gfwleak/tango-tsg-container
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tfe 适配 container

Browse Source
This commit is contained in:
luwenpeng
2021-03-12 17:22:38 +08:00
parent c6a966db2f
commit 9a3ac3e15a
11 changed files with 660 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
config/tfe/doh/doh.conf Normal file
View File

@@ -0,0 +1,13 @@
[doh]
enable=0
[maat]
table_appid=TSG_OBJ_APP_ID
table_addr=TSG_SECURITY_ADDR
table_qname=TSG_FIELD_DOH_QNAME
table_host=TSG_FIELD_DOH_HOST
[kafka]
ENTRANCE_ID=0
# if enable "en_sendlog", the iterm "tfe.conf [kafka] enable" must set 1
en_sendlog=1

92
config/tfe/pangu/pangu_pxy.conf Normal file
View File

@@ -0,0 +1,92 @@
[debug]
enable_plugin=1
[log]
entrance_id=0
# default 1, if enable "en_sendlog", the iterm "tfe.conf [kafka] enable" must set 1
en_sendlog=0
#Addresses of minio. Format is defined by WiredLB.
minio_ip_list=192.168.44.10;
minio_listen_port=9090
#Maximum number of connections opened by per host.
#MAX_CONNECTION_PER_HOST=1
#Maximum number of requests in a pipeline.
#MAX_CNNT_PIPELINE_NUM=20
#Maximum parellel sessions(http and redis) is allowed to open.
#MAX_CURL_SESSION_NUM=100
#Maximum time the request is allowed to take(seconds).
#MAX_CURL_TRANSFER_TIMEOUT_S=0
#Bucket name in minio.
cache_bucket_name=proxybucket
#Maximum size of memory used by tango_cache_client. Upload will fail if the current size of memory used exceeds this value.
max_used_memroy_size_mb=5120
#Default TTL of objects, i.e. the time after which the object will expire(minumun 60s, i.e. 1 minute).
cache_default_ttl_second=3600
#Whether to hash the object key before cache actions. GET/PUT may be faster if you open it.
cache_object_key_hash_switch=1
#Store way: 0-MINIO; 1-META in REDIS, object in minio; 2-META and small object in Redis, large object in minio;
cache_store_object_way=0
#If CACHE_STORE_OBJECT_WAY is 2 and the size of a object is not bigger than this value, object will be stored in redis.
redis_cache_object_size=1024000
#If CACHE_STORE_OBJECT_WAY is not 0, we will use redis to store meta and object.
redis_cluster_addrs=192.168.10.62-63;
#Configs of WiredLB for Minios load balancer.
wiredlb_override=1
wiredlb_topic=MinioFileLog
wiredlb_datacenter=k18consul-tse
wiredlb_health_port=8560
wiredlb_group=FileLog
log_fsstat_appname=tango_log_file
log_fsstat_filepath=./tango_log_file.fs
log_fsstat_interval=10
log_fsstat_trig=1
log_fsstat_dst_ip=10.4.20.202
log_fsstat_dst_port=8125
[ratelimit]
enable=0
token_name=ratelimit
redis_server=192.168.44.72
redis_port=7002
redis_db_index=6
[tango_cache]
enable_cache=0
min_cache_obj_size=512
#minio ip, as wiredlb required
minio_ip_list=192.168.10.61-64;
minio_listen_port=9000
#max_connection_per_host=1
max_cnnt_pipeline_num=20
#max_curl_session_num=100
cache_bucket_name=proxybucket
max_used_memory_size_mb=10240
cache_default_ttl_second=3600
cache_object_key_hash_switch=1
#1-minio，2-redis
#Store way: 0-MINIO; 1-META in REDIS, object in minio; 2-META and small object in Redis, large object in minio;
cache_store_object_way=0
#If CACHE_STORE_OBJECT_WAY is 2 and the size of a object is not bigger than this value, object will be stored in redis.
redis_cache_object_size=102400
#If CACHE_STORE_OBJECT_WAY is not 0, we will use redis to store meta and object.
redis_cluster_addrs=192.168.10.62-63;
#wired load balancer configuration
wiredlb_override=1
wiredlb_topic=MinioCache
wiredlb_datacenter=k18consul-tse
wiredlb_health_port=52101
wiredlb_group=TangoCache
cache_undefined_obj=1
query_undefined_obj=0
statsd_server=192.168.10.72
statsd_port=8126
histogram_bins=0.20,0.40,0.6,0.8

