ss-tproxy

#!/bin/bash

export PATH="$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"

# &#38500;&#20102;&#20027;&#33050;&#26412;&#65292;&#20854;&#20182;&#25991;&#20214;&#37117;&#25918;&#36825;&#20010;&#30446;&#24405;&#65292;&#27492;&#20540;&#21487;&#34987;&#21629;&#20196;&#34892;&#21442;&#25968;&#35206;&#30422;
base_dir='/etc/ss-tproxy' # &#21516;&#26102;&#20063;&#26159;&#24037;&#20316;&#30446;&#24405;
config_file='ss-tproxy.conf' # &#21487;&#34987;&#21629;&#20196;&#34892;&#21442;&#25968;&#35206;&#30422;

# &#24050;&#23384;&#22312;&#30340;&#20989;&#25968;&#21644;&#21464;&#37327;&#23613;&#37327;&#21035;&#25913;&#21517;/&#21024;&#38500;&#65292;&#22240;&#20026;&#21487;&#33021;&#34987; ss-tproxy.conf &#24341;&#29992;(&#22914;&#38057;&#23376;&#20989;&#25968;)
# &#30001;&#20110;&#38656;&#35201;&#25191;&#34892; iptables&#12289;&#31574;&#30053;&#36335;&#30001;&#12289;&#20869;&#26680;&#21442;&#25968; &#31561;&#29305;&#26435;&#25805;&#20316;&#65292;&#33050;&#26412;&#24517;&#39035;&#20197; root &#26435;&#38480;&#25191;&#34892;

# &#26377;xtables&#38145;&#26102;&#36827;&#34892;&#31561;&#24453;&#65292;&#32780;&#19981;&#26159;&#25253;&#38169;&#36864;&#20986;
iptables() {
    command iptables -w "$@"
}

# &#26377;xtables&#38145;&#26102;&#36827;&#34892;&#31561;&#24453;&#65292;&#32780;&#19981;&#26159;&#25253;&#38169;&#36864;&#20986;
ip6tables() {
    command ip6tables -w "$@"
}

font_bold() {
    printf "\e[1m$*\e[0m"
}

color_red() {
    printf "\e[35m$*\e[0m"
}

color_green() {
    printf "\e[32m$*\e[0m"
}

color_yellow() {
    printf "\e[31m$*\e[0m"
}

# &#25171;&#21360;&#38169;&#35823;&#28040;&#24687;&#65292;&#24182;&#36864;&#20986;&#33050;&#26412;
log_error() {
    echo "$(font_bold $(color_yellow '[ERROR]')) $*" 1>&2
    exit 1
}

is_func() {
    [ "$(type -t $1)" = 'function' ]
}

# &#22914;&#26524;&#20989;&#25968;&#23384;&#22312;&#65292;&#21017;&#35843;&#29992;
call_func() {
    is_func "$1" && "$@"
}

# &#20351;&#29992;&#25968;&#20540;0&#21644;1&#20570;&#24067;&#23572;&#20540;&#26368;&#22909;&#65292;&#20294;&#30001;&#20110;&#21382;&#21490;&#21407;&#22240;&#65292;&#27809;&#27861;&#25913;&#20102;
is_true() {
    [ "$1" = 'true' ]
}

is_false() {
    ! is_true "$1"
}

is_uint() {
    [ "$1" ] && [ -z "${1//[0-9]/}" ]
}

# str substr
str_find() {
    [[ "$1" == *"$2"* ]]
}

file_is_exists() {
    [ -f "$1" ]
}

file_required() {
    file_is_exists "$1" || log_error "file not found: $1"
}

list_ext_ipv4() {
    grep '^-' "$1" | cut -c2-
}

list_ext_ipv6() {
    grep '^~' "$1" | cut -c2-
}

list_ext_domain() {
    grep '^@' "$1" | cut -c2-
}

command_path() {
    type -P "$1"
}

command_is_exists() {
    type -P "$1" &>/dev/null
}

command_required() {
    command_is_exists "$1" || log_error "command not found: $1"
}

group_is_exists() {
    if is_uint "$1"; then # gid
        grep -q ":$1:" /etc/group
    else # name
        grep -q "^$1:" /etc/group
    fi
}

create_group() {
    if is_uint "$1"; then # gid
        log_error "gid:'$1' not exists, please check proxy_procgroup/dns_procgroup"
    elif command_is_exists groupadd; then
        groupadd "$1" || log_error "failed to create group:'$1' via groupadd, exit-code: $?"
    elif command_is_exists addgroup; then
        addgroup "$1" || log_error "failed to create group:'$1' via addgroup, exit-code: $?"
    else
        log_error "group:'$1' not exists, and groupadd/addgroup are not found, please create it manually"
    fi
}

# group command
set_command_group() {
    command_required "$2"
    local group="$1" path="$(command_path "$2")"
    chgrp "$group" "$path" || log_error "chgrp failed: group=$group path=$path"
    chmod g+xs "$path"
}

# command
set_proxy_group() {
    set_command_group "$proxy_procgroup" "$1"
}

# command
set_dns_group() {
    set_command_group "$dns_procgroup" "$1"
}

process_is_running() {
    kill -0 "$1" &>/dev/null
}

# &#20248;&#38597;&#20851;&#38381;&#36827;&#31243;
kill_by_pid() {
    [ $# -eq 0 ] && return

    # send SIGTERM
    for pid in "$@"; do
        process_is_running "$pid" && kill "$pid"
    done

    # wait up to 5s
    local running_pids
    for ((i = 0; i < 100; i++)); do
        running_pids=()
        for pid in "$@"; do
            process_is_running "$pid" && running_pids+=("$pid")
        done
        [ "${#running_pids[@]}" -eq 0 ] && return
        ((i < 5)) && sleep 0.01 || sleep 0.05
        ((i % 20 == 0 && i >= 30)) && echo "[notice] kill process: ${running_pids[@]}"
    done

