#!/bin/sh
#copyright by hiboy
[ -f /tmp/script.lock ] && exit 0
touch /tmp/script.lock
### 创建子程序脚本【https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/4script_script.sh】
cat > "/tmp/sh_wifi_dog.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

IPT=/bin/iptables
WD_DIR="/usr/bin"
SVC_PATH=$WD_DIR/wifidog
if [ ! -f "$SVC_PATH" ] ; then
	WD_DIR="/opt/bin"
fi
#开关
wifidog_enable=`nvram get wifidog_enable`
wifidog_Daemon=`nvram get wifidog_Daemon`


#认证服务器
wifidog_Hostname=`nvram get wifidog_Hostname`
wifidog_HTTPPort=`nvram get wifidog_HTTPPort`
[ -z $wifidog_HTTPPort ] && wifidog_HTTPPort="80" && nvram set wifidog_HTTPPort=$wifidog_HTTPPort
wifidog_Path=`nvram get wifidog_Path`
[ -z $wifidog_Path ] && wifidog_Path="/" && nvram set wifidog_Path=$wifidog_Path

#高级设置
wifidog_id=`nvram get wifidog_id`
[ -z $wifidog_id ] && wifidog_id=$(/sbin/ifconfig br0  | sed -n '/HWaddr/ s/^.*HWaddr */HWADDR=/pg'  | awk -F"=" '{print $2}' |sed -n 's/://pg'| awk -F" " '{print $1}')  && nvram set wifidog_id=$wifidog_id
wifidog_lanif=`nvram get wifidog_lanif`
[ -z $wifidog_lanif ] && wifidog_lanif="br0" && nvram set wifidog_lanif=$wifidog_lanif
wifidog_wanif=`nvram get wifidog_wanif`
[ -z $wifidog_wanif ] && wifidog_wanif=$(nvram get wan0_ifname_t) && nvram set wifidog_wanif=$wifidog_wanif
wifidog_Port=`nvram get wifidog_Port`
[ -z $wifidog_Port ] && wifidog_Port="2060" && nvram set wifidog_Port=$wifidog_Port
wifidog_Interval=`nvram get wifidog_Interval`
[ -z $wifidog_Interval ] && wifidog_Interval="60" && nvram set wifidog_Interval=$wifidog_Interval
wifidog_Timeout=`nvram get wifidog_Timeout`
[ -z $wifidog_Timeout ] && wifidog_Timeout="5" && nvram set wifidog_Timeout=$wifidog_Timeout
wifidog_MaxConn=`nvram get wifidog_MaxConn`
[ -z $wifidog_MaxConn ] && wifidog_MaxConn="30" && nvram set wifidog_MaxConn=$wifidog_MaxConn
wifidog_MACList=`nvram get wifidog_MACList`
[ -z $wifidog_MACList ] && wifidog_MACList="00:00:DE:AD:BE:AF" && nvram set wifidog_MACList=$wifidog_MACList



start()
{
SVC_PATH=$WD_DIR/wifidog
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/wifidog"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【Wifidog】" "自动安装 wifidog 程序"
	# 找不到 wifidog，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【Wifidog】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/wifidog "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/wifidog"
		chmod 755 "/opt/bin/wifidog"
		wgetcurl.sh /opt/bin/wdctl "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/wdctl"
		chmod 755 "/opt/bin/wdctl"
	else
		logger -t "【Wifidog】" "找到 $SVC_PATH"
	fi
	SVC_PATH=/opt/bin/wifidog
fi

[ ! -s "$SVC_PATH" ] && {  logger -t "【Wifidog】" "找不到 $SVC_PATH, 需要手动安装 $SVC_PATH"; }

{
rm -f /etc/storage/wifidog.conf  
# 将数值赋给WiFiDog官方的配置参数			   
echo "
#WiFiDog 配置文件

#网关ID
GatewayID $wifidog_id

#内部网卡
GatewayInterface $wifidog_lanif

#外部网卡
ExternalInterface $wifidog_wanif 

#认证服务器
AuthServer {
Hostname $wifidog_Hostname
HTTPPort $wifidog_HTTPPort
Path $wifidog_Path
}

#守护进程
Daemon $wifidog_Daemon

#检查DNS状态(Check DNS health by querying IPs of these hosts)
PopularServers $wifidog_Hostname

#运行状态
HtmlMessageFile /www/wifidog-msg.html

#监听端口
GatewayPort $wifidog_Port

#心跳间隔时间
CheckInterval $wifidog_Interval

#心跳间隔次数
ClientTimeout $wifidog_Timeout

#HTTP最大连接数
HTTPDMaxConn $wifidog_MaxConn

#信任的MAC地址,加入信任列表将不用登录可访问
TrustedMACList $wifidog_MACList

#全局防火墙设置
FirewallRuleSet global {
FirewallRule allow tcp port 443
}

#新验证用户
FirewallRuleSet validating-users {
	FirewallRule allow to 0.0.0.0/0
}
#正常用户
FirewallRuleSet known-users {
	FirewallRule allow to 0.0.0.0/0
}

#未知用户
FirewallRuleSet unknown-users {
	FirewallRule allow udp port 53
	FirewallRule allow tcp port 53
	FirewallRule allow udp port 67
	FirewallRule allow tcp port 67
}

#锁住用户
FirewallRuleSet locked-users {
	FirewallRule block to 0.0.0.0/0
}
" >> /etc/storage/wifidog.conf
}
if [ "$wifidog_enable" = "1" ] ; then
	$WD_DIR/wifidog -c /etc/storage/wifidog.conf &
fi

	logger -t "【Wifidog】" "启动"
}

stop()
{
	logger -t "【Wifidog】" "关闭"
	echo "Stopping Wifidog ... "
	if $WD_DIR/wdctl status 2> /dev/null
	then
		if $WD_DIR/wdctl stop
		then
				echo "OK"
		else
				echo "FAILED:  wdctl stop exited with non 0 status"
		fi

	else
	   echo "FAILED:  Wifidog was not running"
	fi
}

status()
{
	$WD_DIR/wdctl status
}

case "$1" in
  start)
	start
	;;
  restart)
	stop
	sleep 2
	start
	;;
  reload)
	stop
	sleep 2
	start
	;;
  stop)
	stop
	;;
  status)
	status
	;;
  debug|test-module)
	### Test ipt_mark with iptables
	test_ipt_mark () {
	  IPTABLES_OK=$($IPT -A FORWARD -m mark --mark 2 -j ACCEPT 2>&1 | grep "No chain.target.match")
	  if [ -z "$IPTABLES_OK" ] ; then
		$IPT -D FORWARD -m mark --mark 2 -j ACCEPT 2>&1
		echo 1
	  else
		echo 0
	  fi
	}
	### Test ipt_mac with iptables
	test_ipt_mac () {
	  IPTABLES_OK=$($IPT -A INPUT -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT 2>&1 | grep "No chain.target.match")
	  if [ -z "$IPTABLES_OK" ] ; then
		$IPT -D INPUT -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT 2>&1
		echo 1
	  else
		echo 0
	  fi
	}

	### Test ipt_REDIRECT with iptables
	test_ipt_REDIRECT () {
	  IPTABLES_OK=$($IPT -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 2060 2>&1 | grep "No chain.target.match")
	  if [ -z "$IPTABLES_OK" ] ; then
		$IPT -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 2060 2>&1
		echo 1
	  else
		echo 0
	  fi
	}

	### Find a module on disk
	module_exists () {
	echo " Looking for a module on disk"
	  EXIST=$(find /lib/modules/`uname -r` -name $1.*o 2>/dev/null)
	  if [ -n "$EXIST" ] ; then
		echo 1
	  else
		echo 0
	  fi
	}

	### Test if a module is in memory
	module_in_memory () {
	  MODULE=$(lsmod | grep $1 | awk '{print $1}')
	  if [ "$MODULE" = "$1" ] ; then
		echo 1
	  else
		echo 0
	  fi
	}

	echo "Testing for iptables modules"

	echo "  Testing ipt_mac"
	TEST_IPT_MAC=$(test_ipt_mac)
	if [ "$TEST_IPT_MAC" = "0" ] ; then
	  echo "   iptables is not working with ipt_mac"
	  echo "   Scanning disk for ipt_mac module"
	  TEST_IPT_MAC_MODULE_EXISTS=$(module_exists "ipt_mac")
	  if [ "$TEST_IPT_MAC_MODULE_EXISTS" = "0" ] ; then
		echo "   ipt_mac module is missing, please install it (kernel or module)"
		exit
	  else
		echo "   ipt_mac module exists, trying to load"
		insmod ipt_mac > /dev/null
		TEST_IPT_MAC_MODULE_MEMORY=$(module_in_memory "ipt_mac")
		if [ "$TEST_IPT_MAC_MODULE_MEMORY" = "0" ] ; then
		  echo "  Error: ipt_mac not loaded"
		  exit
		else
		  echo "  ipt_mac loaded sucessfully"
		fi
	  fi
	else
	  echo "   ipt_mac  module is working"
	fi

	echo "  Testing ipt_mark"
	TEST_IPT_MARK=$(test_ipt_mark)
	if [ "$TEST_IPT_MARK" = "0" ] ; then
	  echo "   iptables is not working with ipt_mark"
	  echo "   Scanning disk for ipt_mark module"
	  TEST_IPT_MARK_MODULE_EXISTS=$(module_exists "ipt_mark")
	  if [ "$TEST_IPT_MARK_MODULE_EXISTS" = "0" ] ; then
		echo "   iptables ipt_mark module missing, please install it (kernel or module)"
		exit
	  else
		echo "   ipt_mark module exists, trying to load"
		insmod ipt_mark
		TEST_IPT_MARK_MODULE_MEMORY=$(module_in_memory "ipt_mark")
		if [ "$TEST_IPT_MARK_MODULE_MEMORY" = "0" ] ; then
		  echo "   Error: ipt_mark not loaded"
		  exit
		else
		  echo "   ipt_mark loaded sucessfully"
		fi
	  fi
	  else
	echo "   ipt_mark module is working"
	fi

