From b651e49190d6bfdb31ef6e5be9a13f1349cf46cf Mon Sep 17 00:00:00 2001 From: Whale Choi Date: Fri, 18 Sep 2020 20:03:46 +0800 Subject: [PATCH] [v1.0.14] Add USB guest proxy support, fix guest's dns request proxy. --- README.md | 8 +- customize.sh | 7 +- module.prop | 2 +- module_installer.sh | 183 ------------------ v2ray/etc/config.json | 155 --------------- v2ray/etc/config.json.template | 2 +- v2ray/etc/dnscrypt-proxy/dnscrypt-proxy.toml | 2 +- .../example-dnscrypt-proxy.toml | 22 ++- v2ray/etc/dnscrypt-proxy/update-rules.sh | 12 +- v2ray/scripts/dnscrypt-proxy.service | 157 +++------------ v2ray/scripts/v2ray.inotify | 7 + v2ray/scripts/v2ray.tproxy | 11 +- 12 files changed, 74 insertions(+), 494 deletions(-) delete mode 100644 module_installer.sh delete mode 100644 v2ray/etc/config.json mode change 100644 => 100755 v2ray/etc/dnscrypt-proxy/update-rules.sh diff --git a/README.md b/README.md index 9113b1a..6475c9f 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ You can download the release installer zip file and install it via the Magisk Ma `export V2RAY_LOCATION_ASSET=/data/v2ray; v2ray -test -config /data/v2ray/config.json` in android terminal or ssh. -- dnscrypt-proxy config file is store in `/data/v2ray/dnscrypt-proxy/` folder, you can update cn domains list via running the shell script `update-rules.sh` or if you dislike the default rules, you can edit them by yourself. +- dnscrypt-proxy config file is store in `/data/v2ray/dnscrypt-proxy/` folder, you can update cn domains list via running the shell script `update-rules.sh` or if you dislike the default rules, you can edit them by yourself. ( If you want to disable dnscrypt-proxy, just delete the config file `/data/v2ray/dnscrypt-proxy/dnscrypt-proxy.toml` ) - Tips: Please notice that the default configuration has already set inbounds section to cooperate work with transparent proxy script. It is recommended that you only edit the first element of outbounds section to your proxy server and edit file `/data/v2ray/appid.list` to select which App to proxy. @@ -59,11 +59,11 @@ You can download the release installer zip file and install it via the Magisk Ma -#### Share transparent proxy to WiFi guest +#### Share transparent proxy to WiFi guest or USB guest - Transparent proxy is share to WiFi guest by default. -- If you don't want to share proxy to WiFi guest, delete the file `/data/v2ray/softap.list` or empty it. -- For most situation, Android WiFi hotspot interface is `softap0` . If your device is not conform to it , please write down the name of your WiFi hotspot name in `/data/v2ray/softap.list`. ( You can run command `ip addr` to search the name of WiFi hotspot interface ) +- If you don't want to share proxy to WiFi guest or USB guest, delete the file `/data/v2ray/softap.list` or empty it. +- For most situation, Android WiFi hotspot subnet is `192.168.43.0/24`, and USB subnet is `192.168.42.0/24`. If your device is not conform to it , please write down the subnet you want proxy in `/data/v2ray/softap.list`. ( You can run command `ip addr` to search the subnet ) diff --git a/customize.sh b/customize.sh index 3b350b9..44250d5 100644 --- a/customize.sh +++ b/customize.sh @@ -55,7 +55,7 @@ rm "${download_v2ray_zip}" # copy v2ray data and config ui_print "- Copy V2Ray config and data files" [ -f /data/v2ray/softap.list ] || \ -echo "softap0" > /data/v2ray/softap.list +echo "192.168.43.0/24" > /data/v2ray/softap.list [ -f /data/v2ray/resolv.conf ] || \ unzip -j -o "${ZIPFILE}" "v2ray/etc/resolv.conf" -d /data/v2ray >&2 unzip -j -o "${ZIPFILE}" "v2ray/etc/config.json.template" -d /data/v2ray >&2 @@ -85,11 +85,12 @@ echo "id=v2ray" > $MODPATH/module.prop echo "name=V2ray for Android" >> $MODPATH/module.prop echo -n "version=" >> $MODPATH/module.prop echo ${latest_v2ray_version} >> $MODPATH/module.prop -echo "versionCode=20200815" >> $MODPATH/module.prop +echo "versionCode=20200918" >> $MODPATH/module.prop echo "author=chendefine" >> $MODPATH/module.prop echo "description=V2ray core with service scripts for Android" >> $MODPATH/module.prop inet_uid="3003" +net_raw_uid="3004" set_perm_recursive $MODPATH 0 0 0755 0644 set_perm $MODPATH/service.sh 0 0 0755 set_perm $MODPATH/uninstall.sh 0 0 0755 @@ -98,7 +99,7 @@ set_perm $MODPATH/scripts/v2ray.inotify 0 0 0755 set_perm $MODPATH/scripts/v2ray.service 0 0 0755 set_perm $MODPATH/scripts/v2ray.tproxy 0 0 0755 set_perm $MODPATH/scripts/dnscrypt-proxy.service 0 0 0755 -set_perm $MODPATH/system/bin/dnscrypt-proxy 0 0 0755 set_perm $MODPATH/system/bin/v2ray ${inet_uid} ${inet_uid} 0755 set_perm $MODPATH/system/bin/v2ctl ${inet_uid} ${inet_uid} 0755 set_perm /data/v2ray ${inet_uid} ${inet_uid} 0755 +set_perm $MODPATH/system/bin/dnscrypt-proxy ${net_raw_uid} ${net_raw_uid} 0755 \ No newline at end of file diff --git a/module.prop b/module.prop index e8708de..2540c9d 100644 --- a/module.prop +++ b/module.prop @@ -1,6 +1,6 @@ id=v2ray name=V2ray for Android version=latest_version -versionCode=20200815 +versionCode=20200918 author=chendefine description=V2ray core with service scripts for Android diff --git a/module_installer.sh b/module_installer.sh deleted file mode 100644 index f046d33..0000000 --- a/module_installer.sh +++ /dev/null @@ -1,183 +0,0 @@ -#!/sbin/sh - -################# -# Initialization -################# - -umask 022 - -# echo before loading util_functions -ui_print() { echo "$1"; } - -require_new_magisk() { - ui_print "*******************************" - ui_print " Please install Magisk v19.0+! " - ui_print "*******************************" - exit 1 -} - -######################### -# Load util_functions.sh -######################### - -OUTFD=$2 -ZIPFILE=$3 - -mount /data 2>/dev/null - -[ -f /data/adb/magisk/util_functions.sh ] || require_new_magisk -. /data/adb/magisk/util_functions.sh -[ $MAGISK_VER_CODE -lt 19000 ] && require_new_magisk - -if [ $MAGISK_VER_CODE -ge 20400 ]; then - # New Magisk have complete installation logic within util_functions.sh - install_module - exit 0 -fi - -################# -# Legacy Support -################# - -TMPDIR=/dev/tmp -PERSISTDIR=/sbin/.magisk/mirror/persist - -is_legacy_script() { - unzip -l "$ZIPFILE" install.sh | grep -q install.sh - return $? -} - -print_modname() { - ui_print "*******************************" - ui_print " V2Ray for Android " - ui_print "*******************************" -} - -# Override abort as old scripts have some issues -abort() { - ui_print "$1" - $BOOTMODE || recovery_cleanup - [ -n $MODPATH ] && rm -rf $MODPATH - rm -rf $TMPDIR - exit 1 -} - -rm -rf $TMPDIR 2>/dev/null -mkdir -p $TMPDIR - -# Preperation for flashable zips -setup_flashable - -# Mount partitions -mount_partitions - -# Detect version and architecture -api_level_arch_detect - -# Setup busybox and binaries -$BOOTMODE && boot_actions || recovery_actions - -############## -# Preparation -############## - -# Extract prop file -unzip -o "$ZIPFILE" module.prop -d $TMPDIR >&2 -[ ! -f $TMPDIR/module.prop ] && abort "! Unable to extract zip file!" - -$BOOTMODE && MODDIRNAME=modules_update || MODDIRNAME=modules -MODULEROOT=$NVBASE/$MODDIRNAME -MODID=`grep_prop id $TMPDIR/module.prop` -MODPATH=$MODULEROOT/$MODID -MODNAME=`grep_prop name $TMPDIR/module.prop` - -# Create mod paths -rm -rf $MODPATH 2>/dev/null -mkdir -p $MODPATH - -########## -# Install -########## - -if is_legacy_script; then - unzip -oj "$ZIPFILE" module.prop install.sh uninstall.sh 'common/*' -d $TMPDIR >&2 - - # Load install script - . $TMPDIR/install.sh - - # Callbacks - print_modname - on_install - - # Custom uninstaller - [ -f $TMPDIR/uninstall.sh ] && cp -af $TMPDIR/uninstall.sh $MODPATH/uninstall.sh - - # Skip mount - $SKIPMOUNT && touch $MODPATH/skip_mount - - # prop file - $PROPFILE && cp -af $TMPDIR/system.prop $MODPATH/system.prop - - # Module info - cp -af $TMPDIR/module.prop $MODPATH/module.prop - - # post-fs-data scripts - $POSTFSDATA && cp -af $TMPDIR/post-fs-data.sh $MODPATH/post-fs-data.sh - - # service scripts - $LATESTARTSERVICE && cp -af $TMPDIR/service.sh $MODPATH/service.sh - - ui_print "- Setting permissions" - set_permissions -else - print_modname - - unzip -o "$ZIPFILE" customize.sh -d $MODPATH >&2 - - if ! grep -q '^SKIPUNZIP=1$' $MODPATH/customize.sh 2>/dev/null; then - ui_print "- Extracting module files" - unzip -o "$ZIPFILE" -x 'META-INF/*' -d $MODPATH >&2 - - # Default permissions - set_perm_recursive $MODPATH 0 0 0755 0644 - fi - - # Load customization script - [ -f $MODPATH/customize.sh ] && . $MODPATH/customize.sh -fi - -# Handle replace folders -for TARGET in $REPLACE; do - ui_print "- Replace target: $TARGET" - mktouch $MODPATH$TARGET/.replace -done - -if $BOOTMODE; then - # Update info for Magisk Manager - mktouch $NVBASE/modules/$MODID/update - cp -af $MODPATH/module.prop $NVBASE/modules/$MODID/module.prop -fi - -# Copy over custom sepolicy rules -if [ -f $MODPATH/sepolicy.rule -a -e $PERSISTDIR ]; then - ui_print "- Installing custom sepolicy patch" - PERSISTMOD=$PERSISTDIR/magisk/$MODID - mkdir -p $PERSISTMOD - cp -af $MODPATH/sepolicy.rule $PERSISTMOD/sepolicy.rule -fi - -# Remove stuffs that don't belong to modules -rm -rf \ -$MODPATH/system/placeholder $MODPATH/customize.sh \ -$MODPATH/README.md $MODPATH/.git* 2>/dev/null - -############# -# Finalizing -############# - -cd / -$BOOTMODE || recovery_cleanup -rm -rf $TMPDIR - -ui_print "- Done" -exit 0 diff --git a/v2ray/etc/config.json b/v2ray/etc/config.json deleted file mode 100644 index 590b9b6..0000000 --- a/v2ray/etc/config.json +++ /dev/null @@ -1,155 +0,0 @@ -// Config file of V2Ray. This file follows standard JSON format, with comments support. -// Uncomment entries below to satisfy your needs. Also read our manual for more detail at -// https://www.v2ray.com/ -{ - "log": { - // By default, V2Ray writes access log to stdout. - // "access": "/path/to/access/log/file", - "access": "none", - - // By default, V2Ray write error log to stdout. - // "error": "/path/to/error/log/file", - "error": "/data/v2ray/run/error.log", - - // Log level, one of "debug", "info", "warning", "error", "none" - "loglevel": "warning" - }, - // List of inbound proxy configurations. - "inbounds": [{ - // Port to listen on. You may need root access if the value is less than 1024. - "port": 65535, - - // IP address to listen on. Change to "0.0.0.0" to listen on all network interfaces. - "listen": "0.0.0.0", - - // Tag of the inbound proxy. May be used for routing. - "tag": "proxy-inbound", - - // Protocol name of inbound proxy. - "protocol": "dokodemo-door", - - // Settings of the protocol. Varies based on protocol. - "settings": { - // Disable timeout setting for keeping persistent connection. Such as FCM. - // "timeout": 10, - "network": "tcp,udp", - "followRedirect": true - }, - - // If you wanna bypass BT streams, you should enable it. - "sniffing": { - "enabled": false - // , - // "destOverride": ["http", "tls"] - } - }], - // List of outbound proxy configurations. - "outbounds": [{ - // Replace your proxy protocol in this section, like: vmess or shadowsocks - "protocol": "freedom", - - // Settings of the protocol. Varies based on protocol. - "settings": {}, - - // Tag of the outbound. May be used for routing. - "tag": "proxy" - },{ - // Protocol name of the outbound proxy. - "protocol": "freedom", - - // Settings of the protocol. Varies based on protocol. - "settings": {}, - - // Tag of the outbound. May be used for routing. - "tag": "direct" - },{ - "protocol": "blackhole", - "settings": {}, - "tag": "blocked" - }], - - // Transport is for global transport settings. If you have multiple transports with same settings - // (say mKCP), you may put it here, instead of in each individual inbound/outbounds. - //"transport": {}, - - // Routing controls how traffic from inbounds are sent to outbounds. - "routing": { - "domainStrategy": "AsIs", - "rules":[ - { - // Bypass private IPs. - "type": "field", - "ip": ["geoip:private"], - "outboundTag": "direct" - }, - { - // Bypass all china IPs. - "type": "field", - "ip": ["geoip:cn"], - "outboundTag": "direct" - } - //, - //{ - // Bypass all china sites. - // "type": "field", - // "domain": ["geosite:cn"], - // "outboundTag": "direct" - //}, - //{ - // To bypass all BT streams, you should enable sniffing. - // "type": "field", - // "protocol":["bittorrent"], - // "outboundTag": "direct" - //}, - //{ - // If your network condition not very well, you could bypass dnscrypt-proxy's upstream DNS. - // "type": "field", - // "domain": [ - // "cloudflare-dns.com", - // "doh.opendns.com", - // "dns.google" - // ], - // "outboundTag": "direct" - //}, - //{ - // Blocks major ads. - // "type": "field", - // "domain": ["geosite:category-ads"], - // "outboundTag": "blocked" - //} - ] - }, - - // Policy controls some internal behavior of how V2Ray handles connections. - // It may be on connection level by user levels in 'levels', or global settings in 'system.' - "policy": { - // Connection policys by user levels - "levels": { - "0": { - "uplinkOnly": 0, - "downlinkOnly": 0 - } - }, - "system": { - "statsInboundUplink": false, - "statsInboundDownlink": false - } - }, - - // Stats enables internal stats counter. - // This setting can be used together with Policy and Api. - //"stats":{}, - - // Api enables gRPC APIs for external programs to communicate with V2Ray instance. - //"api": { - //"tag": "api", - //"services": [ - // "HandlerService", - // "LoggerService", - // "StatsService" - //] - //}, - - // You may add other entries to the configuration, but they will not be recognized by V2Ray. - "other": {} -} diff --git a/v2ray/etc/config.json.template b/v2ray/etc/config.json.template index 590b9b6..a9a513c 100644 --- a/v2ray/etc/config.json.template +++ b/v2ray/etc/config.json.template @@ -45,7 +45,7 @@ }], // List of outbound proxy configurations. "outbounds": [{ - // Replace your proxy protocol in this section, like: vmess or shadowsocks + // Replace your proxy protocol in this section, like: VMESS, VLESS or Shadowsocks "protocol": "freedom", // Settings of the protocol. Varies based on protocol. diff --git a/v2ray/etc/dnscrypt-proxy/dnscrypt-proxy.toml b/v2ray/etc/dnscrypt-proxy/dnscrypt-proxy.toml index 8e63be0..4279b87 100644 --- a/v2ray/etc/dnscrypt-proxy/dnscrypt-proxy.toml +++ b/v2ray/etc/dnscrypt-proxy/dnscrypt-proxy.toml @@ -3,7 +3,7 @@ ################################## listen_addresses = ['127.0.0.1:65534'] max_clients = 250 -# user_name = 'nobody' +# user_name = 'net_raw' ipv4_servers = true ipv6_servers = false dnscrypt_servers = false diff --git a/v2ray/etc/dnscrypt-proxy/example-dnscrypt-proxy.toml b/v2ray/etc/dnscrypt-proxy/example-dnscrypt-proxy.toml index 7a36cac..0f79458 100644 --- a/v2ray/etc/dnscrypt-proxy/example-dnscrypt-proxy.toml +++ b/v2ray/etc/dnscrypt-proxy/example-dnscrypt-proxy.toml @@ -117,6 +117,14 @@ timeout = 5000 keepalive = 30 +## Add EDNS-client-subnet information to outgoing queries +## +## Multiple networks can be listed; they will be randomly chosen. +## These networks don't have to match your actual networks. + +# edns_client_subnet = ["0.0.0.0/0", "2001:db8::/32"] + + ## Response for blocked queries. Options are `refused`, `hinfo` (default) or ## an IP response. To give an IP response, use the format `a:,aaaa:`. ## Using the `hinfo` option means that some responses will be lies. @@ -253,7 +261,7 @@ netprobe_address = '9.9.9.9:53' ## encrypted-dns-server can be configured to use this for access control ## in the [access_control] section -# query_meta = ["key1:value1", "key2:value2", "token:MySecretToken"] +# query_meta = ['key1:value1', 'key2:value2', 'token:MySecretToken'] ## Automatic log files rotation @@ -386,14 +394,14 @@ cache_neg_max_ttl = 600 ## For each `listen_address` the complete URL to access the server will be: ## `https://` (ex: `https://127.0.0.1/dns-query`) -# path = "/dns-query" +# path = '/dns-query' ## Certificate file and key - Note that the certificate has to be trusted. ## See the documentation (wiki) for more information. -# cert_file = "localhost.pem" -# cert_key_file = "localhost.pem" +# cert_file = 'localhost.pem' +# cert_key_file = 'localhost.pem' @@ -641,7 +649,7 @@ cache_neg_max_ttl = 600 # The list below enables workarounds to make non-relayed usage more reliable # until the servers are fixed. -fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security'] +fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security'] @@ -734,13 +742,13 @@ skip_incompatible = false [dns64] ## (Option 1) Static prefix(es) as Pref64::/n CIDRs. -# prefix = ["64:ff9b::/96"] +# prefix = ['64:ff9b::/96'] ## (Option 2) DNS64-enabled resolver(s) to discover Pref64::/n CIDRs. ## These resolvers are used to query for Well-Known IPv4-only Name (WKN) "ipv4only.arpa." to discover only. ## Set with your ISP's resolvers in case of custom prefixes (other than Well-Known Prefix 64:ff9b::/96). ## IMPORTANT: Default resolvers listed below support Well-Known Prefix 64:ff9b::/96 only. -# resolver = ["[2606:4700:4700::64]:53", "[2001:4860:4860::64]:53"] +# resolver = ['[2606:4700:4700::64]:53', '[2001:4860:4860::64]:53'] diff --git a/v2ray/etc/dnscrypt-proxy/update-rules.sh b/v2ray/etc/dnscrypt-proxy/update-rules.sh old mode 100644 new mode 100755 index f846b10..e93940f --- a/v2ray/etc/dnscrypt-proxy/update-rules.sh +++ b/v2ray/etc/dnscrypt-proxy/update-rules.sh @@ -1,18 +1,20 @@ -wget -N https://github.com/felixonmars/dnsmasq-china-list/raw/master/accelerated-domains.china.conf +rm accelerated-domains.china.conf bogus-nxdomain.china.conf toblock-without-shorturl-optimized.lst dnscrypt-proxy-cloaking.txt example-dnscrypt-proxy.toml + +wget https://github.com/felixonmars/dnsmasq-china-list/raw/master/accelerated-domains.china.conf echo '# Converted from https://github.com/felixonmars/dnsmasq-china-list/blob/master/accelerated-domains.china.conf' >dnscrypt-forwarding-rules.txt echo '# https://github.com/felixonmars/dnsmasq-china-list' >>dnscrypt-forwarding-rules.txt echo '# Thanks to all contributors.' >>dnscrypt-forwarding-rules.txt echo '' >>dnscrypt-forwarding-rules.txt cat accelerated-domains.china.conf | grep -v '^#server' | sed -e 's|/| |g' -e 's|^server= ||' | sed 's/114.114.114.114/114.114.114.114,114.114.115.115/g' >>dnscrypt-forwarding-rules.txt -wget -N https://github.com/felixonmars/dnsmasq-china-list/raw/master/bogus-nxdomain.china.conf +wget https://github.com/felixonmars/dnsmasq-china-list/raw/master/bogus-nxdomain.china.conf echo '# Converted from https://github.com/felixonmars/dnsmasq-china-list/blob/master/bogus-nxdomain.china.conf' >dnscrypt-blacklist-ips.txt echo '# https://github.com/felixonmars/dnsmasq-china-list' >>dnscrypt-blacklist-ips.txt echo '# Thanks to all contributors.' >>dnscrypt-blacklist-ips.txt echo '' >>dnscrypt-blacklist-ips.txt cat bogus-nxdomain.china.conf | grep -v '^#bogus' | grep bogus-nxdomain | sed 's/bogus-nxdomain=//g' >>dnscrypt-blacklist-ips.txt -#wget -N https://github.com/missdeer/blocklist/raw/master/toblock-without-shorturl-optimized.lst +#wget https://github.com/missdeer/blocklist/raw/master/toblock-without-shorturl-optimized.lst #echo '# Converted from https://github.com/missdeer/blocklist/blob/master/toblock-without-shorturl-optimized.lst' >dnscrypt-blacklist-domains.txt #echo '# https://github.com/missdeer/blocklist' >>dnscrypt-blacklist-domains.txt #echo '# Thanks to all contributors.' >>dnscrypt-blacklist-domains.txt @@ -23,7 +25,7 @@ cat bogus-nxdomain.china.conf | grep -v '^#bogus' | grep bogus-nxdomain | sed 's #echo 'ads[0-9]*' >>dnscrypt-blacklist-domains.txt #cat toblock-without-shorturl-optimized.lst | grep -v '^#' | tr -s '\n' | tr A-Z a-z | grep -v '^ad\.' | grep -v -e '^ad[0-9]' | grep -v '^ads\.' | grep -v -e '^ads[0-9]' | rev | sort -n | uniq | rev >>dnscrypt-blacklist-domains.txt -#wget -N https://github.com/googlehosts/hosts/raw/master/hosts-files/dnscrypt-proxy-cloaking.txt +#wget https://github.com/googlehosts/hosts/raw/master/hosts-files/dnscrypt-proxy-cloaking.txt #echo '# Converted from https://github.com/googlehosts/hosts/blob/master/hosts-files/dnscrypt-proxy-cloaking.txt' >dnscrypt-cloaking-rules.txt #echo '# https://github.com/googlehosts/hosts' >>dnscrypt-cloaking-rules.txt #echo '# Thanks to all contributors.' >>dnscrypt-cloaking-rules.txt @@ -32,4 +34,4 @@ cat bogus-nxdomain.china.conf | grep -v '^#bogus' | grep bogus-nxdomain | sed 's rm accelerated-domains.china.conf bogus-nxdomain.china.conf toblock-without-shorturl-optimized.lst dnscrypt-proxy-cloaking.txt -wget -N https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-proxy/example-dnscrypt-proxy.toml +wget https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-proxy/example-dnscrypt-proxy.toml diff --git a/v2ray/scripts/dnscrypt-proxy.service b/v2ray/scripts/dnscrypt-proxy.service index 8c29efc..173ddfe 100644 --- a/v2ray/scripts/dnscrypt-proxy.service +++ b/v2ray/scripts/dnscrypt-proxy.service @@ -1,5 +1,6 @@ #!/system/bin/sh +dnsmasq_uid="1052" bin_name="dnscrypt-proxy" bin_file="/system/bin/${bin_name}" run_path="/data/v2ray/run" @@ -7,14 +8,11 @@ pid_file="${run_path}/dnscrypt-proxy.pid" conf_path="/data/v2ray/dnscrypt-proxy" conf_file="${conf_path}/dnscrypt-proxy.toml" bin_opts="-config ${conf_file}" -appid_file="/data/v2ray/appid.list" -appid_list=() -softap_file="/data/v2ray/softap.list" -softap_list=() iptables_wait="iptables" v2ray_share=false -proxy_for_app=false -inet_uid="3003" +softap_file="/data/v2ray/softap.list" +appid_list=() +proxy_for_guest=false host_ip="127.0.0.1" dns_port="65534" proxy_port="65535" @@ -39,15 +37,6 @@ find_netstat_path() { return 1 } -iptables_chain_exist() { - local chain_list="$1" - local target_chain="$2" - if `echo "${chain_list}" | grep -q ":${target_chain} "` ; then - return 0 - fi - return 1 -} - probe_dnscrypt-proxy_alive() { [ -f ${pid_file} ] && cmd_file="/proc/`cat ${pid_file}`/cmdline" || return 1 [ -f ${cmd_file} ] && grep -q "dnscrypt-proxy" ${cmd_file} && return 0 || return 1 @@ -64,102 +53,26 @@ probe_v2ray_listen() { fi } -probe_v2ray_target() { +check_proxy_guest() { ## add eof to appid and softap file - echo "" >> "${appid_file}" - ## trim empty line in appid and softap file - sed -i '/^$/d' "${appid_file}" - ## probe proxy app - if [ -f ${appid_file} ] ; then - ## check appid_file is white-list or black-list - if head -1 "${appid_file}" | grep -q 'bypass' ; then - app_proxy_mode="skip" - else - app_proxy_mode="pick" - fi - ## filter appid number - while read appid_line ; do - appid_text=(`echo ${appid_line}`) - for appid_word in ${appid_text[*]} ; do - if echo "${appid_word}" | grep -q '#' ; then - break - elif [ "${appid_word}" -ge 0 ] 2>/dev/null ; then - appid_list=(${appid_list[*]} ${appid_word}) - fi - done - done < ${appid_file} - fi + echo "" >> "${softap_file}" + ## trim empty line in softap file + sed -i '/^$/d' "${softap_file}" ## probe proxy wifi interface ${v2ray_share} && [ -f ${softap_file} ] && softap_list=(`cat ${softap_file}`) || unset softap_list - ## check proxy app or not - if ( [ "${app_proxy_mode}" = "skip" ] || ( [ "${app_proxy_mode}" = "pick" ] && [ ${#appid_list[@]} -gt 0 ] ) ) ; then - proxy_for_app=true - fi - ## check enable proxy iptables or not - if ! ( ${proxy_for_app} ) ; then - echo "[Error]: DNS is not proxy for APP." - exit 1 - fi -} - -probe_uid_app_name() { - app_handle="$2" - if [ "$1" == "0" ] ; then - app_name="root" - else - app_name=`grep " $1 " /data/system/packages.list | cut -d ' ' -f 1` - app_name=`echo ${app_name} | sed 's/ / \& /g'` - fi - if [ "${app_name}" != "" ] ; then - echo "[Info]: ${app_handle} ${app_name} APP's DNS request." - else - echo "[Warning]: APP with uid=$1 is not found." - return 1 - fi -} - -proxy_app_dns_iptables() { - ## create iptables proxy chains for app tcp - ${iptables_wait} -t nat -N APP_DNS_PROXY - ## bypass v2ray program - ${iptables_wait} -t nat -A APP_DNS_PROXY -m owner --uid-owner ${inet_uid} -j RETURN - ## white-list mode - if [ "${app_proxy_mode}" = "pick" ] ; then - ## proxy all apps network - if [ "${appid_list[*]}" = "0" ] ; then - echo "[Info]: Proxy all APP's DNS request." - ${iptables_wait} -t nat -A APP_DNS_PROXY -m owner ! --uid-owner ${inet_uid} -j V2RAY_APP_DNS - ## proxy assign app - else - for appid in ${appid_list[@]}; do - probe_uid_app_name ${appid} "Proxy" && \ - ${iptables_wait} -t nat -A APP_DNS_PROXY -m owner --uid-owner ${appid} -j V2RAY_APP_DNS - done - fi - ## black-list mode - elif [ "${app_proxy_mode}" = "skip" ] ; then - for appid in ${appid_list[@]}; do - probe_uid_app_name ${appid} "Ignore" && \ - ${iptables_wait} -t nat -A APP_DNS_PROXY -m owner --uid-owner ${appid} -j RETURN - done - echo "[Info]: Proxy all remaining APP's DNS request." - ${iptables_wait} -t nat -A APP_DNS_PROXY -m owner ! --uid-owner ${inet_uid} -j V2RAY_APP_DNS - fi - ## apply proxy rules to iptables - ${iptables_wait} -t nat -A APP_DNS_PROXY -m owner --uid-owner 0 -j V2RAY_APP_DNS - ${iptables_wait} -t nat -A OUTPUT -p udp --dport 53 -j APP_DNS_PROXY + ## check proxy wifi guest or not + [ ${#softap_list[@]} -gt 0 ] && proxy_for_guest=true } create_proxy_iptables() { - echo "[Info]: Create DNS proxy chains." - ## create iptables proxy chains for dns - ${iptables_wait} -t nat -N V2RAY_APP_DNS - ## build basic iptables proxy chains - ${iptables_wait} -t nat -A V2RAY_APP_DNS -p udp -j DNAT --to-destination ${host_ip}:${dns_port} - if ! iptables_chain_exist "${iptables_chains}" "APP_DNS_PROXY" && ${proxy_for_app} ; then - ## proxy app network - proxy_app_dns_iptables - fi + echo "[Info]: Proxy local system's DNS request." + ${iptables_wait} -t nat -A OUTPUT -p udp -m owner --uid-owner 0 --dport 53 -j DNAT --to-destination ${host_ip}:${dns_port} + ## proxy wifi guest DNS + check_proxy_guest && \ + if ${proxy_for_guest} ; then + echo "[Info]: Proxy dnsmasq's DNS request." + ${iptables_wait} -t nat -A OUTPUT -p udp -m owner --uid-owner ${dnsmasq_uid} --dport 53 -j DNAT --to-destination ${host_ip}:${dns_port} + fi } display_dnscrypt-proxy_pid() { @@ -172,23 +85,10 @@ display_dnscrypt-proxy_pid() { fi } -flush_endpoint_iptables() { - ${iptables_wait} -t nat -F V2RAY_APP_DNS 2>/dev/null -} - -flush_nat_iptables() { - echo "[Info]: Clean nat proxy iptables rules." - local iptables_chains=`iptables-save -t nat | cut -d ' ' -f 1 | tr "\n" " " | grep -o ":[0-9A-Z_]* "` - ${iptables_wait} -t nat -D OUTPUT -p udp --dport 53 -j APP_DNS_PROXY 2>/dev/null - if iptables_chain_exist "${iptables_chains}" "APP_DNS_PROXY" ; then - ${iptables_wait} -t nat -F APP_DNS_PROXY - ${iptables_wait} -t nat -X APP_DNS_PROXY - fi - if iptables_chain_exist "${iptables_chains}" "V2RAY_APP_DNS" ; then - ${iptables_wait} -t nat -F V2RAY_APP_DNS - ${iptables_wait} -t nat -X V2RAY_APP_DNS - fi - unset