    # force kill
    echo "[warning] force kill: ${running_pids[@]}"
    kill -9 "${running_pids[@]}"
}

# &#20248;&#38597;&#20851;&#38381;&#36827;&#31243;
kill_by_name() {
    local pids=()
    for name in "$@"; do
        pids+=($(pidof "$name"))
    done
    kill_by_pid "${pids[@]}"
}

tcp_port_is_exists() {
    $netstat -lnpt | grep -q ":$1[[:blank:]]"
}

udp_port_is_exists() {
    $netstat -anpu | grep -q ":$1[[:blank:]]"
}

# &#36890;&#36807;&#19968;&#20123;&#36816;&#34892;&#26102;&#29305;&#24449;(&#31995;&#32479;&#37325;&#21551;&#21518;&#19981;&#20445;&#30041;&#30340;&#29366;&#24577;)&#65292;&#21028;&#26029;&#26159;&#21542;&#22788;&#20110;start&#29366;&#24577;
ss_tproxy_is_started() {
    iptables  -t mangle -S SSTP_OUTPUT &>/dev/null ||
    iptables  -t nat    -S SSTP_OUTPUT &>/dev/null ||
    ip6tables -t mangle -S SSTP_OUTPUT &>/dev/null ||
    ip6tables -t nat    -S SSTP_OUTPUT &>/dev/null ||
    ip -4 rule 2>/dev/null | grep -q "lookup $ipts_rt_tab" ||
    ip -6 rule 2>/dev/null | grep -q "lookup $ipts_rt_tab" ||
    ip -4 route show table $ipts_rt_tab 2>/dev/null | grep -q '^' ||
    ip -6 route show table $ipts_rt_tab 2>/dev/null | grep -q '^'
}

is_ipv4_ipts() {
    [ "$1" = 'iptables' ]
}

is_ipv6_ipts() {
    [ "$1" = 'ip6tables' ]
}

# $ipts table chain
chain_is_exists() {
    local table="$2" chain="$3"
    $1 -t $table -S $chain &>/dev/null
}

# &#20808;&#21028;&#26029;chain&#26159;&#21542;&#23384;&#22312;
# $ipts table chain
chain_is_empty() {
    local table="$2" chain="$3"
    [ $($1 -t $table -S $chain | wc -l) -le 1 ]
}

is_global_mode() {
    [ "$mode" = 'global' ]
}

is_gfwlist_mode() {
    [ "$mode" = 'gfwlist' ]
}

is_chnroute_mode() {
    [ "$mode" = 'chnroute' ]
}

# tcp&#20063;&#20351;&#29992;tproxy? (udp&#24517;&#39035;&#29992;tproxy)
is_tcp_tproxy() {
    is_true "$tproxy"
}

is_built_in_dns() {
    is_false "$dns_custom"
}

is_proxy_other() {
    is_false "$selfonly"
}

is_drop_quic() {
    case "$ipts_drop_quic" in
        tcponly)
            ! is_enabled_udp;;
        always)
            true;;
        *)
            false;;
    esac
}

is_enabled_ipv4() {
    is_true "$ipv4"
}

is_enabled_ipv6() {
    is_true "$ipv6"
}

is_enabled_udp() {
    is_false "$tcponly"
}

is_need_iproute() {
    is_tcp_tproxy || is_enabled_udp
}

# ip#port
get_ip_from_addr() {
    local addr="$1"
    echo "${addr%#*}"
}

# ip#port
get_port_from_addr() {
    local addr="$1"
    echo "${addr#*#}"
}

#===============================================================

# &#21152;&#36733;&#19978;&#27425;start&#26102;&#30340;&#19968;&#20123;&#36816;&#34892;&#26102;&#29366;&#24577;&#65292;&#20027;&#35201;&#26159;pid
load_pidfile() {
    if ss_tproxy_is_started; then
        source .ss-tproxy.pid
    else
        # start&#29366;&#24577;&#19979;&#37325;&#21551;&#31995;&#32479;&#65292;pid&#25991;&#20214;&#20250;&#20445;&#30041;(&#26410;&#34987;&#28165;&#29702;)&#65292;&#36825;&#37324;&#21024;&#19968;&#19979;
        delete_pidfile
    fi
}

# start&#20043;&#21518;&#35843;&#29992;&#65292;&#20445;&#23384;start&#26102;&#30340;&#19968;&#20123;&#36816;&#34892;&#26102;&#29366;&#24577;
save_pidfile() {
    {
        if is_built_in_dns; then
            echo "sstp_pid_chinadns=$sstp_pid_chinadns"
        else
            call_func custom_dns_pid
        fi
        call_func extra_pid
    } >.ss-tproxy.pid
}

# stop&#26102;&#31227;&#38500;&#65292;&#25110;&#32773;&#37325;&#21551;&#31995;&#32479;&#21518;&#26377;&#27531;&#30041;&#65292;&#20063;&#31227;&#38500;
delete_pidfile() {
    rm -f .ss-tproxy.pid &>/dev/null
}

#===============================================================

load_config() {
    file_required $config_file

    source $config_file "${arg_list[@]}" ||
        log_error "$config_file load failed, exit-code: $?"

    # &#35206;&#30422;&#21516;&#21517;&#37197;&#32622;&#65292;&#20063;&#21487;&#20197;&#29992;&#26469;&#23450;&#20041;&#26032;&#21464;&#37327;
    for override in "${override_list[@]}"; do
        eval "$override"
    done

    { ! is_enabled_ipv4 && ! is_enabled_ipv6; } &&
        log_error "both ipv4 and ipv6 are disabled, nothing to do"

    if is_global_mode; then
        # &#30333;&#21517;&#21333;
        file_required ignlist.ext
    elif is_gfwlist_mode; then
        # &#40657;&#21517;&#21333;
        file_required gfwlist.txt
        file_required gfwlist.ext
    elif is_chnroute_mode; then
        # &#30333;&#21517;&#21333; + &#40657;&#21517;&#21333;(&#20248;&#20808;)
        file_required ignlist.ext
        file_required chnlist.txt
        file_required chnroute.txt
        file_required chnroute6.txt
        file_required gfwlist.txt
        file_required gfwlist.ext
    else
        log_error "invalid config value for mode: '$mode'"
    fi

    [ "$proxy_procgroup" -a "$proxy_procgroup" != 0 -a "$proxy_procgroup" != root ] ||
        log_error "invalid config value for proxy_procgroup: '$proxy_procgroup'"

    [ "$dns_procgroup" -a "$dns_procgroup" != 0 -a "$dns_procgroup" != root ] ||
        log_error "invalid config value for dns_procgroup: '$dns_procgroup'"

    [ "$proxy_procgroup" != "$dns_procgroup" ] ||
        log_error "proxy_procgroup and dns_procgroup must be different: '$proxy_procgroup'"

    group_is_exists "$proxy_procgroup" || create_group "$proxy_procgroup"
    group_is_exists "$dns_procgroup"   || create_group "$dns_procgroup"

    is_need_iproute && command_required 'ip'

    command_required 'ipset'

    is_enabled_ipv4 && command_required 'iptables'
    is_enabled_ipv6 && command_required 'ip6tables'

    if is_built_in_dns; then
        set_dns_group 'chinadns-ng'
    else
        call_func custom_dns_init
    fi

    case "$opts_ss_netstat" in
        auto)
            if command_is_exists 'ss'; then
                netstat='ss'
            elif command_is_exists 'netstat'; then
                netstat='netstat'
            else
                log_error "command not found: ss/netstat"
            fi
            ;;
        ss)
            command_required 'ss'
            netstat='ss'
            ;;
        netstat)
            command_required 'netstat'
            netstat='netstat'
            ;;
        *)
            log_error "invalid config value for opts_ss_netstat: '$opts_ss_netstat'"
            ;;
    esac
}