##TODO:  This will not test if required iptables userspace (iptables-mod-nat on Kamikaze) is installed
	echo "  Testing ipt_REDIRECT"
	TEST_IPT_MAC=$(test_ipt_REDIRECT)
	if [ "$TEST_IPT_MAC" = "0" ] ; then
	  echo "   iptables is not working with ipt_REDIRECT"
	  echo "   Scanning disk for ipt_REDIRECT module"
	  TEST_IPT_MAC_MODULE_EXISTS=$(module_exists "ipt_REDIRECT")
	  if [ "$TEST_IPT_MAC_MODULE_EXISTS" = "0" ] ; then
		echo "   ipt_REDIRECT module is missing, please install it (kernel or module)"
		exit
	  else
		echo "   ipt_REDIRECT module exists, trying to load"
		insmod ipt_REDIRECT > /dev/null
		TEST_IPT_MAC_MODULE_MEMORY=$(module_in_memory "ipt_REDIRECT")
		if [ "$TEST_IPT_MAC_MODULE_MEMORY" = "0" ] ; then
		  echo "  Error: ipt_REDIRECT not loaded"
		  exit
		else
		  echo "  ipt_REDIRECT loaded sucessfully"
		fi
	  fi
	else
	  echo "   ipt_REDIRECT  module is working"
	fi

	;;

  *)
   echo "Usage: $0 {start|stop|restart|reload|status|test-module}"
A_restart=`nvram get wifidog_status`
B_restart="$wifidog_enable$wifidog_Daemon$wifidog_Hostname$wifidog_HTTPPort$wifidog_Path$wifidog_id$wifidog_lanif$wifidog_wanif$wifidog_Port$wifidog_Interval$wifidog_Timeout$wifidog_MaxConn$wifidog_MACList"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set wifidog_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi

if [ "$wifidog_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof wifidog`" ] && logger -t "【Wifidog】" "停止 wifidog"
$WD_DIR/wdctl stop
sleep 1
killall -9 wifidog wdctl
fi
if [ "$wifidog_enable" = "1" ] ; then
	port=$(iptables -t nat -L PREROUTING | grep 'Outgoing' | wc -l)
	if [ "$port" = 0 ] ; then
		logger -t "【Wifidog】" "检测:找不到 wifidog 转发规则, 重新添加"
		stop
		$WD_DIR/wdctl stop
		sleep 1
		killall -9 wifidog wdctl
		start
	fi
fi
if [ "$wifidog_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
$WD_DIR/wdctl stop
sleep 1
killall -9 wifidog wdctl
start
restart_dhcpd
fi
   exit 1
   ;;
esac
exit 0



EEF
chmod 777 "/tmp/sh_wifi_dog.sh"
cat > "/tmp/sh_tinyproxy.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
tinyproxy_port=`nvram get tinyproxy_port`
tinyproxy_enable=`nvram get tinyproxy_enable`
tinyproxy_path=`nvram get tinyproxy_path`
[ -z $tinyproxy_path ] && tinyproxy_path=`which tinyproxy` && nvram set tinyproxy_path=$tinyproxy_path
A_restart=`nvram get tinyproxy_status`
B_restart="$tinyproxy_enable$tinyproxy_path$tinyproxy_port$(cat /etc/storage/tinyproxy_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set tinyproxy_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$tinyproxy_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof tinyproxy`" ] && logger -t "【tinyproxy】" "停止 tinyproxy"
killall -9 tinyproxy tinyproxy_script.sh
fi
if [ "$tinyproxy_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 tinyproxy tinyproxy_script.sh
SVC_PATH=$tinyproxy_path
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/tinyproxy"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【tinyproxy】" "自动安装 tinyproxy 程序"
	# 找不到 tinyproxy，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【tinyproxy】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/tinyproxy "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/tinyproxy"
		chmod 755 "/opt/bin/tinyproxy"
	else
		logger -t "【tinyproxy】" "找到 $SVC_PATH"
	fi
	tinyproxy_path=`which tinyproxy` && nvram set tinyproxy_path=$tinyproxy_path
	SVC_PATH=$tinyproxy_path
fi

[ ! -s "$SVC_PATH" ] && {  logger -t "【tinyproxy】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【tinyproxy】" "运行 tinyproxy_script"
killall -9 tinyproxy tinyproxy_script.sh
$tinyproxy_path -c /etc/storage/tinyproxy_script.sh &
restart_dhcpd
sleep 3
[ ! -z "`pidof tinyproxy`" ] && logger -t "【tinyproxy】" "启动成功"
[ -z "`pidof tinyproxy`" ] && logger -t "【tinyproxy】" "启动失败, 注意检查端口是否有冲突,10秒后自动尝试重新启动" && sleep 10 && nvram set tinyproxy_status=00 && /tmp/sh_tinyproxy.sh &
fi
EEF
chmod 777 "/tmp/sh_tinyproxy.sh"
cat > "/tmp/sh_mproxy.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

mproxy_enable=`nvram get mproxy_enable`
mproxy_port=`nvram get mproxy_port`
A_restart=`nvram get mproxy_status`
B_restart="$mproxy_enable$mproxy_port$(cat /etc/storage/mproxy_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set mproxy_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$mproxy_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof mproxy`" ] && logger -t "【mproxy】" "停止 mproxy"
killall -9 mproxy mproxy_script.sh
fi
if [ "$mproxy_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 mproxy mproxy_script.sh
SVC_PATH="/usr/sbin/mproxy"
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/mproxy"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【mproxy】" "自动安装 mproxy 程序"
	# 找不到 mproxy，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【mproxy】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/mproxy "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/mproxy"
		chmod 755 "/opt/bin/mproxy"
	else
		logger -t "【mproxy】" "找到 $SVC_PATH"
	fi
fi

hash mproxy 2>/dev/null || {  logger -t "【mproxy】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【mproxy】" "运行 mproxy_script"
killall -9 mproxy mproxy_script.sh
/etc/storage/mproxy_script.sh &
restart_dhcpd
sleep 5
[ ! -z "`pidof mproxy`" ] && logger -t "【mproxy】" "启动成功"
[ -z "`pidof mproxy`" ] && logger -t "【mproxy】" "启动失败, 注意检查端口是否有冲突, 10秒后自动尝试重新启动" && sleep 10 && nvram set mproxy_status=00 && /tmp/sh_mproxy.sh &
fi
EEF
chmod 777 "/tmp/sh_mproxy.sh"
cat > "/tmp/sh_vpnproxy.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

vpnproxy_enable=`nvram get vpnproxy_enable`
vpnproxy_wan_port=`nvram get vpnproxy_wan_port`
[ -z $vpnproxy_wan_port ] && vpnproxy_wan_port="8888" && nvram set vpnproxy_wan_port=$vpnproxy_wan_port
vpnproxy_vpn_port=`nvram get vpnproxy_vpn_port`
[ -z $vpnproxy_vpn_port ] && vpnproxy_vpn_port="1194" && nvram set vpnproxy_vpn_port=$vpnproxy_vpn_port
A_restart=`nvram get vpnproxy_status`
B_restart="$vpnproxy_enable$vpnproxy_wan_port$vpnproxy_vpn_port"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set vpnproxy_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$vpnproxy_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof nvpproxy`" ] && logger -t "【vpnproxy】" "停止 vpnproxy"
killall -9 nvpproxy
fi
if [ "$vpnproxy_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 nvpproxy
SVC_PATH="/opt/bin/nvpproxy"
hash nvpproxy 2>/dev/null || m -rf /opt/bin/nvpproxy
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【vpnproxy】" "自动安装 vpnproxy 程序"
	# 找不到 vpnproxy，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【vpnproxy】" "找不到 $SVC_PATH 下载程序"
		rm -rf /opt/bin/nvpproxy.tar.gz
		wgetcurl.sh /opt/bin/nvpproxy.tar.gz "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/nvpproxy.tar.gz"
		tar -xzvf /opt/bin/nvpproxy.tar.gz -C /opt/bin/
		if [ ! -s "/opt/bin/nvpproxy" ] ; then
			logger -t "【vpnproxy】" "解压不正常:/opt/bin/nvpproxy"
			logger -t "【vpnproxy】" "启动失败, 10秒后自动尝试重新启动" && sleep 10
			nvram set vpnproxy_status=00 && /tmp/sh_vpnproxy.sh &
			exit 1
		fi
		chmod 755 "/opt/bin/nvpproxy"
		rm -rf /opt/bin/nvpproxy.tar.gz
	else
		logger -t "【vpnproxy】" "找到 $SVC_PATH"
	fi
fi

hash nvpproxy 2>/dev/null || {  logger -t "【vpnproxy】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【vpnproxy】" "运行 $SVC_PATH"
killall -9 nvpproxy
start-stop-daemon -S -q -b -m -p /var/run/nvpproxy.pid -x $SVC_PATH -- -port=$vpnproxy_wan_port -proxy=127.0.0.1:$vpnproxy_vpn_port
restart_dhcpd
sleep 5
[ ! -z "`pidof nvpproxy`" ] && logger -t "【vpnproxy】" "启动成功"
[ -z "`pidof nvpproxy`" ] && logger -t "【vpnproxy】" "启动失败, 注意检查端口是否有冲突, 10秒后自动尝试重新启动" && sleep 5 && nvram set vpnproxy_status=00 && /tmp/sh_vpnproxy.sh &
fi
EEF
chmod 777 "/tmp/sh_vpnproxy.sh"

cat > "/tmp/sh_shellinabox.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

shellinabox_enable=`nvram get shellinabox_enable`
[ -z $shellinabox_enable ] && shellinabox_enable="0" && nvram set shellinabox_enable=$shellinabox_enable
shellinabox_port=`nvram get shellinabox_port`
[ -z $shellinabox_port ] && shellinabox_port="4200" && nvram set shellinabox_port=$shellinabox_port
shellinabox_css=`nvram get shellinabox_css`
[ -z $shellinabox_css ] && shellinabox_css="white-on-black" && nvram set shellinabox_css=$shellinabox_css
shellinabox_options=`nvram get shellinabox_options`
shellinabox_wan=`nvram get shellinabox_wan`

