mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:27:02 +01:00
Krzysztof kuhy Rudnicki
2cd62587d6
First phone_focus_mode split, so it sets the pattern. The nine iptables and tethering-offload functions move to a SIBLING file, not a lib/ member: deploy.sh copies a hardcoded per-file list into REMOTE_DIR and never deploys lib/, so anything sourced on the phone has to sit beside the entry script. deploy.sh has two hardcoded lists, not one - an adb push into the staging dir and an adb_root cp out of it. Both were updated; missing the push would have left the copy pointing at a file that was never staged. The test harness copies only the entry script into its scratch dir, so it was taught to copy the sibling too. That is the same coupling as the phone deployment, in a form that can actually be run - and running it is the evidence: 17 passed, 0 failed, identical to the pre-split baseline, with the daemon sourcing the new sibling exactly as it will on the device. This script is #!/system/bin/sh with no `set -e`, so the extractor refused to guess an anchor rather than placing the source line somewhere wrong. It went after the existing config.sh source by hand. All 20 functions verbatim. Not verified on the phone - the next deploy is where that gets confirmed. Over-cap files 25 -> 24. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
104 lines
3.7 KiB
Bash
Executable File
104 lines
3.7 KiB
Bash
Executable File
#!/system/bin/sh
|
|
# shellcheck shell=ash
|
|
# iptables chain management and tethering-offload control for tether_enforcer.
|
|
#
|
|
# A sibling file rather than a lib/ member: deploy.sh copies a hardcoded
|
|
# per-file list into REMOTE_DIR and never deploys lib/, so anything sourced on
|
|
# the phone must sit beside the entry script and be listed there too.
|
|
|
|
apply_offload_off() {
|
|
local cur
|
|
cur="$(settings get global "$TETHER_OFFLOAD_KEY" 2>/dev/null)"
|
|
if [ "$cur" != "1" ]; then
|
|
settings put global "$TETHER_OFFLOAD_KEY" 1 2>/dev/null \
|
|
&& log "tether offload was '$cur' - forced disabled (=1)"
|
|
fi
|
|
}
|
|
|
|
snapshot_offload() {
|
|
local cur
|
|
cur="$(settings get global "$TETHER_OFFLOAD_KEY" 2>/dev/null)"
|
|
printf '%s\n' "${cur:-null}" > "$TETHER_OFFLOAD_SNAP" 2>/dev/null || true
|
|
}
|
|
|
|
restore_offload() {
|
|
local snap
|
|
[ -f "$TETHER_OFFLOAD_SNAP" ] && snap="$(cat "$TETHER_OFFLOAD_SNAP" 2>/dev/null)"
|
|
case "$snap" in
|
|
''|null)
|
|
# No pre-existing value: clear ours so the OS default returns.
|
|
settings delete global "$TETHER_OFFLOAD_KEY" 2>/dev/null || true
|
|
;;
|
|
*)
|
|
settings put global "$TETHER_OFFLOAD_KEY" "$snap" 2>/dev/null || true
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# Run iptables/ip6tables with a 2s xtables lock-wait so our calls queue for the
|
|
# lock instead of silently failing the instant netd holds it (proven necessary
|
|
# on-device for the curfew net layer). $1 = binary.
|
|
iptw() {
|
|
local bin="$1"
|
|
shift
|
|
"$bin" -w 2 "$@"
|
|
}
|
|
|
|
ensure_chain() {
|
|
local ipt="$1"
|
|
if ! iptw "$ipt" -L "$TETHER_IPT_CHAIN" >/dev/null 2>&1; then
|
|
iptw "$ipt" -N "$TETHER_IPT_CHAIN" 2>/dev/null || {
|
|
log "ERROR: could not create $ipt chain $TETHER_IPT_CHAIN"
|
|
return 1
|
|
}
|
|
fi
|
|
# De-dupe: remove every existing FORWARD jump, then pin exactly one at #1
|
|
# (netd inserts its own tethering rules into FORWARD, so we must be first).
|
|
while iptw "$ipt" -D FORWARD -j "$TETHER_IPT_CHAIN" 2>/dev/null; do :; done
|
|
iptw "$ipt" -I FORWARD 1 -j "$TETHER_IPT_CHAIN" 2>/dev/null || {
|
|
log "ERROR: could not insert FORWARD -> $TETHER_IPT_CHAIN for $ipt"
|
|
return 1
|
|
}
|
|
}
|
|
|
|
fill_chain() {
|
|
local ipt="$1" reject="$2"
|
|
iptw "$ipt" -F "$TETHER_IPT_CHAIN" 2>/dev/null || return 1
|
|
# Single rule: reject everything that would be forwarded through us.
|
|
iptw "$ipt" -A "$TETHER_IPT_CHAIN" -j REJECT --reject-with "$reject" 2>/dev/null || true
|
|
}
|
|
|
|
# Only rebuild when actually tampered (chain missing, unlinked from FORWARD, or
|
|
# wrong size). Avoids forking a flush+refill every tick, which pegs netd.
|
|
chain_intact() {
|
|
local ipt="$1" actual
|
|
iptw "$ipt" -C FORWARD -j "$TETHER_IPT_CHAIN" >/dev/null 2>&1 || return 1
|
|
actual="$(iptw "$ipt" -S "$TETHER_IPT_CHAIN" 2>/dev/null | grep -c '^-A')"
|
|
[ "$actual" = "1" ]
|
|
}
|
|
|
|
apply_forward_block() {
|
|
if command -v iptables >/dev/null 2>&1; then
|
|
if chain_intact iptables; then :; \
|
|
elif ensure_chain iptables && fill_chain iptables icmp-port-unreachable; then
|
|
log "iptables (v4) FORWARD block rebuilt (was missing/tampered)"
|
|
fi
|
|
fi
|
|
if command -v ip6tables >/dev/null 2>&1; then
|
|
if chain_intact ip6tables; then :; \
|
|
elif ensure_chain ip6tables && fill_chain ip6tables icmp6-port-unreachable; then
|
|
log "ip6tables (v6) FORWARD block rebuilt (was missing/tampered)"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
teardown_forward_block() {
|
|
local ipt
|
|
for ipt in iptables ip6tables; do
|
|
command -v "$ipt" >/dev/null 2>&1 || continue
|
|
while iptw "$ipt" -D FORWARD -j "$TETHER_IPT_CHAIN" 2>/dev/null; do :; done
|
|
iptw "$ipt" -F "$TETHER_IPT_CHAIN" 2>/dev/null || true
|
|
iptw "$ipt" -X "$TETHER_IPT_CHAIN" 2>/dev/null || true
|
|
done
|
|
}
|