#===============================================================

# url filename
update_domain_list() {
    command_required 'curl'

    local url="$1" filename="$2"

    local data # &#22768;&#26126;&#21644;&#36171;&#20540;&#24517;&#39035;&#20998;&#24320;&#65292;&#19981;&#28982;&#38169;&#35823;&#30721;&#20250;&#20002;&#22833;
    data="$(set -o pipefail; curl -4fsSkL "$url" | grep -v -e '^[[:space:]]*$' -e '^[[:space:]]*#')" ||
        log_error "download failed: $url (exit-code: $?)"

    if head -n1 <<<"$data" | grep -q /; then
        # server=/&#22495;&#21517;&#21518;&#32512;/dns_ip
        echo "$data" | awk -F/ '{print $2}' | sort | uniq >$filename
    else
        # &#32431;&#22495;&#21517;&#21518;&#32512;
        echo "$data" | sort | uniq >$filename
    fi
}

update_gfwlist() {
    update_domain_list "$url_gfwlist" gfwlist.txt
}

update_chnlist() {
    update_domain_list "$url_chnlist" chnlist.txt
}

update_chnroute() {
    command_required 'curl'

    local data # &#22768;&#26126;&#21644;&#36171;&#20540;&#24517;&#39035;&#20998;&#24320;&#65292;&#19981;&#28982;&#38169;&#35823;&#30721;&#20250;&#20002;&#22833;
    data="$(set -o pipefail; curl -4fsSkL "$url_chnroute" | grep CN)" ||
        log_error "download failed: $url_chnroute (exit-code: $?)"

    awk -F'|' '/ipv4/ {printf("%s/%d\n", $4, 32-log($5)/log(2))}' <<<"$data" >chnroute.txt
    awk -F'|' '/ipv6/ {printf("%s/%d\n", $4, $5)}' <<<"$data" >chnroute6.txt
}

#===============================================================

# direct/remote "server1 server2 ..."
get_chinadns_upstream() {
    local opt use_tcp_dns

    if [ "$1" = direct ]; then
        opt='-c'
        use_tcp_dns=0
    else
        opt='-t'
        case "$dns_remote_tcp" in
            tcponly) ! is_enabled_udp && use_tcp_dns=1 || use_tcp_dns=0;;
            always) use_tcp_dns=1;;
            *) use_tcp_dns=0;;
        esac
    fi

    for upstream in $2; do
        if ((use_tcp_dns)) && ! str_find "$upstream" "://"; then
            upstream="tcp://$upstream"
        fi
        echo " $opt $upstream"
    done
}

start_chinadns() {
    local args=""

    if is_enabled_ipv6; then   
        args+=" -b ::"
    else
        args+=" -b 0.0.0.0"
    fi

    if [ "$chinadns_bind_port" ]; then
        args+=" -l $chinadns_bind_port"
    else
        args+=" -l $dns_mainport"
    fi

    is_enabled_ipv4 && args+="$(get_chinadns_upstream direct "$dns_direct")"
    is_enabled_ipv6 && args+="$(get_chinadns_upstream direct "$dns_direct6")"

    is_enabled_ipv4 && args+="$(get_chinadns_upstream remote "$dns_remote")"
    is_enabled_ipv6 && args+="$(get_chinadns_upstream remote "$dns_remote6")"

    args+=" --cache $chinadns_cache_size"
    args+=" --cache-stale $chinadns_cache_stale"
    args+=" --cache-refresh $chinadns_cache_refresh"
    args+=" --verdict-cache $chinadns_verdict_cache"

    [ "$chinadns_cache_db" ] && args+=" --cache-db $chinadns_cache_db"
    [ "$chinadns_verdict_db" ] && args+=" --verdict-cache-db $chinadns_verdict_db"

    for config in $chinadns_config_files; do
        args+=" -C $config"
    done

    [ "$chinadns_extra_options" ] && args+=" $chinadns_extra_options"

    is_true "$chinadns_verbose" && args+=' -v'

    if is_global_mode; then
        sstp_pid_chinadns=$(
            trap "" CHLD # &#36991;&#20813;bash&#21464;&#20026;&#20725;&#23608;&#36827;&#31243;
            chinadns-ng \
            $args \
            -m <(list_ext_domain ignlist.ext) \
            -d gfw \
            -a sstp_white,sstp_white6 \
            </dev/null &>>$chinadns_logfile &
            echo $!
        )
    elif is_gfwlist_mode; then
        sstp_pid_chinadns=$(
            trap "" CHLD # &#36991;&#20813;bash&#21464;&#20026;&#20725;&#23608;&#36827;&#31243;
            chinadns-ng \
            $args \
            -g gfwlist.txt,<(list_ext_domain gfwlist.ext) \
            -d chn \
            -A sstp_black,sstp_black6 \
            </dev/null &>>$chinadns_logfile &
            echo $!
        )
    else # chnroute
        sstp_pid_chinadns=$(
            trap "" CHLD # &#36991;&#20813;bash&#21464;&#20026;&#20725;&#23608;&#36827;&#31243;
            chinadns-ng \
            $args \
            -m chnlist.txt,<(list_ext_domain ignlist.ext) \
            -g gfwlist.txt,<(list_ext_domain gfwlist.ext) \
            $(is_true "$chinadns_chnlist_first" && echo '-M') \
            -a sstp_white,sstp_white6 \
            -A sstp_black,sstp_black6 \
            -4 sstp_white -6 sstp_white6 \
            </dev/null &>>$chinadns_logfile &
            echo $!
        )
    fi
}

# dns: &#21024;&#38500;dns-cache
# verdict: &#21024;&#38500;verdict-cache
# &#26080;&#21442;&#25968;: &#21024;&#38500;dns-cache&#21644;verdict-cache
del_chinadns_cache() {
    if [ -z "$1" ] || [ "$1" = dns ]; then
        file_is_exists "$chinadns_cache_db" && rm "$chinadns_cache_db"
    fi
    if [ -z "$1" ] || [ "$1" = verdict ]; then
        file_is_exists "$chinadns_verdict_db" && rm "$chinadns_verdict_db"
    fi
}

#===============================================================

start_dnsserver() {
    if is_built_in_dns; then
        start_chinadns
    else
        call_func custom_dns_start
    fi
}

stop_dnsserver() {
    # &#20026;&#38450;&#27490;&#20462;&#25913;&#37197;&#32622;&#23548;&#33268;&#36827;&#31243;&#27531;&#30041;&#65292;&#27492;&#22788;&#19981;&#20570;&#21028;&#26029;

    kill_by_pid $sstp_pid_chinadns

    call_func custom_dns_stop
}

restart_dnsserver() {
    ss_tproxy_is_started || return 1
    stop_dnsserver
    start_dnsserver
    save_pidfile
    return 0
}

flush_dnscache() {
    # ss_tproxy_is_started || return

    if is_built_in_dns; then
        if ss_tproxy_is_started; then
            kill_by_pid $sstp_pid_chinadns
            del_chinadns_cache "$1"
            start_chinadns
            save_pidfile
        else
            del_chinadns_cache "$1"
        fi
    else
        call_func custom_dns_flush "$1"
    fi
}