10
config/tfe/tfe/future.conf Normal file
View File

@@ -0,0 +1,10 @@
[STAT]
no_stats=0
statsd_server=127.0.0.1
statsd_port=8100
histogram_bins=0.50,0.80,0.9,0.95
statsd_cycle=5
# FS_OUTPUT_STATSD=1, FS_OUTPUT_INFLUX_LINE=2
statsd_format=2
# printf diff Not available
# print_diff=1

178
config/tfe/tfe/tfe.conf Normal file
View File

@@ -0,0 +1,178 @@
[system]
nr_worker_threads=8
enable_kni_v1=0
enable_kni_v2=0
enable_kni_v3=1
# Only when (disable_coredump == 1 || (enable_breakpad == 1 && enable_breakpad_upload == 1)) is satisfied, the core will not be generated locally
disable_coredump=0
enable_breakpad=1
enable_breakpad_upload=1
breakpad_upload_url=http://sentry.mesalab.cn:9000/api/3/minidump/?sentry_key=e8e446bb3bd8435c97f4c01770ca7025
# must be /run/tfe/crashreport，due to tmpfile limit
breakpad_minidump_dir=/run/tfe/crashreport
# ask for at least (1 + nr_worker_threads) masks
# the first mask for acceptor thread
# the others mask for worker thread
enable_cpu_affinity=1
cpu_affinity_mask=1-9
# LEAST_CONN = 0; ROUND_ROBIN = 1
load_balance=1
[kni]
# kni v1
#uxdomain=/var/run/.tfe_kni_acceptor_handler
# kni v2
#scm_socket_file=/var/run/.tfe_kmod_scm_socket
# send cmsg
send_switch=0
ip=192.168.100.1
cmsg_port=2475
# watch dog
watchdog_switch=0
watchdog_port=2476
[ssl]
ssl_ja3_debug=0
ssl_ja3_table=PXY_SSL_FINGERPRINT
# ssl version Not available, configured via TSG website
# ssl_max_version=tls13
# ssl_min_version=ssl3
ssl_compression=1
no_ssl2=1
no_ssl3=0
no_tls10=0
no_tls11=0
no_tls12=0
default_ciphers=ALL:-aNULL
no_cert_verify=0
# session ticket
no_session_ticket=0
stek_group_num=4096
stek_rotation_time=3600
# session cache
no_session_cache=0
session_cache_slots=4194304
session_cache_expire_seconds=1800
# service cache
service_cache_slots=4194304
service_cache_expire_seconds=300
service_cache_fail_as_pinning_cnt=4
service_cache_fail_as_proto_err_cnt=5
service_cache_fail_time_window=30
# cert
check_cert_crl=0
trusted_cert_load_local=0
#trusted_cert_file=resource/tfe/tls-ca-bundle.pem
trusted_cert_file=resource/tfe/tsg_diagonse_ca.pem
trusted_cert_dir=resource/tfe/trusted_storage
# master key
log_master_key=0
key_log_file=log/sslkeylog.log
# mid cert cache
mc_cache_enable=0
mc_cache_eth=eth0
mc_cache_broker_list=192.168.44.11:9092,192.168.44.14:9092,192.168.44.15:9092
mc_cache_topic=PXY-EXCH-INTERMEDIA-CERT
[key_keeper]
#Mode: debug - generate cert with ca_path, normal - generate cert with cert store
#0 on cache 1 off cache
no_cache=0
mode=normal
cert_store_host=192.168.40.21
cert_store_port=9991
ca_path=resource/tfe/tango-ca-trust-ca.pem
untrusted_ca_path=resource/tfe/tango-ca-untrust-ca.pem
hash_slot_size=131072
hash_expire_seconds=300
cert_expire_time=24
# health_check only for "mode=normal" default 1
enable_health_check=1
[debug]
# 1 : enforce tcp passthrough
# 0 : Whether to passthrough depends on the tcp_options in cmsg
passthrough_all_tcp=0
[ratelimit]
read_rate=0
read_burst=0
write_rate=0
write_burst=0
[tcp]
# read rcv_buff/snd_buff options from tfe conf
sz_rcv_buffer=-1
sz_snd_buffer=-1
# 1 : use tcp_options in tfe.conf
# 0 : use tcp_options in cmsg
enable_overwrite=0
tcp_nodelay=1
so_keepalive=1
tcp_keepcnt=8
tcp_keepintvl=15
tcp_keepidle=30
tcp_user_timeout=600
tcp_ttl_upstream=75
tcp_ttl_downstream=70
[stat]
statsd_server=127.0.0.1
statsd_port=8100
statsd_cycle=5
# 1:FS_OUTPUT_STATSD; 2:FS_OUTPUT_INFLUX_LINE
statsd_format=2
histogram_bins=0.5,0.8,0.9,0.95
statsd_set_prometheus_port=9001
statsd_set_prometheus_url_path=/metrics
[traffic_mirror]
enable=0
device=ens8f2
# 0:TRAFFIC_MIRROR_ETHDEV_AF_PACKET; 1:TRAFFIC_MIRROR_ETHDEV_MARSIO
type=1
table_info=resource/pangu/table_info_traffic_mirror.conf
stat_file=log/traffic_mirror.status
[kafka]
enable=0
NIC_NAME=eth0
kafka_brokerlist=192.168.44.11:9092,192.168.44.14:9092,192.168.44.15:9092
kafka_topic=PROXY-EVENT-LOG
device_id_filepath=/opt/tsg/etc/tsg_sn.json
[maat]
# 0:json 1:redis 2:iris
maat_input_mode=1
stat_switch=1
perf_switch=1
table_info=resource/pangu/table_info.conf
accept_path=/opt/tsg/etc/tsg_device_tag.json
accept_tag_key=device_id
stat_file=log/pangu_scan.fs2
effect_interval_s=1
deferred_load_on=0
# json mode conf iterm
json_cfg_file=resource/pangu/pangu_http.json
# redis mode conf iterm
maat_redis_server=192.168.44.72
maat_redis_port_range=7002
maat_redis_db_index=0
# iris mode conf iterm
full_cfg_dir=pangu_policy/full/index/
inc_cfg_dir=pangu_policy/inc/index/