A_restart=`nvram get shellinabox_status`
B_restart="$shellinabox_enable$shellinabox_port$shellinabox_css$shellinabox_options$shellinabox_wan"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set shellinabox_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ -n "`pidof shellinaboxd`" ] && [ "$shellinabox_enable" = "1" ] && [ "$shellinabox_wan" = "1" ] ; then
	port=$(iptables -t filter -L INPUT -v -n --line-numbers | grep dpt:$shellinabox_port | cut -d " " -f 1 | sort -nr | wc -l)
	if [ "$port" = 0 ] ; then
		logger -t "【shellinabox】" "检测:找不到 ss-server 端口:$shellinabox_port 规则, 重新添加"
		iptables -t filter -I INPUT -p tcp --dport $shellinabox_port -j ACCEPT &
	fi
fi
if [ "$shellinabox_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof shellinaboxd`" ] && logger -t "【shellinabox】" "停止 shellinabox" && /opt/etc/init.d/S88shellinaboxd stop
killall -9 shellinaboxd
fi
if [ "$shellinabox_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 shellinaboxd
SVC_PATH="/opt/sbin/shellinaboxd"
hash shellinaboxd 2>/dev/null || m -rf /opt/sbin/shellinaboxd
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【shellinabox】" "自动安装 shellinabox 程序"
	# 找不到 shellinabox，安装 opt
	rm -rf /opt/opti.txt
	if [ ! -f "/opt/opti.txt" ] ; then
		ssfile=`nvram get ssfile`
		ssfile2=`nvram get ssfile2`
		upanPath=""
		ss_opt_x=`nvram get ss_opt_x`
		[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
		[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		if [ ! -z $upanPath ] ; then
			mkdir -p /media/$upanPath/opt
			mount -o bind /media/$upanPath/opt /opt
			ln -sf /media/$upanPath /tmp/AiDisk_00
			/tmp/sh_installs.sh $ssfile 1
		else
			mkdir -p /tmp/AiDisk_00/opt
			mount -o bind /tmp/AiDisk_00/opt /opt
			/tmp/sh_installs.sh $ssfile2 2
		fi
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【shellinabox】" "找不到 $SVC_PATH"
	else
		logger -t "【shellinabox】" "找到 $SVC_PATH"
	fi
fi

hash shellinaboxd 2>/dev/null || {  logger -t "【shellinabox】" "找不到 $SVC_PATH ，需要安装 opt 环境 opkg install shellinabox"; }

logger -t "【shellinabox】" "运行 $SVC_PATH"
killall -9 shellinaboxd
/opt/etc/init.d/S88shellinaboxd restart
sleep 5
[ ! -z "`pidof shellinaboxd`" ] && logger -t "【shellinabox】" "启动成功"
[ -z "`pidof shellinaboxd`" ] && logger -t "【shellinabox】" "启动失败, 注意检查端口是否有冲突, 10秒后自动尝试重新启动" && sleep 10 && nvram set shellinabox_status=00 && /tmp/sh_shellinabox.sh &
fi
EEF
chmod 777 "/tmp/sh_shellinabox.sh"

cat > "/tmp/sh_theme.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

theme_enable=`nvram get theme_enable`
[ -z $theme_enable ] && theme_enable=0 && nvram set theme_enable=$theme_enable
A_restart=`nvram get theme_status`
B_restart="$theme_enable"
#B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
B_restart=`echo -n "$B_restart"`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set theme_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$theme_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
logger -t "【主题界面】" "停止下载主题包"
fi
if [ "$theme_enable" != "0" ] && [ "$needed_restart" = "1" ] ; then
SVC_PATH="/opt/share/www/custom/common-theme/css/main.css"
#rm -f $SVC_PATH
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【主题界面】" "部署主题风格包"
	if [ ! -d "/opt/share/www/custom" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/share/www/custom
	fi
	rm -f $SVC_PATH
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【主题界面】" "主题风格包下载 $theme_enable"
		rm -f /opt/share/www/custom/theme.tgz
		[ "$theme_enable" = "1" ] && wgetcurl.sh /opt/share/www/custom/theme.tgz "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/theme-big.tgz"
		[ "$theme_enable" = "2" ] && wgetcurl.sh /opt/share/www/custom/theme.tgz "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/theme-lit.tgz"
		tar -xzvf /opt/share/www/custom/theme.tgz -C /opt/share/www/custom
		if [ ! -s "$SVC_PATH" ] ; then
			logger -t "【主题界面】" "解压不正常:/opt/share/www/custom"
			nvram set theme_status=00
			exit 1
		fi
		rm -f /opt/share/www/custom/theme.tgz
	fi
fi
fi
EEF
chmod 777 "/tmp/sh_theme.sh"

cat > "/tmp/sh_lnmp.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

lnmp_enable=`nvram get lnmp_enable`
[ -z $lnmp_enable ] && lnmp_enable=0 && nvram set lnmp_enable=$lnmp_enable
default_enable=`nvram get default_enable`
[ -z $default_enable ] && default_enable=0 && nvram set default_enable=$default_enable
default_port=`nvram get default_port`
[ -z $default_port ] && default_port=81 && nvram set default_port=$default_port
kodexplorer_enable=`nvram get kodexplorer_enable`
[ -z $kodexplorer_enable ] && kodexplorer_enable=0 && nvram set kodexplorer_enable=$kodexplorer_enable
kodexplorer_port=`nvram get kodexplorer_port`
[ -z $kodexplorer_port ] && kodexplorer_port=82 && nvram set kodexplorer_port=$kodexplorer_port
phpmyadmin_enable=`nvram get phpmyadmin_enable`
[ -z $phpmyadmin_enable ] && phpmyadmin_enable=0 && nvram set phpmyadmin_enable=$phpmyadmin_enable
phpmyadmin_port=`nvram get phpmyadmin_port`
[ -z $phpmyadmin_port ] && phpmyadmin_port=85 && nvram set phpmyadmin_port=$phpmyadmin_port
wifidog_server_enable=`nvram get wifidog_server_enable`
[ -z $wifidog_server_enable ] && wifidog_server_enable=0 && nvram set wifidog_server_enable=$wifidog_server_enable
wifidog_server_port=`nvram get wifidog_server_port`
[ -z $wifidog_server_port ] && wifidog_server_port=84 && nvram set wifidog_server_port=$wifidog_server_port
owncloud_enable=`nvram get owncloud_enable`
[ -z $owncloud_enable ] && owncloud_enable=0 && nvram set owncloud_enable=$owncloud_enable
owncloud_port=`nvram get owncloud_port`
[ -z $owncloud_port ] && owncloud_port=83 && nvram set owncloud_port=$owncloud_port
mysql_enable=`nvram get mysql_enable`
http_username=`nvram get http_username`

A_restart=`nvram get lnmp_status`
B_restart="$http_username$lnmp_enable$mysql_enable$default_enable$kodexplorer_enable$owncloud_enable$phpmyadmin_enable$wifidog_server_enable$default_port$kodexplorer_port$owncloud_port$phpmyadmin_port$wifidog_server_port"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set lnmp_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$lnmp_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof nginx`" ] && logger -t "【LNMP】" "停止 nginx+php+mysql 环境"
/opt/etc/init.d/S70mysqld stop
/opt/etc/init.d/S79php-fpm stop
/opt/etc/init.d/S80nginx stop
killall spawn-fcgi nginx php-cgi mysqld
fi
if [ "$lnmp_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
/opt/etc/init.d/S70mysqld stop
/opt/etc/init.d/S79php-fpm stop
/opt/etc/init.d/S80nginx stop
killall spawn-fcgi nginx php-cgi mysqld
logger -t "【LNMP】" "/opt 已用数据空间`df -m|grep "% /opt" | awk ' {print $5F}'`/100%"
logger -t "【LNMP】" "/opt 已用节点空间`df -i|grep "% /opt" | awk ' {print $5F}'`/100%"
logger -t "【LNMP】" "以上两个数据如出现占用100%时，则opt空间或Inodes爆满，会影响LNMP运行，请重新正确格式化U盘。"

SVC_PATH="/opt/lnmp.txt"
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【LNMP】" "自动安装 nginx+php+mysql 环境"
	# 找不到【LNMP】，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	optava=`df -m|grep "% /opt" | awk ' {print $4F}'`
	if [ $optava -le 300 ] || [ -z "$optava" ] ; then
		logger -t "【LNMP】" "/opt剩余空间: $optava M，不足300M, 停止启用 LNMP, 请尝试重启"
		lnmp_enable=0 && nvram set lnmp_enable=$lnmp_enable
		nvram set lnmp_status=$optava
		nvram commit
		exit 1
	fi
	touch /opt/testchmod
	chmod 644 /opt/testchmod
	optava=`ls /opt -al | grep testchmod| grep 'rw-r--r--'`
	if [ -z "$optava" ] ; then
		logger -t "【LNMP】" "/opt 修改文件权限失败, 停止启用 LNMP"
		logger -t "【LNMP】" "注意: U 盘格式不支持 FAT32, 请格式化 U 盘, 要用 EXT4 或 NTFS 格式。"
		lnmp_enable=0 && nvram set lnmp_enable=$lnmp_enable
		nvram commit
		exit 1
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【LNMP】" "找不到 $SVC_PATH 下载 /opt/opt-lnmp.tgz，需时3分钟"
		lnmpfile=`nvram get lnmpfile`
		logger -t "【LNMP】" "下载地址:$lnmpfile"
		rm -rf /opt/opt-lnmp.tgz
		wgetcurl.sh /opt/opt-lnmp.tgz "$lnmpfile"
		logger -t "【LNMP】" "下载 /opt/opt-lnmp.tgz 完成. 解压文档, 需时5分钟。。。"
		tar -xzvf /opt/opt-lnmp.tgz -C /opt/
		if [ ! -s "$SVC_PATH" ] ; then
			logger -t "【LNMP】" "解压不正常:$SVC_PATH"
			logger -t "【LNMP】" "启动失败, 10秒后自动尝试重新启动" && sleep 10
			rm -f /opt/lnmp.txt
			killall spawn-fcgi nginx php-cgi mysqld
			nvram set lnmp_status=00
			nvram commit
			/tmp/sh_lnmp.sh &
			exit 1
		else
		logger -t "【LNMP】" "解压完成."