#===============================================================

# 4/6 key=val
sysctl_all_iface() {
    for path in /proc/sys/net/ipv$1/conf/*; do
        sysctl -wq ${path#/proc/sys/}/$2
    done
}

set_kernel_param() {
    # &#20801;&#35768;ip&#36716;&#21457;&#65292;&#20805;&#24403;&#32593;&#20851;
    is_enabled_ipv4 && sysctl -wq net.ipv4.ip_forward=1
    is_enabled_ipv6 && sysctl_all_iface 6 forwarding=1

    # &#20801;&#35768;&#36335;&#30001;loopback&#22320;&#22336;&#65292;&#22914;&#26524;&#19981;&#24320;&#21551;&#65292;&#22806;&#37096;&#25968;&#25454;&#21253;&#23558;&#26080;&#27861;dnat&#33267;127.0.0.1
    sysctl_all_iface 4 route_localnet=1

    # &#31105;&#27490;&#21457;&#36865;icmp&#37325;&#23450;&#21521;&#21253;&#65292;&#38450;&#27490;&#20869;&#32593;&#26426;&#22312;ping&#30340;&#26102;&#20505;&#25910;&#21040;&#37325;&#23450;&#21521;&#28040;&#24687;("&#26049;&#36335;&#30001;"&#25299;&#25169;)
    sysctl_all_iface 4 send_redirects=0
}

#===============================================================

# &#22833;&#36133;&#20063;&#19981;&#36864;&#20986;&#65292;&#36991;&#20813;&#36923;&#36753;&#25191;&#34892;&#19981;&#23436;&#25972;
start_proxyproc() {
    eval "$proxy_startcmd"
}

stop_proxyproc() {
    eval "$proxy_stopcmd"
}

restart_proxyproc() {
    ss_tproxy_is_started || return 1
    stop_proxyproc
    start_proxyproc
    return 0
}

#===============================================================

# setname <ip_list
init_ipset() {
    ipset create $1 hash:net family $(str_find $1 6 && echo inet6 || echo inet)
    sed "s/^/add $1 /" | ipset -! restore
}

# [proto://][host@]ip[#port][path]
get_upstream_ip() {
    local upstream="$1"
    upstream="${upstream##*://}"
    upstream="${upstream##*@}"
    upstream="${upstream%%/*}"
    upstream="${upstream%%#*}"
    echo "$upstream"
}

# prefix "true/false/ip..." "upstreams..."
get_ext_ip() {
    case "$2" in
        true) for u in $3; do echo "$1$(get_upstream_ip "$u")"; done;;
        false) ;;
        *) for ip in $2; do echo "$1$ip"; done;;
    esac
}

get_ext_whiteip() {
    if is_built_in_dns; then
        get_ext_ip '-' "$dns_direct_white" "$dns_direct"
        get_ext_ip '~' "$dns_direct6_white" "$dns_direct6"
    else
        call_func custom_dns_whiteip
    fi
}

get_ext_blackip() {
    if is_built_in_dns; then
        get_ext_ip '-' "$dns_remote_black" "$dns_remote"
        get_ext_ip '~' "$dns_remote6_black" "$dns_remote6"
    else
        call_func custom_dns_blackip
    fi
}

# dns&#21644;iptables&#37117;&#38656;&#35201;ipset&#65292;&#20026;&#38450;&#27490;dns&#32452;&#20214;&#25253;&#38169;(A/AAAA)&#65292;v4&#21644;v6&#38598;&#21512;&#23558;&#22987;&#32456;&#21019;&#24314;
start_ipset() {
    if is_global_mode; then
        { list_ext_ipv4 ignlist.ext; get_ext_whiteip | list_ext_ipv4 -; } | init_ipset sstp_white
        { list_ext_ipv6 ignlist.ext; get_ext_whiteip | list_ext_ipv6 -; } | init_ipset sstp_white6
    elif is_gfwlist_mode; then
        { list_ext_ipv4 gfwlist.ext; get_ext_blackip | list_ext_ipv4 -; } | init_ipset sstp_black
        { list_ext_ipv6 gfwlist.ext; get_ext_blackip | list_ext_ipv6 -; } | init_ipset sstp_black6
    elif is_chnroute_mode; then
        { list_ext_ipv4 ignlist.ext; get_ext_whiteip | list_ext_ipv4 -; cat chnroute.txt;  } | init_ipset sstp_white
        { list_ext_ipv6 ignlist.ext; get_ext_whiteip | list_ext_ipv6 -; cat chnroute6.txt; } | init_ipset sstp_white6
        { list_ext_ipv4 gfwlist.ext; get_ext_blackip | list_ext_ipv4 -; } | init_ipset sstp_black
        { list_ext_ipv6 gfwlist.ext; get_ext_blackip | list_ext_ipv6 -; } | init_ipset sstp_black6
    fi
}

# stop&#23601;&#28165;&#31354;&#65292;&#22914;&#26524;&#21482;&#26159;&#25442;&#33410;&#28857;&#25110;&#37325;&#21551;&#20195;&#29702;&#65292;&#19981;&#35201;&#36890;&#36807;ss-tproxy&#36827;&#34892;&#65292;&#35831;&#30452;&#25509;&#25805;&#20316;&#20195;&#29702;&#36827;&#31243;
flush_ipset() {
    for setname in $(ipset -n list | grep '^sstp_'); do
        # https://github.com/zfl9/ss-tproxy/issues/234
        while ! ipset destroy $setname &>/dev/null; do
            sleep 0.02
        done
    done
}

#===============================================================

_start_iproute() {
    local family="$1"

    # &#23558;&#25968;&#25454;&#21253;&#36335;&#30001;&#33267;&#26412;&#22320;
    # &#20869;&#32593;&#36807;&#26469;&#30340;&#21253;: prerouting -> routing -> input(lo)
    # &#26412;&#26426;&#21457;&#20986;&#30340;&#21253;: output -> routing -> postrouting(lo) -> prerouting(lo) -> routing -> input(lo)
    ip $family route add local default dev $ipts_if_lo table $ipts_rt_tab

