Skip to content

Commit

Permalink
set iptables mark with xor mask to avoid change OEM mark
Browse files Browse the repository at this point in the history
  • Loading branch information
@whalechoi
whalechoi committed May 14, 2024
1 parent 4d15060 commit 55274d9
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 24 deletions.
8 changes: 4 additions & 4 deletions main/common/const.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,19 +4,19 @@ import "github.com/coreos/go-iptables/iptables"

const (
CoreGid = "3005"
TproxyTableId = "233"
TproxyMarkId = "1111"
TproxyTableId = "160"
TproxyMarkId = "0x200000/0x200000"
DummyDevice = "xdummy"
DummyIp = "fd01:5ca1:ab1e:8d97:497f:8b48:b9aa:85cd/128"
DummyMarkId = "164"
DummyMarkId = "0x400000/0x400000"
DummyTableId = "164"
Tun2socksIPv4 = "10.10.12.1"
Tun2socksIPv6 = "fd02:5ca1:ab1e:8d97:497f:8b48:b9aa:85cd"
Tun2socksMTU = 8500
Tun2socksMultiQueue = false
Tun2socksUdpMode = "udp"
TunTableId = "168"
TunMarkId = "168"
TunMarkId = "0x800000/0x800000"
)

var (
Expand Down
4 changes: 2 additions & 2 deletions main/proxies/tproxy/dummy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,10 +73,10 @@ func createDummyOutputChain() error {
if err := common.Ipt6.NewChain("mangle", "DUMMY"); err != nil {
return e.New("create ipv6 mangle chain DUMMY failed, ", err).WithPrefix(tagDummy)
}
if err := common.Ipt6.Append("mangle", "DUMMY", "-p", "tcp", "-j", "MARK", "--set-mark", common.DummyMarkId); err != nil {
if err := common.Ipt6.Append("mangle", "DUMMY", "-p", "tcp", "-j", "MARK", "--set-xmark", common.DummyMarkId); err != nil {
return e.New("set mark on tcp mangle chain DUMMY failed, ", err).WithPrefix(tagDummy)
}
if err := common.Ipt6.Append("mangle", "DUMMY", "-p", "udp", "-j", "MARK", "--set-mark", common.DummyMarkId); err != nil {
if err := common.Ipt6.Append("mangle", "DUMMY", "-p", "udp", "-j", "MARK", "--set-xmark", common.DummyMarkId); err != nil {
return e.New("set mark on udp mangle chain DUMMY failed, ", err).WithPrefix(tagDummy)
}
if err := common.Ipt6.Append("mangle", "OUTPUT", "-j", "DUMMY"); err != nil {
Expand Down
36 changes: 18 additions & 18 deletions main/proxies/tproxy/tproxy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -192,10 +192,10 @@ func createProxyChain(ipv6 bool) error {
// start processing proxy rules
// if PkgList has no package, should proxy everything
if len(builds.Config.Proxy.PkgList) == 0 {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" tcp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
} else if builds.Config.Proxy.Mode == "blacklist" {
Expand All @@ -209,37 +209,37 @@ func createProxyChain(ipv6 bool) error {
}
}
// allow others
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" tcp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
} else if builds.Config.Proxy.Mode == "whitelist" {
// allow PkgList
for _, pkg := range builds.Config.Proxy.PkgList {
uidSlice := tools.GetUid(pkg)
for _, uid := range uidSlice {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-m", "owner", "--uid-owner", uid, "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-m", "owner", "--uid-owner", uid, "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create package "+pkg+" proxy on "+currentProto+" tcp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-m", "owner", "--uid-owner", uid, "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-m", "owner", "--uid-owner", uid, "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create package "+pkg+" proxy on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
}
}
// allow root user(eg: magisk, ksud, netd...)
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-m", "owner", "--uid-owner", "0", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-m", "owner", "--uid-owner", "0", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create root user proxy on "+currentProto+" tcp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-m", "owner", "--uid-owner", "0", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-m", "owner", "--uid-owner", "0", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create root user proxy on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