iptables_chains +flush_dns_iptables() { + echo "[Info]: Clean DNS proxy iptables rules." + ${iptables_wait} -t nat -D OUTPUT -p udp -m owner --uid-owner 0 --dport 53 -j DNAT --to-destination ${host_ip}:${dns_port} 2>/dev/null + ${iptables_wait} -t nat -D OUTPUT -p udp -m owner --uid-owner ${dnsmasq_uid} --dport 53 -j DNAT --to-destination ${host_ip}:${dns_port} 2>/dev/null } start_dnscrypt-proxy() { @@ -198,6 +98,10 @@ start_dnscrypt-proxy() { elif probe_v2ray_listen ; then echo "[Info]: Starting ${bin_name} service." mkdir -p ${run_path} + echo -n "" > ${conf_path}/dnscrypt-nxdomain.log + echo -n "" > ${conf_path}/dnscrypt-query.log + chown -R net_raw:net_raw ${conf_path} + chown net_raw:net_raw ${bin_file} chmod 6755 ${bin_file} nohup ${bin_file} ${bin_opts} & sleep 1 @@ -231,15 +135,10 @@ suit_iptables_version case "$1" in enable) - if start_dnscrypt-proxy ; then - flush_endpoint_iptables - probe_v2ray_target - sleep 2 - create_proxy_iptables - fi + start_dnscrypt-proxy && create_proxy_iptables ;; disable) - flush_nat_iptables + flush_dns_iptables stop_dnscrypt-proxy ;; status) diff --git a/v2ray/scripts/v2ray.inotify b/v2ray/scripts/v2ray.inotify index 4062fef..f582d3f 100644 --- a/v2ray/scripts/v2ray.inotify +++ b/v2ray/scripts/v2ray.inotify @@ -17,6 +17,13 @@ start_v2ray() { if [ -f /data/v2ray/appid.list ] || [ -f /data/v2ray/softap.list ] ; then ${tproxy} enable [ -f "${dnscrypt_conf}" ] && ${dns_proxy_service} enable + settings put global airplane_mode_on 1 + sleep 1 + am broadcast -a android.intent.action.AIRPLANE_MODE + sleep 1 + settings put global airplane_mode_on 0 + sleep 1 + am broadcast -a android.intent.action.AIRPLANE_MODE fi } diff --git a/v2ray/scripts/v2ray.tproxy b/v2ray/scripts/v2ray.tproxy index 0990fc1..26d3bf9 100644 --- a/v2ray/scripts/v2ray.tproxy +++ b/v2ray/scripts/v2ray.tproxy @@ -2,6 +2,7 @@ route_id="1130" inet_uid="3003" +net_raw_uid="3004" route_name="v2ray" proxy_port="65535" proxy_mark="0x20151130" @@ -15,7 +16,7 @@ softap_list=() v2ray_share=false proxy_for_app=false proxy_for_guest=false -intranet=(0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4) +intranet=(0.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 224.0.0.0/4 240.0.0.0/4) suit_iptables_version() { iptables_version=`iptables -V | grep -o "v1\.[0-9]"` @@ -163,6 +164,7 @@ proxy_app_tcp_iptables() { probe_uid_app_name ${appid} "Proxy" && \ ${iptables_wait} -t nat -A APP_TCP_PROXY -m owner --uid-owner ${appid} -j V2RAY done + ${iptables_wait} -t nat -A APP_TCP_PROXY -m owner --uid-owner ${net_raw_uid} -j V2RAY fi ## black-list mode elif [ "${app_proxy_mode}" = "skip" ] ; then @@ -174,7 +176,6 @@ proxy_app_tcp_iptables() { ${iptables_wait} -t nat -A APP_TCP_PROXY -m owner ! --uid-owner ${inet_uid} -j V2RAY fi ## apply proxy rules to iptables - ${iptables_wait} -t nat -A APP_TCP_PROXY -m owner --uid-owner 0 -j V2RAY ${iptables_wait} -t nat -A OUTPUT -p tcp -j APP_TCP_PROXY } @@ -183,8 +184,8 @@ proxy_guest_tcp_iptables() { ${iptables_wait} -t nat -N GUEST_TCP_PROXY ## proxy assign softap for softap in ${softap_list[@]}; do - echo "[Info]: Proxy ${softap} WiFi guest's TCP network." - ${iptables_wait} -t nat -A GUEST_TCP_PROXY -i ${softap} -j V2RAY + echo "[Info]: Proxy ${softap} guest's TCP network." + ${iptables_wait} -t nat -A GUEST_TCP_PROXY -s ${softap} -j V2RAY done ${iptables_wait} -t nat -A PREROUTING -p tcp -j GUEST_TCP_PROXY } @@ -218,7 +219,7 @@ filter_proxy_iptables() { ${iptables_wait} -t filter -A PROTECT_V2RAY -i lo -j RETURN ## permit assign softap for softap in ${softap_list[@]}; do - ${iptables_wait} -t filter -A PROTECT_V2RAY -i ${softap} -j RETURN + ${iptables_wait} -t filter -A PROTECT_V2RAY -s ${softap} -j RETURN done ## deny all other visit ${iptables_wait} -t filter -A PROTECT_V2RAY -p tcp --dport ${proxy_port} -j DROP