20
config/tfe/tfe/zlog.conf Normal file
View File

@@ -0,0 +1,20 @@
# kill -s SIGHUP "pid"
[global]
default format = "%d(%c), %V, %F, %U, %m%n"
[levels]
DEBUG=10
INFO=20
FATAL=30
[rules]
*.fatal "./log/error.log.%d(%F)";
tfe.DEBUG "./log/tfe.log.%d(%F)";
http.DEBUG "./log/http.log.%d(%F)";
http2.DEBUG "./log/http2.log.%d(%F)";
doh.DEBUG "./log/doh_pxy.log.%d(%F)";
pangu.DEBUG "./log/pangu_pxy.log.%d(%F)";

20
docker-compose.yml
View File

@@ -18,3 +18,23 @@ services:
- ./config/sapp_run/tsgconf/maat.conf:/home/mesasoft/sapp_run/tsgconf/maat.conf
- ./config/sapp_run/conf/capture_packet_plug.conf:/home/mesasoft/sapp_run/conf/capture_packet_plug.conf
- /etc/localtime:/etc/localtime:ro
tfe:
build:
context: ./dockerfile/tfe
dockerfile: Dockerfile
image: "tfe-v4.4"
container_name: "tfe-container-v4.4"
security_opt:
- seccomp:unconfined
cap_add:
- NET_ADMIN
- SYS_PTRACE
devices:
- "/dev/net/tun:/dev/net/tun"
volumes:
- ./config/tfe/doh/doh.conf:/opt/tsg/tfe/conf/doh/doh.conf
- ./config/tfe/pangu/pangu_pxy.conf:/opt/tsg/tfe/conf/pangu/pangu_pxy.conf
- ./config/tfe/tfe/future.conf:/opt/tsg/tfe/conf/tfe/future.conf
- ./config/tfe/tfe/tfe.conf:/opt/tsg/tfe/conf/tfe/tfe.conf
- ./config/tfe/tfe/zlog.conf:/opt/tsg/tfe/conf/tfe/zlog.conf
- /etc/localtime:/etc/localtime:ro