		fi
	else
		logger -t "【LNMP】" "找到 $SVC_PATH"
	fi
fi

chmod -R 777 /opt/bin/
chmod -R 777 /opt/lib/

if [ -f "/opt/etc/init.d/S69pdcnlnmpinit" ] ; then
sed -e 's/.*nvram get lnmp_enable.*/lnmp_enable=`nvram get lnmp_enable` \&\& default_port=`nvram get default_port` /g' -i /opt/etc/init.d/S69pdcnlnmpinit
fi
logger -t "【LNMP】" "运行 nginx+php+mysql 环境"
if [ "$mysql_enable" = "4" ] || [ ! -d "/opt/mysql/test" ] ; then
	logger -t "【LNMP】" "重置 /opt/mysql 数据"
	killall mysqld
	rm -rf /opt/mysql/*
	sed -e "s/.*user.*/user = "$http_username"/g" -i /opt/etc/my.cnf
	chmod 644 /opt/etc/my.cnf
	mkdir -p /opt/mysql/
	/opt/bin/mysql_install_db
	/opt/bin/mysqld &
	sleep 2
	logger -t "【LNMP】" "重置 mysql 默认账号:root, 默认密码:admin, 请手动修改密码"
	/opt/bin/mysqladmin -u root password admin
	killall mysqld
	mysql_enable=0 && nvram set mysql_enable=$mysql_enable
	nvram commit
fi
if [ "$default_enable" = "4" ] ; then
	logger -t "【LNMP】" "重置 默认主页 数据."
	rm -rf /opt/www/default
	logger -t "【LNMP】" "重置 默认主页 数据完成。"
	default_enable=0 && nvram set default_enable=$default_enable
	nvram commit
fi
if [ "$kodexplorer_enable" = "4" ] ; then
	logger -t "【LNMP】" "重置 KodExplorer 芒果云 数据."
	rm -rf /opt/www/kodexplorer
	logger -t "【LNMP】" "重置 KodExplorer 芒果云 数据完成."
	kodexplorer_enable=0 && nvram set kodexplorer_enable=$kodexplorer_enable
	nvram commit
fi
if [ "$owncloud_enable" = "4" ] ; then
	logger -t "【LNMP】" "重置 OwnCloud 私有云 数据."
	rm -rf /opt/www/owncloud
	logger -t "【LNMP】" "重置 OwnCloud 私有云 数据完成."
	owncloud_enable=0 && nvram set owncloud_enable=$owncloud_enable
	nvram commit
fi
if [ "$phpmyadmin_enable" = "4" ] ; then
	logger -t "【LNMP】" "重置 phpMyAdmin 数据."
	rm -rf /opt/www/phpmyadmin
	logger -t "【LNMP】" "重置 phpMyAdmin 数据完成."
	phpmyadmin_enable=0 && nvram set phpmyadmin_enable=$phpmyadmin_enable
	nvram commit
fi
if [ "$wifidog_server_enable" = "4" ] ; then
	logger -t "【LNMP】" "重置 wifidog_server 数据."
	rm -rf /opt/www/wifidog_server
	logger -t "【LNMP】" "重置 wifidog_server 数据完成."
	wifidog_server_enable=0 && nvram set wifidog_server_enable=$wifidog_server_enable
	nvram commit
fi
B_restart="$http_username$lnmp_enable$mysql_enable$default_enable$kodexplorer_enable$owncloud_enable$phpmyadmin_enable$wifidog_server_enable$default_port$kodexplorer_port$owncloud_port$phpmyadmin_port$wifidog_server_port"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
nvram set lnmp_status=$B_restart
if [ "$lnmp_enable" = "1" ] ; then
	if [ "$default_enable" = "1" ] || [ "$default_enable" = "2" ] ; then
		if [ ! -d "/opt/www/default" ] ; then
			mkdir -p /opt/www/default
			cp -rf /opt/etc/nginx/xhost/default.conf /opt/etc/nginx/vhost/default.conf
			if [ ! -f "/opt/www/default/tz.php" ] ; then
				logger -t "【LNMP】" "找不到 tz.php, 下载程序文档, 需时1秒"
				logger -t "【LNMP】" "下载地址:https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/tz.php"
				wgetcurl.sh /opt/www/default/tz.php "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/tz.php"
			fi
		fi
		if [ ! -d "/opt/www/default" ] ; then
			logger -t "【LNMP】" "默认主页 停用, 因未找到 /opt/www/default"
		fi
	fi
	if [ "$kodexplorer_enable" = "1" ] || [ "$kodexplorer_enable" = "2" ] ; then
		if [ ! -d "/opt/www/kodexplorer/data" ] ; then
			if [ ! -f "/opt/www/kodexplorer.tgz" ] ; then
				logger -t "【LNMP】" "找不到 kodexplorer.tgz, 下载程序文档, 需时2分钟"
				lnmpfile3=`nvram get lnmpfile3`
				logger -t "【LNMP】" "下载地址:$lnmpfile3"
				wgetcurl.sh /opt/www/kodexplorer.tgz "$lnmpfile3"
			fi
			logger -t "【LNMP】" "解压 kodexplorer 文档, 需时1分钟"
			tar -xzvf /opt/www/kodexplorer.tgz -C /opt/www
		fi
		if [ ! -d "/opt/www/kodexplorer/data" ] ; then
			logger -t "【LNMP】" "芒果云 停用, 因未找到 /opt/www/kodexplorer/data"
		else
			sed -e "s/.*upload_chunk_size.*/		\'upload_chunk_size\'	 => 1024*1024*1,		\/\/上传分片大小；默认1M/g" -i /opt/www/kodexplorer/config/setting.php
			chmod -R 777 /opt/www/kodexplorer/
		fi
	fi
	if [ "$phpmyadmin_enable" = "1" ] || [ "$phpmyadmin_enable" = "2" ] ; then
		if [ ! -d "/opt/www/phpmyadmin/libraries" ] ; then
			if [ ! -f "/opt/www/phpmyadmin.tgz" ] ; then
				logger -t "【LNMP】" "找不到 phpmyadmin.tgz, 下载程序文档, 需时2分钟"
				lnmpfile4=`nvram get lnmpfile4`
				logger -t "【LNMP】" "下载地址:$lnmpfile4"
				wgetcurl.sh /opt/www/phpmyadmin.tgz "$lnmpfile4"
			fi
			logger -t "【LNMP】" "解压 phpmyadmin 文档, 需时1分钟"
			tar -xzvf /opt/www/phpmyadmin.tgz -C /opt/www
		fi
		if [ ! -d "/opt/www/phpmyadmin/libraries" ] ; then
			logger -t "【LNMP】" "phpmyadmin 停用, 因未找到 /opt/www/phpmyadmin/libraries"
		else
			chmod 644 /opt/www/phpmyadmin/config.inc.php
		fi
	fi
	rm -rf /opt/etc/nginx/vhost/wifidog_server.conf
	if [ "$wifidog_server_enable" = "1" ] || [ "$wifidog_server_enable" = "2" ] ; then
		if [ ! -d "/opt/www/wifidog_server/auth" ] ; then
			if [ ! -f "/opt/www/wifidog_server.tgz" ] ; then
				logger -t "【LNMP】" "找不到 wifidog_server.tgz, 下载程序文档"
				lnmpfile6=`nvram get lnmpfile6`
				logger -t "【LNMP】" "下载地址:$lnmpfile6"
				wgetcurl.sh /opt/www/wifidog_server.tgz "$lnmpfile6"
			fi
			logger -t "【LNMP】" "解压 wifidog_server 文档"
			tar -xzvf /opt/www/wifidog_server.tgz -C /opt/www
		fi
		if [ ! -d "/opt/www/wifidog_server/auth" ] ; then
			logger -t "【LNMP】" "wifidog_server 停用, 因未找到 /opt/www/wifidog_server/auth"
		else
			chmod -R 777 /opt/www/wifidog_server/
			[ ! -f "/opt/etc/nginx/xhost/wifidog_server.conf" ] && wgetcurl.sh /opt/etc/nginx/xhost/wifidog_server.conf "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/wifidog_server.conf"
			cp -rf /opt/etc/nginx/xhost/wifidog_server.conf /opt/etc/nginx/vhost/wifidog_server.conf
			logger -t "【LNMP】" "wifidog_server 路径:/opt/www/wifidog_server 端口:$wifidog_server_port"
			sed -e "s/.*访问端口4.*/		listen	   "$wifidog_server_port"; "' # 访问端口4/g' -i /opt/etc/nginx/vhost/wifidog_server.conf
			sed -e "s/.*output_buffering.*/output_buffering = On/g" -i /opt/etc/php.ini
			sed -e "s/.*session\.auto_start.*/session\.auto_start = 1/g" -i /opt/etc/php.ini
			logger -t "【LNMP】" "wifidog_server:`nvram get lan_ipaddr`:"$wifidog_server_port
		fi
	fi
	if [ "$owncloud_enable" = "1" ] || [ "$owncloud_enable" = "2" ] ; then
		if [ ! -d "/opt/www/owncloud/config" ] ; then
			if [ ! -f "/opt/www/owncloud-8.0.14.tar.bz2" ] ; then
				logger -t "【LNMP】" "找不到 owncloud-8.0.14.tar.bz2, 下载程序文档, 需时3分钟"
				lnmpfile5=`nvram get lnmpfile5`
				logger -t "【LNMP】" "下载地址:$lnmpfile5"
				wgetcurl.sh /opt/www/owncloud-8.0.14.tar.bz2 "$lnmpfile5"
			fi
			logger -t "【LNMP】" "解压 owncloud 文档, 需时5分钟"
			tar -jxvf /opt/www/owncloud-8.0.14.tar.bz2 -C /opt/www
		fi
		if [ ! -d "/opt/www/owncloud/config" ] ; then
			logger -t "【LNMP】" "owncloud 停用, 因未找到 /opt/www/owncloud/config"
		else
			chmod 770 /opt/www/owncloud/data
		fi
	fi
fi
/opt/etc/init.d/S69pdcnlnmpinit start
/opt/etc/init.d/S70mysqld restart
/opt/etc/init.d/S79php-fpm restart
/opt/etc/init.d/S80nginx restart
logger -t "【LNMP】" "/opt 已用数据空间`df -m|grep "% /opt" | awk ' {print $5F}'`/100%"
logger -t "【LNMP】" "/opt 已用节点空间`df -i|grep "% /opt" | awk ' {print $5F}'`/100%"
logger -t "【LNMP】" "以上两个数据如出现占用100%时，则 opt 空间或 Inodes 爆满，会影响 LNMP 运行，请重新正确格式化 U盘。"