    # https://github.com/zfl9/ss-tproxy/pull/186
    # https://man7.org/linux/man-pages/man8/ip-rule.8.html
    # https://man7.org/linux/man-pages/man7/rtnetlink.7.html
    # https://stackoverflow.com/questions/10259266/what-does-proto-kernel-means-in-unix-routing-table
    if ip rule help 2>&1 | grep -Fwq protocol; then
        ip $family rule add fwmark $ipts_rt_mark table $ipts_rt_tab protocol static
    else
        ip $family rule add fwmark $ipts_rt_mark table $ipts_rt_tab
    fi
}

start_iproute() {
    ! is_need_iproute && return

    is_enabled_ipv4 && _start_iproute -4
    is_enabled_ipv6 && _start_iproute -6
}

_flush_iproute() {
    while ip $1 rule del table $ipts_rt_tab &>/dev/null; do true; done
    ip $1 route flush table $ipts_rt_tab &>/dev/null
}

flush_iproute() {
    # &#19981;&#20570;&#21028;&#26029;&#65292;&#38450;&#27490;&#30456;&#20851;&#37197;&#32622;&#25913;&#21160;&#23548;&#33268;&#27531;&#30041;
    _flush_iproute -4
    _flush_iproute -6
}

#===============================================================

start_iptables_pre() {
    $1 -t mangle -N SSTP_PREROUTING
    $1 -t mangle -N SSTP_OUTPUT

    $1 -t nat    -N SSTP_PREROUTING
    $1 -t nat    -N SSTP_OUTPUT
    $1 -t nat    -N SSTP_POSTROUTING
}

start_iptables_post() {
    $1 -t mangle -A PREROUTING  -j SSTP_PREROUTING
    $1 -t mangle -A OUTPUT      -j SSTP_OUTPUT

    $1 -t nat    -A PREROUTING  -j SSTP_PREROUTING
    $1 -t nat    -A OUTPUT      -j SSTP_OUTPUT
    $1 -t nat    -A POSTROUTING -j SSTP_POSTROUTING
}

#===============================================================

# local loopback_addr loopback_addrx white_setname black_setname
init_iptables_param() {
    if is_ipv4_ipts $1; then
        loopback_addr="127.0.0.1"
        loopback_addrx="127.0.0.1"
        white_setname="sstp_white"
        black_setname="sstp_black"
    else
        loopback_addr="::1"
        loopback_addrx="[::1]"
        white_setname="sstp_white6"
        black_setname="sstp_black6"
    fi
}

get_dst_port_match() {
    [ "$ipts_proxy_dst_port" ] &&
        echo "-m multiport --dports $ipts_proxy_dst_port"
}

#===============================================================

# $ipts tproxy/dnat
# tproxy: mangle&#34920; (tcp,udp)
# dnat:   nat&#34920;    (tcp)
# &#36827;&#20837;SSTP_RULE&#30340;&#24517;&#39035;&#26159;"&#26032;&#36830;&#25509;&#30340;&#39318;&#21253;"
create_sstp_rule() {
    local table action

    if [ "$2" = 'tproxy' ]; then
        table=mangle
        action="-j CONNMARK --set-mark $ipts_rt_mark" # &#29992;&#26469;&#20445;&#23384;ipset&#21028;&#23450;&#32467;&#26524;(&#27599;&#20010;"&#36830;&#25509;"&#21482;&#21028;&#23450;&#19968;&#27425;)
    else
        table=nat
        action="-p tcp -j DNAT --to-destination $loopback_addrx:$proxy_tcpport" # nat&#30340;&#25805;&#20316;&#21333;&#20301;&#26159;"&#36830;&#25509;"
    fi

    $1 -t $table -N SSTP_RULE

    if is_global_mode; then
        $1 -t $table -A SSTP_RULE \
            -m set ! --match-set $white_setname dst \
            $action
    elif is_gfwlist_mode; then
        $1 -t $table -A SSTP_RULE \
            -m set --match-set $black_setname dst \
            $action
    elif is_chnroute_mode; then
        # &#25918;&#34892;&#30333;&#21517;&#21333;ip (&#33509;&#35813;ip&#21516;&#26102;&#20063;&#20301;&#20110;&#40657;&#21517;&#21333;&#65292;&#21017;&#19981;&#25918;&#34892;)
        $1 -t $table -A SSTP_RULE \
            -m set --match-set $white_setname dst \
            -m set ! --match-set $black_setname dst \
            -j RETURN
        $1 -t $table -A SSTP_RULE \
            $action
    fi
}

# mangle&#34920; OUTPUT/PREROUTING -p udp --dport 443
drop_quic() {
    $1 -t mangle -N SSTP_QUIC

    if is_global_mode; then
        $1 -t mangle -A SSTP_QUIC \
            -m set ! --match-set $white_setname dst \
            -j DROP
    elif is_gfwlist_mode; then
        $1 -t mangle -A SSTP_QUIC \
            -m set --match-set $black_setname dst \
            -j DROP
    elif is_chnroute_mode; then
        # &#25918;&#34892;&#30333;&#21517;&#21333;ip (&#33509;&#35813;ip&#21516;&#26102;&#20063;&#20301;&#20110;&#40657;&#21517;&#21333;&#65292;&#21017;&#19981;&#25918;&#34892;)
        $1 -t mangle -A SSTP_QUIC \
            -m set --match-set $white_setname dst \
            -m set ! --match-set $black_setname dst \
            -j RETURN
        $1 -t mangle -A SSTP_QUIC \
            -j DROP
    fi

    $1 -t mangle -A SSTP_OUTPUT \
        -p udp \
        -m udp --dport 443 \
        -m conntrack --ctdir ORIGINAL \
        -m addrtype ! --dst-type LOCAL \
        -m owner ! --gid-owner $proxy_procgroup \
        -j SSTP_QUIC

    is_proxy_other &&
        $1 -t mangle -A SSTP_PREROUTING \
            -p udp \
            -m udp --dport 443 \
            -m conntrack --ctdir ORIGINAL \
            -m addrtype ! --dst-type LOCAL \
            -j SSTP_QUIC
}

#===============================================================

# mangle&#34920; OUTPUT/PREROUTING
do_proxy_tproxy() {
    local tcp=$(is_tcp_tproxy && echo 1 || echo 0)
    local udp=$(is_enabled_udp && echo 1 || echo 0)

    create_sstp_rule $1 tproxy

    # &#25918;&#34892;&#21457;&#24448;&#26412;&#26426;&#30340;&#27969;&#37327;
    $1 -t mangle -A SSTP_OUTPUT \
        -m addrtype --dst-type LOCAL \
        -j RETURN

    # &#25918;&#34892;reply&#27969;&#37327;&#65292;&#21482;&#22788;&#29702;original&#26041;&#21521;
    $1 -t mangle -A SSTP_OUTPUT \
        -m conntrack --ctdir REPLY \
        -j RETURN

    # &#25918;&#34892;&#26412;&#26426;&#20195;&#29702;&#36827;&#31243;&#20256;&#20986;&#30340;&#27969;&#37327;
    $1 -t mangle -A SSTP_OUTPUT \
        -m owner --gid-owner $proxy_procgroup \
        -j RETURN