47
dockerfile/tfe/Dockerfile
View File

@@ -1,39 +1,52 @@
FROM centos:7
FROM docker.io/centos:7
COPY MESA-Framework.repo /etc/yum.repos.d/
COPY MESA-Framework.repo /etc/yum.repos.d/
COPY framework.conf /etc/ld.so.conf.d/
RUN yum makecache && yum install -y \
RUN yum makecache && yum install -y \
mrzcpd \
numactl \
zlib \
librdkafka \
systemd \
libcjson \
libdocumentanalyze \
libmaatframe \
libMESA_field_stat \
libMESA_field_stat2 \
libMESA_handle_logger \
libMESA_htable\
libMESA_htable \
libMESA_prof_load \
librdkafka \
librulescan \
libtsglua \
libwiredcfg \
libWiredLB \
lz4 \
sapp \
libbreakpad_mini \
mrzcpd \
tfe
libmnl \
libnfnetlink \
iptables \
iproute \
&& ldconfig
RUN yum install -y \
epel-release \
python3 \
gdb \
numactl \
strace \
htop \
tcpdump \
net-tools \
curl \
vim \
&& pip3 install supervisor \
python3 \
&& pip3 install supervisor \
&& yum clean all
CMD tail -f /dev/null
COPY tfe-env.sh /opt/tsg/tfe/
COPY tfe-4.3.30.202103111806030800.ce55dbd-1.el7.x86_64.rpm /root/
RUN rpm -ivh /root/tfe-4.3.30.202103111806030800.ce55dbd-1.el7.x86_64.rpm && chmod o+x /opt/tsg/tfe/tfe-env.sh
COPY supervisord.conf /etc/supervisord/
#ENTRYPOINT ["cat","/root/test.txt"]
WORKDIR /opt/tsg/tfe/
ENTRYPOINT ["/usr/local/bin/supervisord", "-n", "-c", "/etc/supervisord/supervisord.conf"]
# docker run -it --cap-add=NET_ADMIN --cap-add=SYS_PTRACE --security-opt seccomp=unconfined --device /dev/net/tun:/dev/net/tun tfe:v1 /bin/bash
# supervisorctl -c /etc/supervisord/supervisord.conf status