[ -f /opt/lnmpi.txt ] && nvram set lnmpt=`cat /tmp/lnmpi.txt`
[ -f /opt/lnmp.txt ] && nvram set lnmpo=`cat /opt/lnmp.txt`
fi
EEF
chmod 777 "/tmp/sh_lnmp.sh"

cat > "/tmp/sh_ngrok.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
ngrok_enable=`nvram get ngrok_enable`
ngrok_server=`nvram get ngrok_server`
ngrok_port=`nvram get ngrok_port`
ngrok_token=`nvram get ngrok_token`
#系统分配域名
ngrok_domain=`nvram get ngrok_domain`
ngrok_domain_type=`nvram get ngrok_domain_type`
ngrok_domain_lhost=`nvram get ngrok_domain_lhost`
ngrok_domain_lport=`nvram get ngrok_domain_lport`
ngrok_domain_sdname=`nvram get ngrok_domain_sdname`
#TCP端口转发
ngrok_tcp=`nvram get ngrok_tcp`
ngrok_tcp_type=`nvram get ngrok_tcp_type`
ngrok_tcp_lhost=`nvram get ngrok_tcp_lhost`
ngrok_tcp_lport=`nvram get ngrok_tcp_lport`
ngrok_tcp_rport=`nvram get ngrok_tcp_rport`
#自定义域名
ngrok_custom=`nvram get ngrok_custom`
ngrok_custom_type=`nvram get ngrok_custom_type`
ngrok_custom_lhost=`nvram get ngrok_custom_lhost`
ngrok_custom_lport=`nvram get ngrok_custom_lport`
ngrok_custom_hostname=`nvram get ngrok_custom_hostname`
A_restart=`nvram get ngrok_status`
B_restart="$ngrok_enable$ngrok_server$ngrok_port$ngrok_token$ngrok_domain$ngrok_domain_type$ngrok_domain_lhost$ngrok_domain_lport$ngrok_domain_sdname$ngrok_tcp$ngrok_tcp_type$ngrok_tcp_lhost$ngrok_tcp_lport$ngrok_tcp_rport$ngrok_custom$ngrok_custom_type$ngrok_custom_lhost$ngrok_custom_lport$ngrok_custom_hostname$(cat /etc/storage/ngrok_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set ngrok_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$ngrok_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof ngrokc`" ] && logger -t "【ngrokc】" "停止 ngrokc"
killall -9 ngrokc ngrok_script.sh
fi
if [ "$ngrok_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 ngrokc ngrok_script.sh
SVC_PATH="/usr/bin/ngrokc"
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/ngrokc"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【ngrokc】" "自动安装 ngrokc 程序"
	# 找不到ngrokc，安装opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【ngrokc】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/ngrokc "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/ngrokc"
		chmod 755 "/opt/bin/ngrokc"
	else
		logger -t "【ngrokc】" "找到 $SVC_PATH"
	fi
fi

hash ngrokc 2>/dev/null || {  logger -t "【ngrokc】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【ngrokc】" "运行 ngrok_script"
killall -9 ngrokc ngrok_script.sh
#/etc/storage/ngrok_script.sh
sed -Ei '/UI设置自动生成/d' /etc/storage/ngrok_script.sh
sed -Ei '/^$/d' /etc/storage/ngrok_script.sh
# 系统分配域名
if [ "$ngrok_domain" = "1" ] ; then
cat >> "/etc/storage/ngrok_script.sh" <<-EUI
ngrokc -SER[Shost:$ngrok_server,Sport:$ngrok_port,Atoken:$ngrok_token] -AddTun[Type:$ngrok_domain_type,Lhost:$ngrok_domain_lhost,Lport:$ngrok_domain_lport,Sdname:$ngrok_domain_sdname] & #UI设置自动生成
EUI
fi
# TCP端口转发
if [ "$ngrok_tcp" = "1" ] ; then
cat >> "/etc/storage/ngrok_script.sh" <<-EUI
ngrokc -SER[Shost:$ngrok_server,Sport:$ngrok_port,Atoken:$ngrok_token] -AddTun[Type:$ngrok_tcp_type,Lhost:$ngrok_tcp_lhost,Lport:$ngrok_tcp_lport,Rport:$ngrok_tcp_rport] & #UI设置自动生成
EUI
fi
# 自定义域名
if [ "$ngrok_custom" = "1" ] ; then
cat >> "/etc/storage/ngrok_script.sh" <<-EUI
ngrokc -SER[Shost:$ngrok_server,Sport:$ngrok_port,Atoken:$ngrok_token] -AddTun[Type:$ngrok_custom_type,Lhost:$ngrok_custom_lhost,Lport:$ngrok_custom_lport,Hostname:$ngrok_custom_hostname] & #UI设置自动生成
EUI
fi
B_restart="$ngrok_enable$ngrok_server$ngrok_port$ngrok_token$ngrok_domain$ngrok_domain_type$ngrok_domain_lhost$ngrok_domain_lport$ngrok_domain_sdname$ngrok_tcp$ngrok_tcp_type$ngrok_tcp_lhost$ngrok_tcp_lport$ngrok_tcp_rport$ngrok_custom$ngrok_custom_type$ngrok_custom_lhost$ngrok_custom_lport$ngrok_custom_hostname$(cat /etc/storage/ngrok_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
nvram set ngrok_status=$B_restart
/etc/storage/ngrok_script.sh &
restart_dhcpd
fi
EEF
chmod 777 "/tmp/sh_ngrok.sh"

cat > "/tmp/sh_frp.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
frp_enable=`nvram get frp_enable`
frp_enable=${frp_enable:-"0"}
frpc_enable=`nvram get frpc_enable`
frpc_enable=${frpc_enable:-"0"}
frps_enable=`nvram get frps_enable`
frps_enable=${frps_enable:-"0"}

update=$1
if [ "$update" = "updatefrp" ] ; then
[ "$frp_enable" = "1" ] && nvram set frp_status="updatefrp"  && logger -t "【frp】" "重启"
if [ "$frp_enable" = "0" ] ; then
[ -f /opt/bin/frpc ] && rm -rf /opt/bin/frpc && logger -t "【frpc】" "更新"
[ -f /opt/bin/frps ] && rm -rf /opt/bin/frps && logger -t "【frps】" "更新"
nvram set frpc_v=""
nvram set frps_v=""
fi
fi

A_restart=`nvram get frp_status`
B_restart="$frp_enable$frpc_enable$frps_enable$(cat /etc/storage/frp_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set frp_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$frp_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof frpc`" ] && logger -t "【frp】" "停止 frpc"
[ ! -z "`pidof frps`" ] && logger -t "【frp】" "停止 frps"
killall -9 frpc frps frp_script.sh
fi
if [ "$frp_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then

if [ "$frpc_enable" = "1" ] ; then
	SVC_PATH="/opt/bin/frpc"
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【frp】" "自动安装 frpc 程序"
		# 找不到 frpc，安装 opt
		if [ ! -d "/opt/bin" ] ; then
		upanPath=""
		ss_opt_x=`nvram get ss_opt_x`
		[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
		[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		if [ ! -z $upanPath ] ; then
			mkdir -p /media/$upanPath/opt
			mount -o bind /media/$upanPath/opt /opt
			ln -sf /media/$upanPath /tmp/AiDisk_00
		else
			mkdir -p /tmp/AiDisk_00/opt
			mount -o bind /tmp/AiDisk_00/opt /opt
		fi
		mkdir -p /opt/bin
		fi
		if [ ! -f "$SVC_PATH" ] ; then
			logger -t "【frp】" "找不到 $SVC_PATH 下载程序"
			wgetcurl.sh /opt/bin/frpc "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/frpc"
			chmod 755 "/opt/bin/frpc"
		else
			logger -t "【frp】" "找到 $SVC_PATH"
		fi
	fi
	hash frpc 2>/dev/null || {  logger -t "【frp】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }
frpc_v="`/opt/bin/frpc --version`"
nvram set frpc_v=$frpc_v
logger -t "【frp】" "frpc-version: $frpc_v"
fi
if [ "$frps_enable" = "1" ] ; then
	SVC_PATH="/opt/bin/frps"
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【frp】" "自动安装 frps 程序"
		# 找不到 frps，安装 opt
		if [ ! -d "/opt/bin" ] ; then
		upanPath=""
		ss_opt_x=`nvram get ss_opt_x`
		[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
		[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		if [ ! -z $upanPath ] ; then
			mkdir -p /media/$upanPath/opt
			mount -o bind /media/$upanPath/opt /opt
			ln -sf /media/$upanPath /tmp/AiDisk_00
		else
			mkdir -p /tmp/AiDisk_00/opt
			mount -o bind /tmp/AiDisk_00/opt /opt
		fi
		mkdir -p /opt/bin
		fi
		if [ ! -f "$SVC_PATH" ] ; then
			logger -t "【frp】" "找不到 $SVC_PATH 下载程序"
			wgetcurl.sh /opt/bin/frps "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/frps"
			chmod 755 "/opt/bin/frps"
		else
			logger -t "【frp】" "找到 $SVC_PATH"
		fi
	fi
	hash frps 2>/dev/null || {  logger -t "【frp】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }
frps_v="`/opt/bin/frps --version`"
nvram set frps_v=$frps_v
logger -t "【frp】" "frps-version: $frps_v"
fi
logger -t "【frp】" "运行 frp_script"
killall -9 frp_script.sh
/etc/storage/frp_script.sh &
fi
EEF
chmod 777 "/tmp/sh_frp.sh"


cat > "/tmp/sh_server_chan.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
serverchan_enable=`nvram get serverchan_enable`
serverchan_enable=${serverchan_enable:-"0"}
serverchan_sckey=`nvram get serverchan_sckey`
serverchan_notify_1=`nvram get serverchan_notify_1`
serverchan_notify_2=`nvram get serverchan_notify_2`
serverchan_notify_3=`nvram get serverchan_notify_3`
serverchan_notify_4=`nvram get serverchan_notify_4`

send=$1
if [ "$send" = "send" ] ; then
curltest=`which curl`
	if [ -z "$curltest" ] ; then
	opkg install curl
	[ -f /opt/lib/libcurl.so.4.4.0 ] && rm -f /opt/lib/libcurl.so.4 ; cp -a -f /opt/lib/libcurl.so.4.4.0 /opt/lib/libcurl.so.4
	fi
curltest=`which curl`
	if [ -z "$curltest" ] ; then
		logger -t "【微信推送】" "未找到 curl 程序，停止 微信推送。请安装 opt 后输入[opkg install curl]安装"
		exit
	fi
serverchan_text=$2
serverchan_desp=$3
curl -s "http://sc.ftqq.com/$serverchan_sckey.send?text=$serverchan_text" -d "&desp=$serverchan_desp" &
logger -t "【微信推送】" "消息标题:$serverchan_text"
logger -t "【微信推送】" "消息内容:$serverchan_desp"
fi