    # &#25918;&#34892;&#26412;&#26426;&#21457;&#20986;&#30340;dns&#35831;&#27714;&#65292;&#30041;&#32473;nat&#21435;&#37325;&#23450;&#21521;
    ((tcp)) &&
        $1 -t mangle -A SSTP_OUTPUT \
            -p tcp \
            -m tcp --dport 53 \
            -m owner ! --gid-owner $dns_procgroup \
            -j RETURN
    ((udp)) &&
        $1 -t mangle -A SSTP_OUTPUT \
            -p udp \
            -m udp --dport 53 \
            -m owner ! --gid-owner $dns_procgroup \
            -j RETURN

    # &#26412;&#26426;&#20256;&#20986;&#27969;&#37327; => SSTP_RULE
    ((tcp)) &&
        $1 -t mangle -A SSTP_OUTPUT \
            -p tcp \
            -m tcp --syn \
            $(get_dst_port_match) \
            -j SSTP_RULE
    ((udp)) &&
        $1 -t mangle -A SSTP_OUTPUT \
            -p udp \
            -m conntrack --ctstate NEW,RELATED \
            $(get_dst_port_match) \
            -j SSTP_RULE

    # &#25171;mark&#26159;&#20026;&#20102;&#23558;&#21253;&#36335;&#30001;&#21040;&#26412;&#22320;&#65292;&#36827;&#20837;prerouting
    $1 -t mangle -A SSTP_OUTPUT \
        -m connmark --mark $ipts_rt_mark \
        -j MARK --set-mark $ipts_rt_mark

    ###################### prerouting ######################

    # &#25918;&#34892;&#21457;&#24448;&#26412;&#26426;&#30340;&#27969;&#37327;
    $1 -t mangle -A SSTP_PREROUTING \
        -m addrtype --dst-type LOCAL \
        -j RETURN

    # &#25918;&#34892;reply&#27969;&#37327;&#65292;&#21482;&#22788;&#29702;original&#26041;&#21521;
    $1 -t mangle -A SSTP_PREROUTING \
        -m conntrack --ctdir REPLY \
        -j RETURN

    # &#20869;&#32593;&#20256;&#20986;&#27969;&#37327; => SSTP_RULE
    if is_proxy_other; then
        ((tcp)) &&
            $1 -t mangle -A SSTP_PREROUTING \
                -p tcp \
                -m tcp --syn ! --dport 53 \
                -m addrtype ! --src-type LOCAL \
                $(get_dst_port_match) \
                -j SSTP_RULE
        ((udp)) &&
            $1 -t mangle -A SSTP_PREROUTING \
                -p udp \
                -m udp ! --dport 53 \
                -m conntrack --ctstate NEW,RELATED \
                -m addrtype ! --src-type LOCAL \
                $(get_dst_port_match) \
                -j SSTP_RULE
    fi

    # &#26412;&#26426;&#21457;&#20986;&#30340;/&#20869;&#32593;&#36807;&#26469;&#30340;skb => &#20195;&#29702;&#36827;&#31243;
    ((tcp)) &&
        $1 -t mangle -A SSTP_PREROUTING \
            -p tcp \
            -m connmark --mark $ipts_rt_mark \
            -j TPROXY --on-ip $loopback_addr --on-port $proxy_tcpport --tproxy-mark $ipts_rt_mark
    ((udp)) &&
        $1 -t mangle -A SSTP_PREROUTING \
            -p udp \
            -m connmark --mark $ipts_rt_mark \
            -j TPROXY --on-ip $loopback_addr --on-port $proxy_udpport --tproxy-mark $ipts_rt_mark
}

# nat&#34920; OUTPUT/PREROUTING -p tcp
do_proxy_dnat() {
    create_sstp_rule $1 dnat

    # &#26412;&#26426;&#20256;&#20986;&#27969;&#37327; => SSTP_RULE
    $1 -t nat -A SSTP_OUTPUT \
        -p tcp \
        -m tcp --syn \
        -m addrtype ! --dst-type LOCAL \
        $(get_dst_port_match) \
        -m owner ! --gid-owner $proxy_procgroup \
        -j SSTP_RULE

    # &#20869;&#32593;&#20256;&#20986;&#27969;&#37327; => SSTP_RULE
    is_proxy_other &&
        $1 -t nat -A SSTP_PREROUTING \
            -p tcp \
            -m tcp --syn \
            -m addrtype ! --src-type LOCAL ! --dst-type LOCAL \
            $(get_dst_port_match) \
            -j SSTP_RULE
}

#===============================================================

# nat&#34920; OUTPUT/PREROUTING -p tcp,udp
redir_dns_request() {
    # &#26412;&#26426;&#21457;&#20986;&#30340;dns&#35831;&#27714; (dnat)
    $1 -t nat -A SSTP_OUTPUT \
        -p tcp \
        -m tcp --dport 53 --syn \
        -m owner ! --gid-owner $proxy_procgroup \
        -m owner ! --gid-owner $dns_procgroup \
        -j REDIRECT --to-ports $dns_mainport
    $1 -t nat -A SSTP_OUTPUT \
        -p udp \
        -m udp --dport 53 \
        -m conntrack --ctstate NEW \
        -m owner ! --gid-owner $proxy_procgroup \
        -m owner ! --gid-owner $dns_procgroup \
        -j REDIRECT --to-ports $dns_mainport

    # &#26412;&#26426;&#21457;&#20986;&#30340;dns&#35831;&#27714; (snat)
    $1 -t nat -A SSTP_POSTROUTING \
        -d $loopback_addr \
        ! -s $loopback_addr \
        -j SNAT --to-source $loopback_addr

    # &#20854;&#20182;&#20027;&#26426;&#21457;&#26469;&#30340;dns&#35831;&#27714;
    is_proxy_other &&
        $1 -t nat -A SSTP_PREROUTING \
            -p tcp \
            -m tcp --dport 53 --syn \
            -m addrtype ! --src-type LOCAL \
            -j REDIRECT --to-ports $dns_mainport
    is_proxy_other &&
        $1 -t nat -A SSTP_PREROUTING \
            -p udp \
            -m udp --dport 53 \
            -m conntrack --ctstate NEW \
            -m addrtype ! --src-type LOCAL \
            -j REDIRECT --to-ports $dns_mainport
}

#===============================================================

start_iptables_tproxy() {
    # &#22788;&#29702;dns(tcp+udp) nat&#34920;
    redir_dns_request $1

    # &#22788;&#29702;tcp/udp mangle&#34920;
    do_proxy_tproxy $1
}

start_iptables_redirect() {
    # &#22788;&#29702;dns(tcp+udp) nat&#34920;
    redir_dns_request $1