// allow dns_tether user(eg: dnsmasq...)
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-m", "owner", "--uid-owner", "1052", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "tcp", "-m", "owner", "--uid-owner", "1052", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create dns_tether user proxy on "+currentProto+" tcp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-m", "owner", "--uid-owner", "1052", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Append("mangle", "PROXY", "-p", "udp", "-m", "owner", "--uid-owner", "1052", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("create dns_tether user proxy on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
} else {
Expand All @@ -248,17 +248,17 @@ func createProxyChain(ipv6 bool) error {
// allow IntraList
for _, intra := range builds.Config.Proxy.IntraList {
if (currentProto == "ipv4" && !common.IsIPv6(intra)) || (currentProto == "ipv6" && common.IsIPv6(intra)) {
if err := currentIpt.Insert("mangle", "PROXY", 1, "-p", "tcp", "-d", intra, "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Insert("mangle", "PROXY", 1, "-p", "tcp", "-d", intra, "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("allow intra "+intra+" on "+currentProto+" tcp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Insert("mangle", "PROXY", 1, "-p", "udp", "-d", intra, "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Insert("mangle", "PROXY", 1, "-p", "udp", "-d", intra, "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("allow intra "+intra+" on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
}
}
// mark all dns request (except mihomo)
if builds.Config.XrayHelper.CoreType != "mihomo" && builds.Config.XrayHelper.CoreType != "clash.meta" {
if err := currentIpt.Insert("mangle", "PROXY", 1, "-p", "udp", "-m", "owner", "!", "--gid-owner", common.CoreGid, "--dport", "53", "-j", "MARK", "--set-mark", common.TproxyMarkId); err != nil {
if err := currentIpt.Insert("mangle", "PROXY", 1, "-p", "udp", "-m", "owner", "!", "--gid-owner", common.CoreGid, "--dport", "53", "-j", "MARK", "--set-xmark", common.TproxyMarkId); err != nil {
return e.New("mark all dns request on "+currentProto+" udp mangle chain PROXY failed, ", err).WithPrefix(tagTproxy)
}
}
Expand Down Expand Up @@ -315,12 +315,12 @@ func createMangleChain(ipv6 bool) error {
}
}
}
// mark all lo traffic
if err := currentIpt.Append("mangle", "XRAY", "-p", "tcp", "-i", "lo", "-j", "TPROXY", "--on-port", builds.Config.Proxy.TproxyPort, "--tproxy-mark", common.TproxyMarkId); err != nil {
return e.New("create lo interface proxy on "+currentProto+" tcp mangle chain XRAY failed, ", err).WithPrefix(tagTproxy)
// mark all traffic
if err := currentIpt.Append("mangle", "XRAY", "-p", "tcp", "-m", "mark", "--mark", common.TproxyMarkId, "-j", "TPROXY", "--on-port", builds.Config.Proxy.TproxyPort, "--tproxy-mark", common.TproxyMarkId); err != nil {
return e.New("create all traffic proxy on "+currentProto+" tcp mangle chain XRAY failed, ", err).WithPrefix(tagTproxy)
}
if err := currentIpt.Append("mangle", "XRAY", "-p", "udp", "-i", "lo", "-j", "TPROXY", "--on-port", builds.Config.Proxy.TproxyPort, "--tproxy-mark", common.TproxyMarkId); err != nil {
return e.New("create lo interface proxy on "+currentProto+" udp mangle chain XRAY failed, ", err).WithPrefix(tagTproxy)
if err := currentIpt.Append("mangle", "XRAY", "-p", "udp", "-m", "mark", "--mark", common.TproxyMarkId, "-j", "TPROXY", "--on-port", builds.Config.Proxy.TproxyPort, "--tproxy-mark", common.TproxyMarkId); err != nil {
return e.New("create all traffic proxy on "+currentProto+" udp mangle chain XRAY failed, ", err).WithPrefix(tagTproxy)
}
// trans ApList to chain XRAY
for _, ap := range builds.Config.Proxy.ApList {
Expand Down

0 comments on commit 55274d9

Please sign in to comment.