A_restart=`nvram get serverchan_status`
B_restart="$serverchan_enable$serverchan_sckey$serverchan_notify_1$serverchan_notify_2$serverchan_notify_3$serverchan_notify_4$(cat /etc/storage/serverchan_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set serverchan_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$serverchan_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
killall serverchan_script.sh
killall sh_server_chan.sh
fi
if [ "$serverchan_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall serverchan_script.sh
curltest=`which curl`
	if [ -z "$curltest" ] ; then
	opkg install curl
	[ -f /opt/lib/libcurl.so.4.4.0 ] && rm -f /opt/lib/libcurl.so.4 ; cp -a -f /opt/lib/libcurl.so.4.4.0 /opt/lib/libcurl.so.4
	fi
curltest=`which curl`
	if [ -z "$curltest" ] ; then
		logger -t "【微信推送】" "未找到 curl 程序，停止 微信推送。请安装 opt 后输入[opkg install curl]安装"
		exit
	fi
logger -t "【微信推送】" "运行 /etc/storage/serverchan_script.sh"
/etc/storage/serverchan_script.sh &

fi
EEF
chmod 777 "/tmp/sh_server_chan.sh"


cat > "/tmp/sh_kcp_tun.sh" <<-\EEF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
kcptun_enable=`nvram get kcptun_enable`
kcptun_enable=${kcptun_enable:-"0"}
kcptun_server=`nvram get kcptun_server`
kcptun_s_server=""
kcptun_sport=`nvram get kcptun_sport`
kcptun_sport=${kcptun_sport:-"29900"}
kcptun_key=`nvram get kcptun_key`
kcptun_crypt=`nvram get kcptun_crypt`
kcptun_crypt=${kcptun_crypt:-"none"}
kcptun_lport=`nvram get kcptun_lport`
kcptun_lport=${kcptun_lport:-"8388"}
kcptun_sndwnd=`nvram get kcptun_sndwnd`
kcptun_sndwnd=${kcptun_sndwnd:-"1024"}
kcptun_rcvwnd=`nvram get kcptun_rcvwnd`
kcptun_rcvwnd=${kcptun_rcvwnd:-"1024"}
kcptun_mode=`nvram get kcptun_mode`
kcptun_mode=${kcptun_mode:-"fast"}
kcptun_mtu=`nvram get kcptun_mtu`
kcptun_mtu=${kcptun_mtu:-"1350"}
kcptun_dscp=`nvram get kcptun_dscp`
kcptun_dscp=${kcptun_dscp:-"0"}
kcptun_datashard=`nvram get kcptun_datashard`
kcptun_datashard=${kcptun_datashard:-"10"}
kcptun_parityshard=`nvram get kcptun_parityshard`
kcptun_parityshard=${kcptun_parityshard:-"3"}
kcptun_autoexpire=`nvram get kcptun_autoexpire`
kcptun_autoexpire=${kcptun_autoexpire:-"0"}
kcptun_path=`nvram get kcptun_path`
kcptun_path=${kcptun_path:-"/opt/bin/client_linux_mips"}
nvram set kcptun_path=$kcptun_path
kcptun_user=`nvram get kcptun_user`

update=$1
if [ "$update" = "updatekcptun" ] ; then
[ "$kcptun_enable" = "1" ] && nvram set kcptun_status="updatekcptun" && logger -t "【kcptun】" "重启"
[ "$kcptun_enable" = "0" ] && [ -f "$kcptun_path" ] && nvram set kcptun_v="" && logger -t "【kcptun】" "更新" && rm -rf $kcptun_path
fi

A_restart=`nvram get kcptun_status`
B_restart="$kcptun_enable$kcptun_user$kcptun_path$kcptun_parityshard$kcptun_datashard$kcptun_server$kcptun_sport$kcptun_key$kcptun_crypt$kcptun_lport$kcptun_sndwnd$kcptun_rcvwnd$kcptun_mode$kcptun_mtu$kcptun_dscp$(cat /etc/storage/kcptun_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set kcptun_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$kcptun_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof client_linux_mips`" ] && logger -t "【kcptun】" "停止 client_linux_mips"
eval $(ps  | grep "$kcptun_path" | grep -v grep | awk '{print "kill "$1}')
killall client_linux_mips kcptun_script.sh sh_kcpkeep.sh
fi
if [ "$kcptun_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall sh_kcpkeep.sh client_linux_mips $kcptun_path
eval $(ps  | grep "$kcptun_path" | grep -v grep | awk '{print "kill "$1}')
SVC_PATH=$kcptun_path
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/client_linux_mips"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【kcptun】" "自动安装 client_linux_mips 程序"
	# 找不到 client_linux_mips，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【kcptun】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/client_linux_mips "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/client_linux_mips"
		chmod 755 "/opt/bin/client_linux_mips"
	else
		logger -t "【kcptun】" "找到 $SVC_PATH"
	fi
	if [ -f "$SVC_PATH" ] ; then
	   nvram set kcptun_path=$SVC_PATH
	fi
fi
hash client_linux_mips 2>/dev/null || {  logger -t "【kcptun】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }
kcptun_v=`$SVC_PATH -v | awk '{print $3}'`
nvram set kcptun_v=$kcptun_v
logger -t "【kcptun】" "kcptun-version: $kcptun_v"
logger -t "【kcptun】" "运行 kcptun_script"
killall client_linux_mips kcptun_script.sh sh_kcpkeep.sh
#/etc/storage/kcptun_script.sh

resolveip=`/usr/bin/resolveip -4 -t 4 $kcptun_server | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $kcptun_server | awk 'NR==5{print $3}'` 
kcptun_s_server=$resolveip
[ -z "$kcptun_s_server" ] && { logger -t "【kcptun】" "[错误!!] 实在找不到你的 kcptun 服务器IP，麻烦看看哪里错了？"; nvram set kcptun_status=0; exit 0; } 

sed -Ei '/UI设置自动生成/d' /etc/storage/kcptun_script.sh
sed -Ei '/^$/d' /etc/storage/kcptun_script.sh


# 自动生成客户端启动命令

cat >> "/etc/storage/kcptun_script.sh" <<-EUI
# UI设置自动生成  客户端启动参数
$SVC_PATH $kcptun_user -r "$kcptun_s_server:$kcptun_sport" -l ":$kcptun_lport" -key $kcptun_key -mtu $kcptun_mtu -sndwnd $kcptun_sndwnd -rcvwnd $kcptun_rcvwnd -crypt $kcptun_crypt -mode $kcptun_mode -dscp $kcptun_dscp -datashard $kcptun_datashard -parityshard $kcptun_parityshard -autoexpire $kcptun_autoexpire -nocomp & #UI设置自动生成
EUI

# 自动生成服务端启动命令

cat >> "/etc/storage/kcptun_script.sh" <<-EUI
# UI设置自动生成 64位系统 服务端启动参数：此参数复制到服务器启动。（服务端请自行下载部署）
#./server_linux_amd64 -t "$kcptun_s_server:$kcptun_lport" -l ":$kcptun_sport" -key $kcptun_key -mtu $kcptun_mtu -sndwnd 2048 -rcvwnd 2048 -crypt $kcptun_crypt -mode $kcptun_mode -dscp $kcptun_dscp -datashard $kcptun_datashard -parityshard $kcptun_parityshard -nocomp & #UI设置自动生成
# UI设置自动生成 32位系统 服务端启动参数：此参数复制到服务器启动。（服务端请自行下载部署）
#./server_linux_386 -t "$kcptun_s_server:$kcptun_lport" -l ":$kcptun_sport" -key $kcptun_key -mtu $kcptun_mtu -sndwnd 2048 -rcvwnd 2048 -crypt $kcptun_crypt -mode $kcptun_mode -dscp $kcptun_dscp -datashard $kcptun_datashard -parityshard $kcptun_parityshard -nocomp & #UI设置自动生成
EUI


B_restart="$kcptun_enable$kcptun_user$kcptun_path$kcptun_parityshard$kcptun_datashard$kcptun_server$kcptun_sport$kcptun_key$kcptun_crypt$kcptun_lport$kcptun_sndwnd$kcptun_rcvwnd$kcptun_mode$kcptun_mtu$kcptun_dscp$(cat /etc/storage/kcptun_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
nvram set kcptun_status=$B_restart
/etc/storage/kcptun_script.sh &
restart_dhcpd
#守护脚本
killall sh_kcpkeep.sh
KCPNUM=$(echo `cat /etc/storage/kcptun_script.sh | grep -v "^#" | grep "KCPNUM=" | sed 's/KCPNUM=//'`)
cat > "/tmp/sh_kcpkeep.sh" <<-KKP
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
PRO_NAME=$SVC_PATH
KCPNUM=$KCPNUM
WLAN=ra0
 
while true ; do
#   用ps获取 \$PRO_NAME 进程数量
	NUM=\`ps | grep \${PRO_NAME} | grep -v grep |wc -l\`
#	echo \$NUM
if [ "\${NUM}" -lt "\$KCPNUM" ] ; then
#   少于 $KCPNUM ，重启进程
	echo "\${PRO_NAME} was killed"
	eval $(ps  | grep "\${PRO_NAME}" | grep -v grep | awk '{print "kill "$1}')
	killall -9 client_linux_mips
	