    # &#22788;&#29702;tcp nat&#34920;
    do_proxy_dnat $1

    # &#22788;&#29702;udp mangle&#34920;
    if is_enabled_udp; then
        do_proxy_tproxy $1
    fi
}

_start_iptables() {
    start_iptables_pre $1

    local loopback_addr loopback_addrx white_setname black_setname
    init_iptables_param $1

    if is_drop_quic; then
        drop_quic $1
    fi

    if is_tcp_tproxy; then
        start_iptables_tproxy $1
    else
        start_iptables_redirect $1
    fi

    if is_proxy_other; then
        add_snat_rule $1
    fi

    start_iptables_post $1
}

start_iptables() {
    is_enabled_ipv4 && _start_iptables "iptables"
    is_enabled_ipv6 && _start_iptables "ip6tables"
}

#===============================================================

_delete_unused_chain() {
    local list=(
        mangle PREROUTING
        mangle OUTPUT
        nat PREROUTING
        nat OUTPUT
        nat POSTROUTING
    )
    for ((i = 0; i < ${#list[@]}; i += 2)); do
        local table="${list[i]}" chain="${list[i+1]}"
        if chain_is_empty $1 $table SSTP_$chain; then
            $1 -t $table -D $chain -j SSTP_$chain
            $1 -t $table -X SSTP_$chain
        fi
    done
}

delete_unused_chain() {
    is_enabled_ipv4 && _delete_unused_chain "iptables"
    is_enabled_ipv6 && _delete_unused_chain "ip6tables"
}

#===============================================================

_flush_iptables() {
    $1 -t mangle -D PREROUTING  -j SSTP_PREROUTING  &>/dev/null
    $1 -t mangle -D OUTPUT      -j SSTP_OUTPUT      &>/dev/null

    $1 -t nat    -D PREROUTING  -j SSTP_PREROUTING  &>/dev/null
    $1 -t nat    -D OUTPUT      -j SSTP_OUTPUT      &>/dev/null
    $1 -t nat    -D POSTROUTING -j SSTP_POSTROUTING &>/dev/null

    for table in mangle nat; do
        local chain_list=$($1 -t $table -S 2>/dev/null | grep '^-N SSTP_' | awk '{print $2}')
        for chain in $chain_list; do
            $1 -t $table -F $chain
        done
        for chain in $chain_list; do
            $1 -t $table -X $chain
        done
    done
}

flush_iptables() {
    # &#19981;&#20570;&#21028;&#26029;&#65292;&#38450;&#27490;&#30456;&#20851;&#37197;&#32622;&#25913;&#21160;&#23548;&#33268;&#27531;&#30041;
    _flush_iptables "iptables"
    _flush_iptables "ip6tables"
}

#===============================================================

_show_iptables() {
    echo "$(color_green "==> $1-mangle <==")"
    $1 -t mangle -S
    echo
    echo "$(color_green "==> $1-nat <==")"
    $1 -t nat -S
}

show_iptables() {
    is_enabled_ipv4 && _show_iptables "iptables"
    { is_enabled_ipv4 && is_enabled_ipv6; } && echo
    is_enabled_ipv6 && _show_iptables "ip6tables"
}

#===============================================================

# stop&#21518;&#65292;dns&#36827;&#31243;&#26410;&#36816;&#34892;&#65292;&#20026;&#20445;&#35777;&#20869;&#32593;&#26426;&#22120;&#27491;&#24120;&#19978;&#32593;&#65292;&#38656;&#35201;&#37325;&#23450;&#21521;dns&#35831;&#27714;&#33267;&#30452;&#36830;dns
add_reddns_rule() {
    local direct_dns_ip direct_dns_ipx direct_dns_port

    if is_ipv4_ipts $1; then
        [ -z "$ipts_reddns_onstop" ] && return
        direct_dns_ip="$(get_ip_from_addr "$ipts_reddns_onstop")"
        direct_dns_ipx="$direct_dns_ip"
        direct_dns_port="$(get_port_from_addr "$ipts_reddns_onstop")"
    else
        [ -z "$ipts_reddns6_onstop" ] && return
        direct_dns_ip="$(get_ip_from_addr "$ipts_reddns6_onstop")"
        direct_dns_ipx="[$direct_dns_ip]"
        direct_dns_port="$(get_port_from_addr "$ipts_reddns6_onstop")"
    fi

    $1 -t nat -N SSTP_PREROUTING  &>/dev/null
    $1 -t nat -N SSTP_POSTROUTING &>/dev/null

    $1 -t nat -A SSTP_PREROUTING \
        -p tcp \
        -m tcp --dport 53 \
        -m addrtype ! --src-type LOCAL --dst-type LOCAL \
        -j DNAT --to-destination $direct_dns_ipx:$direct_dns_port
    $1 -t nat -A SSTP_PREROUTING \
        -p udp \
        -m udp --dport 53 \
        -m addrtype ! --src-type LOCAL --dst-type LOCAL \
        -j DNAT --to-destination $direct_dns_ipx:$direct_dns_port

    $1 -t nat -A SSTP_POSTROUTING \
        -d $direct_dns_ip \
        -p tcp \
        -m tcp --dport $direct_dns_port \
        -m addrtype ! --src-type LOCAL \
        -j MASQUERADE
    $1 -t nat -A SSTP_POSTROUTING \
        -d $direct_dns_ip \
        -p udp \
        -m udp --dport $direct_dns_port \
        -m addrtype ! --src-type LOCAL \
        -j MASQUERADE
}

# start&#21644;stop&#21518;&#37117;&#21487;&#33021;&#38656;&#35201;&#65292;&#21462;&#20915;&#20110;ss-tproxy.conf&#37197;&#32622;
add_snat_rule() {
    if is_ipv4_ipts $1; then
        is_false "$ipts_set_snat" && return
    else
        is_false "$ipts_set_snat6" && return
    fi

    $1 -t nat -N SSTP_POSTROUTING &>/dev/null

    # &#25490;&#38500;dmz/&#31471;&#21475;&#26144;&#23556;(&#22806;&#32593;->&#20869;&#32593;)&#65292;&#21482;&#21305;&#37197;"&#20869;&#32593;->&#22806;&#32593;"&#36830;&#25509;
    $1 -t nat -A SSTP_POSTROUTING \
        -m owner ! --socket-exists \
        -m conntrack --ctstate NEW,RELATED --ctdir ORIGINAL \
        -m conntrack ! --ctstate SNAT,DNAT \
        -j MASQUERADE
}

# $ipts table &#39044;&#23450;&#20041;&#38142;
add_sstp_chain() {
    local table="$2" chain="$3"
    if chain_is_exists $1 $table SSTP_$chain; then
        $1 -t $table -A $chain -j SSTP_$chain
    fi
}

