+    logger -st transparent-proxy-ipset[$$] -p6 "default gateway available at $DEFAULT_GATEWAY"
+    nft -f - <<-EOF
+		add set inet fw4 tp_spec_def_gw { type ipv4_addr; }
+		flush set inet fw4 tp_spec_def_gw
+		add element inet fw4 tp_spec_def_gw { $DEFAULT_GATEWAY }
+	EOF
+else
+    logger -st transparent-proxy-ipset[$$] -p6 "default gateway not available, please wait for interface ready"
+fi

root/etc/init.d/xray

@@ -6,7 +6,8 @@ USE_PROCD=1
 NAME=xray
 
 GENERATE_CONF="/usr/share/xray/gen_config.lua"
-FIREWALL_INCLUDE="/usr/share/xray/firewall_include.lua"
+
+source /usr/share/xray/init.firewall
 
 uci_get_by_type() {
     local ret=$(uci get ${NAME}.@$1[0].$2 2> /dev/null)
@@ -63,7 +64,6 @@ start_xray() {
 }
 
 gen_config_file() {
-    mkdir -p /var/etc/xray
     rm -f /var/etc/xray/*
     if [ -s /usr/share/xray/infinite_retry ] ; then
         while [ ! -s /var/etc/xray/config.json ] ; do
@@ -78,32 +78,6 @@ gen_config_file() {
     [ ! "${#custom_config}" == "0" ] && echo ${custom_config} > /var/etc/xray/config_custom.json
 }
 
-setup_firewall() {
-    logger -st xray[$$] -p4 "Setting ipset rules..."
-    lua /usr/share/xray/gen_ipset_rules.lua | ipset -! restore
-    /etc/hotplug.d/iface/01-transparent-proxy-ipset
-
-    logger -st xray[$$] -p4 "Generating firewall rules..."
-    /usr/bin/lua ${FIREWALL_INCLUDE} enable > $(uci get firewall.xray.path)
-
-    logger -st xray[$$] -p4 "Triggering firewall restart..."
-    /etc/init.d/firewall restart > /dev/null 2>&1
-}
-
-flush_firewall() {
-    logger -st xray[$$] -p4 "Flushing firewall rules..."
-    /usr/bin/lua ${FIREWALL_INCLUDE} flush > $(uci get firewall.xray.path)
-
-    logger -st xray[$$] -p4 "Triggering firewall restart..."
-    /etc/init.d/firewall restart > /dev/null 2>&1
-
-    logger -st xray[$$] -p4 "Flushing ipset rules..."
-    for setname in $(ipset -n list | grep "tp_spec"); do
-        ipset -! destroy $setname
-    done
-    /etc/hotplug.d/iface/01-transparent-proxy-ipset
-}
-
 setup_dnsmasq() {
     local dns_port=$(uci_get_by_type general dns_port)
     local dns_count=$(uci_get_by_type general dns_count 0)
@@ -140,7 +114,7 @@ flush_when_disable() {
 
 start_service() {
     config_load $NAME
-    mkdir -p /var/run /var/etc
+    mkdir -p /var/run /var/etc/xray
     local xray_bin=$(uci_get_by_type general xray_bin)
     command -v ${xray_bin} > /dev/null 2>&1 || return 1
     gen_config_file

root/etc/nftables.d/99-xray.nft

@@ -0,0 +1 @@
+include "/var/etc/xray/*.nft"