1
dockerfile/tfe/framework.conf Normal file
View File

@@ -0,0 +1 @@
/opt/MESA/lib/

188
dockerfile/tfe/supervisord.conf Normal file
View File

@@ -0,0 +1,188 @@
; Sample supervisor config file.
;
; For more information on the config file, please see:
; http://supervisord.org/configuration.html
;
; Notes:
; - Shell expansion ("~" or "$HOME") is not supported. Environment
; variables can be expanded using this syntax: "%(ENV_HOME)s".
; - Quotes around values are not supported, except in the case of
; the environment= options as shown below.
; - Comments must have a leading space: "a=b ;comment" not "a=b;comment".
; - Command will be truncated if it looks like a config file comment, e.g.
; "command=bash -c 'foo ; bar'" will truncate to "command=bash -c 'foo ".
;
; Warning:
; Paths throughout this example file use /tmp because it is available on most
; systems. You will likely need to change these to locations more appropriate
; for your system. Some systems periodically delete older files in /tmp.
; Notably, if the socket file defined in the [unix_http_server] section below
; is deleted, supervisorctl will be unable to connect to supervisord.
[unix_http_server]
file=/var/run/supervisor.sock ; the path to the socket file
;chmod=0700 ; socket file mode (default 0700)
;chown=nobody:nogroup ; socket file uid:gid owner
;username=user ; default is no username (open server)
;password=123 ; default is no password (open server)
; Security Warning:
; The inet HTTP server is not enabled by default. The inet HTTP server is
; enabled by uncommenting the [inet_http_server] section below. The inet
; HTTP server is intended for use within a trusted environment only. It
; should only be bound to localhost or only accessible from within an
; isolated, trusted network. The inet HTTP server does not support any
; form of encryption. The inet HTTP server does not use authentication
; by default (see the username= and password= options to add authentication).
; Never expose the inet HTTP server to the public internet.
;[inet_http_server] ; inet (TCP) server disabled by default
;port=127.0.0.1:9001 ; ip_address:port specifier, *:port for all iface
;username=user ; default is no username (open server)
;password=123 ; default is no password (open server)
[supervisord]
logfile=/tmp/supervisord.log ; main log file; default $CWD/supervisord.log
logfile_maxbytes=50MB ; max main logfile bytes b4 rotation; default 50MB
logfile_backups=10 ; # of main logfile backups; 0 means none, default 10
loglevel=info ; log level; default info; others: debug,warn,trace
pidfile=/var/run/supervisord.pid ; supervisord pidfile; default supervisord.pid
nodaemon=false ; start in foreground if true; default false
silent=false ; no logs to stdout if true; default false
minfds=1024 ; min. avail startup file descriptors; default 1024
minprocs=200 ; min. avail process descriptors;default 200
;umask=022 ; process file creation umask; default 022
;user=supervisord ; setuid to this UNIX account at startup; recommended if root
;identifier=supervisor ; supervisord identifier, default is 'supervisor'
;directory=/tmp ; default is not to cd during start
;nocleanup=true ; don't clean up tempfiles at start; default false
;childlogdir=/tmp ; 'AUTO' child log dir, default $TEMP
;environment=KEY="value" ; key value pairs to add to environment
;strip_ansi=false ; strip ansi escape codes in logs; def. false
; The rpcinterface:supervisor section must remain in the config file for
; RPC (supervisorctl/web interface) to work. Additional interfaces may be
; added by defining them in separate [rpcinterface:x] sections.
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
; The supervisorctl section configures how supervisorctl will connect to
; supervisord. configure it match the settings in either the unix_http_server
; or inet_http_server section.
[supervisorctl]
serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL for a unix socket
;serverurl=http://127.0.0.1:9001 ; use an http:// url to specify an inet socket
;username=chris ; should be same as in [*_http_server] if set
;password=123 ; should be same as in [*_http_server] if set
;prompt=mysupervisor ; cmd line prompt (default "supervisor")
;history_file=~/.sc_history ; use readline history if available
; The sample program section below shows all possible program subsection values.
; Create one or more 'real' program: sections to be able to control them under
; supervisor.
;[program:theprogramname]
;command=/bin/cat ; the program (relative uses PATH, can take args)
;process_name=%(program_name)s ; process_name expr (default %(program_name)s)
;numprocs=1 ; number of processes copies to start (def 1)
;directory=/tmp ; directory to cwd to before exec (def no cwd)
;umask=022 ; umask for process (default None)
;priority=999 ; the relative start priority (default 999)
;autostart=true ; start at supervisord start (default: true)
;startsecs=1 ; # of secs prog must stay up to be running (def. 1)