_add_stoprule() {
    add_reddns_rule $1
    add_snat_rule $1

    add_sstp_chain $1 nat PREROUTING
    add_sstp_chain $1 nat POSTROUTING
}

# &#20869;&#32593;dns&#37325;&#23450;&#21521;&#12289;&#35774;&#32622;snat&#35268;&#21017;
add_stoprule() {
    ! is_proxy_other && return

    is_enabled_ipv4 && _add_stoprule "iptables"
    is_enabled_ipv6 && _add_stoprule "ip6tables"
}

flush_stoprule() {
    ss_tproxy_is_started && return

    flush_iptables
}

check_resolv_conf() {
    ss_tproxy_is_started || return

    local ipv4_dns="$(awk 'BEGIN {ORS=" "} $1 == "nameserver" && $2 ~ /\./ {print "`" $2 "`"}' /etc/resolv.conf)"
    local ipv6_dns="$(awk 'BEGIN {ORS=" "} $1 == "nameserver" && $2 ~ /:/ {print "`" $2 "`"}' /etc/resolv.conf)"

    if ! is_enabled_ipv4 && [ "$ipv4_dns" ]; then
        echo "$(color_red "[warning]") found ipv4-dns ${ipv4_dns}but ipv4='false'"
        echo "$(color_red "[warning]") please consider removing it from /etc/resolv.conf"
    elif ! is_enabled_ipv6 && [ "$ipv6_dns" ]; then
        echo "$(color_red "[warning]") found ipv6-dns ${ipv6_dns}but ipv6='false'"
        echo "$(color_red "[warning]") please consider removing it from /etc/resolv.conf"
    fi
}

#===============================================================

start() {
    ss_tproxy_is_started && { stop; status; echo; }

    # &#28165;&#31354;&#24182;&#21024;&#38500;sstp_*&#35268;&#21017;&#65292;&#22914;stoprule
    flush_iptables

    call_func pre_start

    set_kernel_param
    start_ipset # &#20808;&#21019;&#24314;ipset&#65292;&#22240;&#20026;dns&#36827;&#31243;&#38656;&#35201;
    start_proxyproc
    start_dnsserver
    start_iproute
    start_iptables

    call_func post_start

    # post_start&#21518;&#20877;&#20445;&#23384;pid&#31561;&#36816;&#34892;&#26102;&#29366;&#24577;&#21040;&#25991;&#20214;
    save_pidfile

    # post_start&#21487;&#33021;&#20250;&#28155;&#21152;&#35268;&#21017;&#21040;sstp_*&#65292;&#25152;&#20197;&#25918;&#21040;&#21518;&#38754;
    delete_unused_chain
}

stop() {
    call_func pre_stop

    # &#19982;start&#39034;&#24207;&#30456;&#21453;
    delete_pidfile
    flush_iptables
    flush_iproute
    stop_dnsserver
    stop_proxyproc
    flush_ipset

    # &#20869;&#32593;dns&#37325;&#23450;&#21521;&#12289;&#35774;&#32622;snat&#35268;&#21017;
    add_stoprule

    call_func post_stop
}

# name func args...
_status() {
    local name="$1" func="$2"
    shift 2
    if $func "$@"; then
        echo -e "$name:\t$(color_green '[running]')"
    else
        echo -e "$name:\t$(color_red '[stopped]')"
    fi
}

status() {
    echo -e "mode:\t\t$(font_bold $mode)"

    _status "proxy/tcp" tcp_port_is_exists $proxy_tcpport
    is_enabled_udp && _status "proxy/udp" udp_port_is_exists $proxy_udpport

    if is_built_in_dns; then
        _status "chinadns" process_is_running $sstp_pid_chinadns
    else
        call_func custom_dns_status
    fi

    call_func extra_status

    check_resolv_conf
}

#===============================================================

version() {
    echo "ss-tproxy v4.8.3 (2024-07-24)"
}

help() {
    cat <<EOF
Usage: ss-tproxy <COMMAND> ... [-x] [-d basedir] [-c config] [name=value ...]
COMMAND := {
    start               start ss-tproxy
    stop                stop ss-tproxy
    restart             restart ss-tproxy
    restart-proxy       restart proxy program
    restart-dns         restart dns program
    status              status of ss-tproxy
    show-iptables       show iptables rules
    flush-stoprule      flush stop rules
    flush-dnscache      flush dns cache
    update-gfwlist      update gfwlist.txt
    update-chnlist      update chnlist.txt
    update-chnroute     update chnroute.txt
    set-proxy-group     set group for executable
    set-dns-group       set group for executable
    version             show version and exit
    help                show help and exit
}
Specify the -x option to debug script
Specify the -d option to use given base dir
Specify the -c option to use given ss-tproxy.conf
Specify the name=value to override ss-tproxy config
Issues or bug report: https://github.com/zfl9/ss-tproxy
See https://github.com/zfl9/ss-tproxy/wiki for more details
EOF
}

#===============================================================

main() {
    local argv=("$@")
    local arg_list=() #&#25152;&#26377;&#20301;&#32622;&#21442;&#25968; &#20250;&#20256;&#32473;ss-tproxy.conf
    local override_list=() #&#35206;&#30422;ss-tproxy.conf&#20013;&#30340;&#21516;&#21517;&#37197;&#32622;

    for ((i = 0; i < ${#argv[@]}; ++i)); do
        local arg="${argv[i]}"
        case "$arg" in
            -x) set -x;;
            -d) base_dir="${argv[++i]}";;
            -c) config_file="${argv[++i]}";;
            -*) echo "$(color_yellow "Unknown option: $arg")"; help; return 1;;
            *=*) override_list+=("$arg");;
            *) arg_list+=("$arg");;
        esac
    done

    if [ "${#arg_list[@]}" -eq 0 ]; then
        help
        return 0
    fi

    [ "$base_dir" ] ||
        log_error "-d is specified, but no argument is given"

    [ "$config_file" ] ||
        log_error "-c is specified, but no argument is given"

    cd -- "$base_dir" ||
        log_error "base directory not exists: $base_dir"

    # &#20808;&#21152;&#36733;ss-tproxy.conf
    load_config

    # &#21152;&#36733;&#19978;&#27425;start&#26102;&#35760;&#24405;&#30340;&#29366;&#24577;&#65292;&#22914;dns&#36827;&#31243;pid
    load_pidfile

    case "${arg_list[0]}" in
        start)           start; status;;
        stop)            stop; status;;
        restart-p*)      restart_proxyproc && status;;
        restart-d*)      restart_dnsserver && status;;
        r*)              stop; status; echo; start; status;;
        stat*)           status;;
        show*)           show_iptables;;
        flush-stop*)     flush_stoprule;;
        flush-dns*)      flush_dnscache "${arg_list[1]}";;
        update-gfwlist)  update_gfwlist;;
        update-chnlist)  update_chnlist;;
        update-chnroute) update_chnroute;;
        set-proxy-group) set_proxy_group "${arg_list[1]}";;
        set-dns-group)   set_dns_group "${arg_list[1]}";;
        v*)              version;;
        h*)              help;;
        *)               echo "$(color_yellow "Unknown command: ${arg_list[0]}")"; help; return 1;;
    esac

    return 0
}

main "$@"