root/usr/share/xray/firewall_include.uc

@@ -0,0 +1,109 @@
+#!/usr/bin/utpl
+{%
+    const uci = require("uci");
+    const cursor = uci.cursor();
+    cursor.load("xray");
+    const config = cursor.get_all("xray");
+    const general = config[filter(keys(config), k => config[k][".type"] == "general")[0]];
+    const tp_spec_src_fw = map(filter(keys(config), k => config[k][".type"] == "lan_hosts" && config[k].bypassed == "0"), k => config[k].macaddr) || [];
+    const tp_spec_src_bp = map(filter(keys(config), k => config[k][".type"] == "lan_hosts" && config[k].bypassed == "1"), k => config[k].macaddr) || [];
+    let wan_bp_ips = general.wan_bp_ips || [];
+    let wan_fw_ips = general.wan_fw_ips || [];
+    push(wan_bp_ips, split(general.fast_dns, ":")[0]);
+    push(wan_fw_ips, split(general.secure_dns, ":")[0]);
+%}
+    set tp_spec_src_ac {
+        type ether_addr
+        size 65536
+    }
+
+    set tp_spec_src_bp {
+        type ether_addr
+        size 65536
+{% if (length(tp_spec_src_bp) > 0): %}
+        elements = { {{ join(", ", tp_spec_src_bp) }} }
+{% endif %}
+    }
+
+    set tp_spec_src_fw {
+        type ether_addr
+        size 65536
+{% if (length(tp_spec_src_fw) > 0): %}
+        elements = { {{ join(", ", tp_spec_src_fw) }} }
+{% endif %}
+    }
+
+    set tp_spec_dst_sp {
+        type ipv4_addr
+        size 65536
+        flags interval
+        elements = { 0.0.0.0/8, 10.0.0.0/8,
+                 100.64.0.0/10, 127.0.0.0/8,
+                 169.254.0.0/16, 172.16.0.0/12,
+                 192.0.0.0/24, 192.31.196.0/24,
+                 192.52.193.0/24, 192.88.99.0/24,
+                 192.168.0.0/16, 192.175.48.0/24,
+                 224.0.0.0-255.255.255.255 }
+    }
+
+    set tp_spec_dst_bp {
+        type ipv4_addr
+        size 65536
+        flags interval
+        elements = { {{ join(", ", wan_bp_ips)}} }
+    }
+
+    set tp_spec_dst_fw {
+        type ipv4_addr
+        size 65536
+        flags interval
+        elements = { {{ join(", ", wan_fw_ips)}} }
+    }
+
+    set tp_spec_def_gw {
+        type ipv4_addr
+        size 65536
+        flags interval
+    }
+
+    chain xray_prerouting {
+        type filter hook prerouting priority filter; policy accept;
+        meta mark 0x000000fc jump tp_spec_wan_ac
+        iifname "{{ general.lan_ifaces }}" jump tp_spec_lan_dg
+    }
+
+    chain xray_output {
+        type route hook output priority filter; policy accept;
+        jump tp_spec_wan_dg
+    }
+
+    chain tp_spec_lan_ac {
+        ether saddr @tp_spec_src_bp return
+        ether saddr @tp_spec_src_fw jump tp_spec_wan_fw
+        ether saddr @tp_spec_src_ac jump tp_spec_wan_ac
+        jump tp_spec_wan_ac
+    }
+
+    chain tp_spec_lan_dg {
+        ip daddr @tp_spec_dst_sp return
+        meta l4proto { tcp, udp } jump tp_spec_lan_ac
+    }
+
+    chain tp_spec_wan_ac {
+        ip daddr @tp_spec_dst_fw jump tp_spec_wan_fw
+        ip daddr @tp_spec_dst_bp return
+        jump tp_spec_wan_fw
+    }
+
+    chain tp_spec_wan_dg {
+        ip daddr @tp_spec_dst_sp return
+        ip daddr @tp_spec_dst_bp return
+        ip daddr @tp_spec_def_gw return
+        meta mark {{ sprintf("0x%08x", general.mark) }} return
+        meta l4proto { tcp, udp } meta mark set 0x000000fc
+    }
+
+    chain tp_spec_wan_fw {
+        meta l4proto tcp meta mark set 0x000000fb tproxy ip to 0.0.0.0:{{ general.tproxy_port_tcp }} accept
+        meta l4proto udp meta mark set 0x000000fb tproxy ip to 0.0.0.0:{{ general.tproxy_port_udp }} accept
+    }

root/usr/share/xray/init.fw3

@@ -0,0 +1,27 @@
+FIREWALL_INCLUDE="/usr/share/xray/firewall_include.lua"
+
+setup_firewall() {
+    logger -st xray[$$] -p4 "Setting ipset rules..."
+    lua /usr/share/xray/gen_ipset_rules.lua | ipset -! restore
+    /etc/hotplug.d/iface/01-transparent-proxy-ipset
+
+    logger -st xray[$$] -p4 "Generating firewall rules..."
+    /usr/bin/lua ${FIREWALL_INCLUDE} enable > $(uci get firewall.xray.path)
+
+    logger -st xray[$$] -p4 "Triggering firewall restart..."
+    /etc/init.d/firewall restart > /dev/null 2>&1
+}
+
+flush_firewall() {
+    logger -st xray[$$] -p4 "Flushing firewall rules..."
+    /usr/bin/lua ${FIREWALL_INCLUDE} flush > $(uci get firewall.xray.path)
+
+    logger -st xray[$$] -p4 "Triggering firewall restart..."
+    /etc/init.d/firewall restart > /dev/null 2>&1
+
+    logger -st xray[$$] -p4 "Flushing ipset rules..."
+    for setname in $(ipset -n list | grep "tp_spec"); do
+        ipset -! destroy $setname
+    done
+    /etc/hotplug.d/iface/01-transparent-proxy-ipset
+}

root/usr/share/xray/init.fw4

@@ -0,0 +1,27 @@
+FIREWALL_INCLUDE="/usr/share/xray/firewall_include.uc"
+
+setup_firewall() {
+    ip rule add fwmark 251 lookup 251
+    ip rule add fwmark 252 lookup 252
+    ip route add local default dev lo table 251
+    ip route add local default dev lo table 252
+
+    logger -st xray[$$] -p4 "Generating firewall4 rules..."
+    /usr/bin/utpl ${FIREWALL_INCLUDE} > /var/etc/xray/firewall_include.nft
+
+    logger -st xray[$$] -p4 "Triggering firewall4 restart..."
+    /etc/init.d/firewall restart > /dev/null 2>&1
+}
+
+flush_firewall() {
+    ip rule del fwmark 251 lookup 251
+    ip rule del fwmark 252 lookup 252
+    ip route del local default dev lo table 251
+    ip route del local default dev lo table 252
+
+    logger -st xray[$$] -p4 "Flushing firewall4 rules..."
+    rm  /var/etc/xray/firewall_include.nft
+
+    logger -st xray[$$] -p4 "Triggering firewall4 restart..."
+    /etc/init.d/firewall restart > /dev/null 2>&1
+}