;startretries=3 ; max # of serial start failures when starting (default 3)
;autorestart=unexpected ; when to restart if exited after running (def: unexpected)
;exitcodes=0 ; 'expected' exit codes used with autorestart (default 0)
;stopsignal=QUIT ; signal used to kill process (default TERM)
;stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10)
;stopasgroup=false ; send stop signal to the UNIX process group (default false)
;killasgroup=false ; SIGKILL the UNIX process group (def false)
;user=chrism ; setuid to this UNIX account to run the program
;redirect_stderr=true ; redirect proc stderr to stdout (default false)
;stdout_logfile=/a/path ; stdout log path, NONE for none; default AUTO
;stdout_logfile_maxbytes=1MB ; max # logfile bytes b4 rotation (default 50MB)
;stdout_logfile_backups=10 ; # of stdout logfile backups (0 means none, default 10)
;stdout_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0)
;stdout_events_enabled=false ; emit events on stdout writes (default false)
;stdout_syslog=false ; send stdout to syslog with process name (default false)
;stderr_logfile=/a/path ; stderr log path, NONE for none; default AUTO
;stderr_logfile_maxbytes=1MB ; max # logfile bytes b4 rotation (default 50MB)
;stderr_logfile_backups=10 ; # of stderr logfile backups (0 means none, default 10)
;stderr_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0)
;stderr_events_enabled=false ; emit events on stderr writes (default false)
;stderr_syslog=false ; send stderr to syslog with process name (default false)
;environment=A="1",B="2" ; process environment additions (def no adds)
;serverurl=AUTO ; override serverurl computation (childutils)
; The sample eventlistener section below shows all possible eventlistener
; subsection values. Create one or more 'real' eventlistener: sections to be
; able to handle event notifications sent by supervisord.
;[eventlistener:theeventlistenername]
;command=/bin/eventlistener ; the program (relative uses PATH, can take args)
;process_name=%(program_name)s ; process_name expr (default %(program_name)s)
;numprocs=1 ; number of processes copies to start (def 1)
;events=EVENT ; event notif. types to subscribe to (req'd)
;buffer_size=10 ; event buffer queue size (default 10)
;directory=/tmp ; directory to cwd to before exec (def no cwd)
;umask=022 ; umask for process (default None)
;priority=-1 ; the relative start priority (default -1)
;autostart=true ; start at supervisord start (default: true)
;startsecs=1 ; # of secs prog must stay up to be running (def. 1)
;startretries=3 ; max # of serial start failures when starting (default 3)
;autorestart=unexpected ; autorestart if exited after running (def: unexpected)
;exitcodes=0 ; 'expected' exit codes used with autorestart (default 0)
;stopsignal=QUIT ; signal used to kill process (default TERM)
;stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10)
;stopasgroup=false ; send stop signal to the UNIX process group (default false)
;killasgroup=false ; SIGKILL the UNIX process group (def false)
;user=chrism ; setuid to this UNIX account to run the program
;redirect_stderr=false ; redirect_stderr=true is not allowed for eventlisteners
;stdout_logfile=/a/path ; stdout log path, NONE for none; default AUTO
;stdout_logfile_maxbytes=1MB ; max # logfile bytes b4 rotation (default 50MB)
;stdout_logfile_backups=10 ; # of stdout logfile backups (0 means none, default 10)
;stdout_events_enabled=false ; emit events on stdout writes (default false)
;stdout_syslog=false ; send stdout to syslog with process name (default false)
;stderr_logfile=/a/path ; stderr log path, NONE for none; default AUTO
;stderr_logfile_maxbytes=1MB ; max # logfile bytes b4 rotation (default 50MB)
;stderr_logfile_backups=10 ; # of stderr logfile backups (0 means none, default 10)
;stderr_events_enabled=false ; emit events on stderr writes (default false)
;stderr_syslog=false ; send stderr to syslog with process name (default false)
;environment=A="1",B="2" ; process environment additions
;serverurl=AUTO ; override serverurl computation (childutils)
; The sample group section below shows all possible group values. Create one
; or more 'real' group: sections to create "heterogeneous" process groups.
;[group:thegroupname]
;programs=progname1,progname2 ; each refers to 'x' in [program:x] definitions
;priority=999 ; the relative start priority (default 999)
; The [include] section can just contain the "files" setting. This
; setting can list multiple files (separated by whitespace or
; newlines). It can also contain wildcards. The filenames are
; interpreted as relative to this file. Included files *cannot*
; include files themselves.
;[include]
;files = relative/directory/*.ini
[program:tfe-env]
user=root
Command=bash -c "/opt/tsg/tfe/tfe-env.sh start"
directory=/opt/tsg/tfe/
startsecs=0
startretries=0
autorestart=false
[program:tfe]
user=root
Command="/opt/tsg/tfe/bin/tfe"
directory=/opt/tsg/tfe/
autostart=true
startsecs=1
startretries=3