	$SVC_PATH $kcptun_user -r "$kcptun_s_server:$kcptun_sport" -l ":$kcptun_lport" -key $kcptun_key -mtu $kcptun_mtu -sndwnd $kcptun_sndwnd -rcvwnd $kcptun_rcvwnd -crypt $kcptun_crypt -mode $kcptun_mode -dscp $kcptun_dscp -datashard $kcptun_datashard -parityshard $kcptun_parityshard -autoexpire $kcptun_autoexpire -nocomp & #UI设置自动生成
elif [ "\${NUM}" -gt "\$KCPNUM" ] ; then
#   大于 $KCPNUM ，杀掉所有进程，重启
	echo "more than \$KCPNUM \${PRO_NAME},killall \${PRO_NAME}"
	eval $(ps  | grep "\${PRO_NAME}" | grep -v grep | awk '{print "kill "$1}')
	killall -9 client_linux_mips
	$SVC_PATH $kcptun_user -r "$kcptun_s_server:$kcptun_sport" -l ":$kcptun_lport" -key $kcptun_key -mtu $kcptun_mtu -sndwnd $kcptun_sndwnd -rcvwnd $kcptun_rcvwnd -crypt $kcptun_crypt -mode $kcptun_mode -dscp $kcptun_dscp -datashard $kcptun_datashard -parityshard $kcptun_parityshard -autoexpire $kcptun_autoexpire -nocomp & #UI设置自动生成
fi
sleep 11
done
exit 0
KKP
chmod 755 "/tmp/sh_kcpkeep.sh"
/tmp/sh_kcpkeep.sh &
fi



EEF
chmod 777 "/tmp/sh_kcp_tun.sh"
cat > "/tmp/sh_jbls.sh" <<-\EEF
#!/bin/sh
jbls_enable=`nvram get jbls_enable`
if [ "$jbls_enable" = "0" ] ; then
[ ! -z "`pidof jblicsvr`" ] && killall -9 jblicsvr
fi
if [ -z "`pidof jblicsvr`" ] && [ "$jbls_enable" = "1" ] ; then
#jblicsvr -d -p 1027
/etc/storage/jbls_script.sh &
fi
EEF
chmod 777 "/tmp/sh_jbls.sh"
cat > "/tmp/sh_vlmcsd.sh" <<-\EEF
#!/bin/sh
kms_enable=`nvram get kms_enable`
if [ "$kms_enable" = "0" ] ; then
[ ! -z "`pidof vlmcsd`" ] && { sed -Ei '/_vlmcs._tcp/d' /etc/storage/dnsmasq/dnsmasq.conf; killall -9 vlmcsd; restart_dhcpd; }
fi
if [ -z "`pidof vlmcsd`" ] && [ "$kms_enable" = "1" ] ; then
[ ! -f /etc_ro/vlmcsd.kmd ] && /usr/bin/vlmcsd -i /etc/storage/vlmcsdini_script.sh -l /tmp/vlmcsd.log &
[ -f /etc_ro/vlmcsd.kmd ] && /usr/bin/vlmcsd -j /etc_ro/vlmcsd.kmd -i /etc/storage/vlmcsdini_script.sh -l /tmp/vlmcsd.log &
computer_name=`nvram get computer_name`
sed -Ei '/_vlmcs._tcp/d' /etc/storage/dnsmasq/dnsmasq.conf
nvram set lan_domain="lan"
echo "srv-host=_vlmcs._tcp.lan,$computer_name.lan,1688,0,100" >> /etc/storage/dnsmasq/dnsmasq.conf
/etc/storage/vlmcsdini_script.sh &
restart_dhcpd
fi
EEF
chmod 777 "/tmp/sh_vlmcsd.sh"
cat > "/tmp/sh_upopt.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
upopt=`nvram get upopt_enable`
rm -f /tmp/opti.txt
rm -f /tmp/lnmpi.txt
ssfile3=`nvram get ssfile3`
[ -z "$ssfile3" ] && ssfile3="https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/optg7.txt"
lnmpfile2=`nvram get lnmpfile2`
[ -z "$lnmpfile2" ] && lnmpfile2="https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/optg7.txt"
wgetcurl.sh "/tmp/opti.txt" $ssfile3
wgetcurl.sh "/tmp/lnmpi.txt" $lnmpfile2
nvram set opto=`cat /opt/opti.txt`
nvram set optt=`cat /tmp/opti.txt`
nvram set lnmpo=`cat /opt/lnmp.txt`
nvram set lnmpt=`cat /tmp/lnmpi.txt`
if [ $(cat /tmp/opti.txt) != $(cat /opt/opti.txt) ] && [ -f /tmp/opti.txt ] ; then
	if [ "$upopt" = "1" ] ; then
		logger -t "【opt】" "opt 需要更新, 自动启动更新"
		rm -rf /opt/opti.txt
		rm -rf /opt/lnmp.txt
		optinstall=1
	else
		logger -t "【opt】" "opt 需要更新, 自动更新未启用, 请设置自动更新或手动更新"
	fi
else
	logger -t "【opt】" "opt 不需更新"
fi
[ "$upopt" = "1" ] && [ ! -f /opt/opti.txt ] && optinstall=1
if [ $(cat /tmp/lnmpi.txt) != $(cat /opt/lnmp.txt) ] && [ -f /tmp/lnmpi.txt ] ; then
	if [ "$upopt" = "1" ] ; then
		logger -t "【opt】" "opt-lnmp 需要更新, 自动启动更新"
		rm -rf /opt/opti.txt
		rm -rf /opt/lnmp.txt
		optinstall=1
	else
		logger -t "【opt】" "opt-lnmp 需要更新, 自动更新未启用, 请设置自动更新或手动更新"
	fi
else
	logger -t "【opt】" "opt-lnmp 不需更新"
fi
[ "$upopt" = "1" ] && [ ! -f /opt/lnmp.txt ] && optinstall=1
EOF
chmod 777 "/tmp/sh_upopt.sh"
cat > "/tmp/sh_download.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
output=$1
url1=$2
url2=$3
[ -z "$url2" ] && url2=$url1
rm -f $output
wgetcurl.sh $output $url1
if [ ! -s "$output" ] ; then
	logger -t "【下载】" "下载失败:【$output】 URL:【$url1】"
	logger -t "【下载】" "重新下载:【$output】 URL:【$url2】"
	rm -f $output
	sleep 6
	wgetcurl.sh $output $url2
fi
if [ ! -s "$output" ] ; then
	logger -t "【下载】" "下载失败:【$output】 URL:【$url2】"
	exit 1
else
	chmod 777 $output
fi
EOF
chmod 777 "/tmp/sh_download.sh"
cat > "/tmp/sh_untar.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
flie=$1
output=$2
outputflie=$3
mkdir -p $output
tar -xzvf $flie -C $output
if [ ! -s "$outputflie" ] ; then
	logger -t "【解压】" "解压不正常:$1"
	exit 1
fi
EOF
chmod 777 "/tmp/sh_untar.sh"
cat > "/tmp/sh_ddns.sh" <<-\EOF
#!/bin/sh
flie=$1
url=$2
logger -t "【DDNS】" "更新 IP 地址-$flie"
while [ "1" ];
do
[ -f "$flie" ] && sleep 66
[ -f "$flie" ] && rm -f $flie
wgetcurl.sh $flie $url
sleep 666
continue
done
EOF
chmod 777 "/tmp/sh_ddns.sh"
cat > "/tmp/sh_func_load_adm.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/tmp/7620adm/lib:/lib:/opt/lib

keep_adm(){
logger -t "【ADM】" "ADM 守护脚本启动."
killall admkeep.sh
cat > "/tmp/admkeep.sh" <<-\ADM
#!/bin/sh
cd /tmp/7620adm
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/tmp/7620adm/lib:/lib:/opt/lib
PRO_NAME="/tmp/7620adm/adm"
ADMNUM=1
runx="1"

while true ; do
#   用ps获取 $PRO_NAME 进程数量
	NUM=`ps | grep $PRO_NAME | grep -v grep |wc -l`
#	echo $NUM
#	logger -t "【ADM】" " $NUM 进程"
if [ "$NUM" -lt "$ADMNUM" ] ; then
#   少于 $ADMNUM ，重启进程
	logger -t "【ADM】" "少于 $ADMNUM, 重启进程"
	echo "$PRO_NAME was killed"
	/tmp/sh_adm18309.sh D
	eval $(ps  | grep "/tmp/7620adm/adm" | grep -v grep | awk '{print "kill "$1}')
	/tmp/7620adm/adm >> /dev/null 2>&1 &
	sleep 10
	/tmp/sh_adm18309.sh A
elif [ "$NUM" -gt "$ADMNUM" ] ; then
#   大于 $ADMNUM ，杀掉所有进程，重启
	logger -t "【ADM】" "大于 $ADMNUM, 杀掉所有进程, 重启"
	echo "more than $ADMNUM $PRO_NAME,killall $PRO_NAME"
	/tmp/sh_adm18309.sh D
	eval $(ps | grep "/tmp/7620adm/adm" | grep -v grep | awk '{print "kill "$1}')
	/tmp/7620adm/adm >> /dev/null 2>&1 &
	sleep 10
	/tmp/sh_adm18309.sh A
fi
sleep 62
if [ ! -f /tmp/cron_adb.lock ] && [ -s "/tmp/7620adm/adm" ] ; then
	PIDS=$(ps | grep "/tmp/7620adm/adm" | grep -v "grep" | wc -l)
	if [ "$PIDS" != 0 ] ; then
		port=$(iptables -t nat -L | grep 'ports 18309' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【ADM】" "守护检查:找不到18309转发规则, 重新添加"
			killall -15 adm
			killall -9 adm
			rm -f /tmp/cron_adb.lock
			nvram set adm_status="restart_firewall"
			restart_firewall &
			sleep 62
		fi
	fi
fi
runx=`expr $runx + 1`
if [ "$runx" -gt 720 ] ; then
runx="1"
checka="/tmp/var/admrule_everyday.txt"
rm -f /tmp/var/admrule_everyday.txt
urla="http://update2.admflt.com/ruler/admrule_everyday.txt"
checkb="/tmp/7620adm/subscribe/admrule_everyday.txt"
wgetcurl.sh $checka $urla
	if [ "`md5sum $checka|cut -d" " -f1`" != "`md5sum $checkb|cut -d" " -f1`" ] ; then
		logger -t "【ADM】" "守护检查:有更新 $urla , 重启进程"
		/tmp/sh_adm18309.sh D
		killall -15 adm
		killall -9 adm
		rm -f /tmp/cron_adb.lock
		nvram set adm_status="restart_firewall"
		restart_firewall &
		sleep 62
	else
		logger -t "【ADM】" "守护检查:不需更新 $urla "
	fi
fi
done
exit 0
ADM
chmod 755 "/tmp/admkeep.sh"
/tmp/admkeep.sh &
}