BIN
dockerfile/tfe/tfe-4.3.30.202103111806030800.ce55dbd-1.el7.x86_64.rpm Normal file
View File

Binary file not shown.

108
dockerfile/tfe/tfe-env.sh Normal file
View File

@@ -0,0 +1,108 @@
#!/bin/bash
INCOMING_DEVICE=tun_kni
LOCAL_MAC_ADDR=fe:65:b7:00:00:01
PEER_MAC_ADDR=aa:bb:cc:dd:ee:ff
LOCAL_IP_ADDR=172.16.241.2
PEER_IP_ADDR=172.16.241.1
start_fun()
{
# 创建虚拟网卡
/usr/sbin/ip tuntap add dev ${INCOMING_DEVICE} mode tun one_queue
# 设置网卡的 MAC
/usr/sbin/ip link set ${INCOMING_DEVICE} address ${LOCAL_MAC_ADDR}
# 设置网卡的状态
/usr/sbin/ip link set ${INCOMING_DEVICE} up
/usr/sbin/ip addr flush dev ${INCOMING_DEVICE}
# 设置网卡的 IPv4 地址
/usr/sbin/ip addr add ${LOCAL_IP_ADDR}/30 dev ${INCOMING_DEVICE}
# 刷新网卡的 ARP
# /usr/sbin/ip neigh flush dev ${INCOMING_DEVICE}
# 将 PEER 的 IP / MAC 加入到本地设备的 ARP 表中
#/usr/sbin/ip neigh add ${PEER_IP_ADDR} lladdr ${PEER_MAC_ADDR} dev ${INCOMING_DEVICE} nud permanent
###########################################################################
# policy route v4
###########################################################################
# 流入的流量走 100 号路由表
/usr/sbin/ip rule add iif ${INCOMING_DEVICE} tab 100
/usr/sbin/ip route add local default dev lo table 100
# 流出的带 0x65 的流量走 101 号路由表
/usr/sbin/ip rule add fwmark 0x65 lookup 101
/usr/sbin/ip route add default dev ${INCOMING_DEVICE} via ${PEER_IP_ADDR} table 101
###########################################################################
# policy route v6
###########################################################################
# 设置网卡的 IPv6 地址
/usr/sbin/ip addr add fd00::02/64 dev ${INCOMING_DEVICE}
/usr/sbin/ip -6 route add default via fd00::01
# 流入的流量走 102 号路由表
/usr/sbin/ip -6 rule add iif ${INCOMING_DEVICE} tab 102
/usr/sbin/ip -6 route add local default dev lo table 102
# 将 PEER 的 IP / MAC 加入到本地设备的 ARP 表中
#/usr/sbin/ip -6 neigh add fd00::01 lladdr ${PEER_MAC_ADDR} dev ${INCOMING_DEVICE} nud permanent
###########################################################################
# iptables netfilter
###########################################################################
iptables -A INPUT -i ${INCOMING_DEVICE} -m bpf --bytecode '14,48 0 0 0,84 0 0 240,21 0 10 64,48 0 0 9,21 0 8 6,40 0 0 6,69 6 0 8191,177 0 0 0,80 0 0 20,21 0 3 88,80 0 0 21,21 0 1 4,6 0 0 65535,6 0 0 0' -j NFQUEUE --queue-num 1
}
stop_fun()
{
iptables -F
/usr/sbin/ip rule del iif ${INCOMING_DEVICE} tab 100
/usr/sbin/ip route del local default dev lo table 100
/usr/sbin/ip rule del fwmark 0x65 lookup 101
/usr/sbin/ip route del default dev ${INCOMING_DEVICE} via ${PEER_IP_ADDR} table 101
/usr/sbin/ip -6 rule del iif ${INCOMING_DEVICE} tab 102
/usr/sbin/ip -6 route del default via fd00::01
/usr/sbin/ip -6 route del local default dev lo table 102
/usr/sbin/ip addr del fd00::02/64 dev ${INCOMING_DEVICE}
/usr/sbin/ip link set ${INCOMING_DEVICE} down
# 删除虚拟网卡
/usr/sbin/ip tuntap del dev ${INCOMING_DEVICE} mode tap
}
status_fun()
{
iptables -L
}
case "$1" in
start)
start_fun
;;
stop)
stop_fun
;;
restart)
stop_fun
start_fun
;;
status)
status_fun
;;
*)
echo "Usage: $0 {start|stop|status|restart}"
esac
exit 0