adm_enable=`nvram get adm_enable`
adbmfile=`nvram get adbmfile`
adm_https=`nvram get adm_https`
adm_hookport=`nvram get adm_hookport`
lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr
ipsets=`nvram get adbyby_mode_x`
A_restart=`nvram get adm_status`
B_restart="$adm_enable$adbmfile$lan_ipaddr$adm_https$ipsets$adm_hookport$ss_DNS_Redirect$ss_DNS_Redirect_IP$ss_DNS_Redirect$(cat /etc/storage/ad_config_script.sh | grep -v "^$" | grep -v "^#")$(cat /etc/storage/adm_rules_script.sh | grep -v "^$" | grep -v "^!")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set adm_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi

if [ "$needed_restart" = "0" ] ; then
if [ ! -f /tmp/cron_adb.lock ] && [ -s "/tmp/7620adm/adm" ] && [ "$adm_enable" = "1" ] ; then
	PIDS=$(ps | grep "/tmp/7620adm/adm" | grep -v "grep" | wc -l)
	if [ "$PIDS" != 0 ] ; then
		port=$(iptables -t nat -L | grep 'ports 18309' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【Adbyby】" "定时检查:找不到18309转发规则, 重新添加"
			/tmp/sh_adm18309.sh A
		fi
	fi
fi
fi
if [ "$needed_restart" = "1" ] ; then
	killall -9 adm ; killall -15 adm ; killall admkeep.sh ;
	[ "`iptables -t nat -L | grep 'ports 18309' | wc -l`" != "0" ] && /tmp/sh_adm18309.sh D &
	sleep 1
	[ "`iptables -t nat -L | grep 'ports 18309' | wc -l`" != "0" ] && /tmp/sh_adm18309.sh D &
	/etc/storage/ez_buttons_script.sh 3 &
	sleep 1
	[ "$adm_enable" = "0" ] && { rm -f /tmp/cron_adb.lock; killall sh_func_load_adm.sh; }
fi
[ "$needed_restart" = "1" ] && { killall -9 adm ; killall -15 adm ; killall admkeep.sh ; }
if [ -z "`pidof adm`" ] && [ "$adm_enable" = "1" ] && [ ! -f /tmp/cron_adb.lock ] ; then
for module in ip_set ip_set_bitmap_ip ip_set_bitmap_ipmac ip_set_bitmap_port ip_set_hash_ip ip_set_hash_ipport ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_net ip_set_hash_netport ip_set_list_set xt_set xt_TPROXY
do
	modprobe $module
done 
	sleep 1
	touch /tmp/cron_adb.lock
	nvram set button_script_1_s="ADM"
	/tmp/sh_adm18309.sh D
	killall -15 adm
	killall -9 adm
	killall admkeep.sh
	if [ ! -s "/tmp/7620adm/adm" ] ; then
		logger -t "【ADM】" "开始下载 7620adm.tgz"
		/tmp/sh_download.sh /tmp/7620adm.tgz $adbmfile
		/tmp/sh_untar.sh /tmp/7620adm.tgz /tmp /tmp/7620adm/adm
	fi
	if [ -s "/tmp/7620adm/adm" ] ; then
		#if [ "$adm_https" = "0" ] ; then
		#	sed -e "s|^\(support_ssl.*\)=[^=]*$|\1=0|" -i /tmp/7620adm/ADMConfig.ini
		#fi
		#if [ "$adm_https" = "1" ] ; then
			mkdir -p /etc/storage/adm
			sed -e "s|^\(support_ssl.*\)=[^=]*$|\1=1|" -i /tmp/7620adm/ADMConfig.ini
			[ -f /etc/storage/adm/adm_ca.crt ] && cp -f /etc/storage/adm/adm_ca.crt /tmp/7620adm/adm_ca.crt
			[ -f /etc/storage/adm/adm_ca_key.pem ] && cp -f /etc/storage/adm/adm_ca_key.pem /tmp/7620adm/adm_ca_key.pem
		#fi
		logger -t "【ADM】" "adm证书位于/etc/storage/adm/"
		cat /etc/storage/adm_rules_script.sh | grep -v '^!' | grep -v "^$" > /tmp/7620adm/user.txt
		chmod 777 /tmp/7620adm/adm
		logger -t "【ADM】" "启动 adm 程序"
		cd /tmp/7620adm
		export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
		export LD_LIBRARY_PATH=/tmp/7620adm/lib:/lib:/opt/lib
		sleep 1
		/tmp/7620adm/adm >/dev/null 2>&1 &
		sleep 10
		#if [ "$adm_https" = "1" ] ; then
			[ ! -f /etc/storage/adm/adm_ca.crt ] && [ -f /tmp/7620adm/adm_ca.crt ] && cp /tmp/7620adm/adm_ca.crt /etc/storage/adm/adm_ca.crt
			[ ! -f /etc/storage/adm/adm_ca_key.pem ] && [ -f /tmp/7620adm/adm_ca_key.pem ] && cp /tmp/7620adm/adm_ca_key.pem /etc/storage/adm/adm_ca_key.pem && mtd_storage.sh save &
		#fi
	fi
	PIDS=$(ps | grep "/tmp/7620adm/adm" | grep -v "grep" | wc -l)
	if [ "$PIDS" != 0 ] ; then 
		logger -t "【ADM】" "启动完成"
		rm -f /tmp/7620adm.tgz
		rm -f /tmp/cron_adb.lock
		/tmp/sh_adm18309.sh A
		sleep 5
		keep_adm
		/etc/storage/ez_buttons_script.sh 3 &
	fi
	rm -f /tmp/cron_adb.lock
	PIDS=$(ps | grep "/tmp/7620adm/adm" | grep -v "grep" | wc -l)
	[ "$PIDS" = 0 ] && logger -t "【ADM】" "启动失败, 10秒后自动尝试重新启动" && sleep 10 && nvram set adm_status=00 && /tmp/sh_func_load_adm.sh &
fi


EOF
chmod 777 "/tmp/sh_func_load_adm.sh"
cat > "/tmp/sh_adm18309.sh" <<-\EOFAD
#!/bin/sh
#初始化开始
TAG="AD_BYBY"		  # iptables tag
FWI="/tmp/firewall.adbyby.pdcn" # firewall include file
AD_LAN_AC_IP=`nvram get AD_LAN_AC_IP`
AD_LAN_AC_IP=${AD_LAN_AC_IP:-"0"}
adm_https=`nvram get adm_https`
adm_hookport=`nvram get adm_hookport`

adb=$1
confdir=$2
gfwlist="/r.gfwlist.conf"
gfw_black_list="gfwlist"
ipsets=`nvram get adbyby_mode_x`
ss_mode_x=`nvram get ss_mode_x`
confdir=`grep conf-dir /etc/storage/dnsmasq/dnsmasq.conf | sed 's/.*\=//g'`
if [ -z "$confdir" ] ; then 
	confdir="/tmp/ss/dnsmasq.d"
fi
[ ! -z "$confdir" ] && mkdir -p $confdir

# AD规则

gen_special_purpose_ip() {
#处理肯定不走通道的目标网段
lan_ipaddr=`nvram get lan_ipaddr`
kcptun_enable=`nvram get kcptun_enable`
kcptun_enable=${kcptun_enable:-"0"}
kcptun_server=`nvram get kcptun_server`
if [ "$kcptun_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $kcptun_server | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $kcptun_server | awk 'NR==5{print $3}'` 
kcptun_server=$resolveip
fi
[ "$kcptun_enable" = "0" ] && kcptun_server=""
ss_enable=`nvram get ss_enable`
ss_enable=${ss_enable:-"0"}
[ "$ss_enable" = "0" ] && ss_s1_ip="" && ss_s2_ip=""
nvram set ss_server1=`nvram get ss_server`
ss_server1=`nvram get ss_server1`
ss_server2=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_server2=""

if [ "$ss_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server1 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server1 | awk 'NR==5{print $3}'` 
ss_s1_ip=$resolveip
fi
if [ ! -z "$ss_server2" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server2 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server2 | awk 'NR==5{print $3}'` 
ss_s2_ip=$resolveip
fi
	cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.25.61.0/24
192.31.196.0/24
192.52.193.0/24
192.88.99.0/24
192.168.0.0/16
192.175.48.0/24
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4
255.255.255.255
$lan_ipaddr
$ss_s1_ip
$ss_s2_ip
$kcptun_server
EOF
}

include_ac_rules() {
	iptables-restore -n <<-EOF
*$1
:AD_BYBY - [0:0]
:AD_BYBY_LAN_AC - [0:0]
:AD_BYBY_WAN_AC - [0:0]
:AD_BYBY_to - [0:0]
-A AD_BYBY -m set --match-set ad_spec_dst_sp dst -j RETURN
-A AD_BYBY -j AD_BYBY_LAN_AC
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_bp src -j RETURN
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_fw src -j AD_BYBY_to
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_ac src -j AD_BYBY_WAN_AC
-A AD_BYBY_LAN_AC -j ${LAN_TARGET:=AD_BYBY_WAN_AC}
-A AD_BYBY_WAN_AC -m set --match-set adbybylist dst -j ${ADBYBYLIST_TARGET:=AD_BYBY_to}
-A AD_BYBY_WAN_AC -m set --match-set cflist dst -j ${ADBYBYLIST_TARGET:=AD_BYBY_to}
-A AD_BYBY_WAN_AC -j ${WAN_TARGET:=AD_BYBY_to}
COMMIT
EOF
}

gen_include() {
[ -n "$FWI" ] || return 0
cat <<-CAT >>$FWI
iptables-restore -n <<-EOF
$(iptables-save | sed  "s/webstr--url/webstr --url/g" | grep -E "$TAG|^\*|^COMMIT" |sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/")
EOF
CAT
return $?
}

flush_r() {
	iptables-save -c | sed  "s/webstr--url/webstr --url/g" | grep -v "$TAG" | iptables-restore -c
	for setname in $(ipset -n list | grep -i "ad_spec"); do
		ipset destroy $setname 2>/dev/null
	done
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	ipset -F adbybylist &> /dev/null
	ipset destroy adbybylist &> /dev/null
	ipset -F cflist &> /dev/null
	iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 18309 &> /dev/null
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	return 0
}
lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr

dns_redirect() {
	# 强制使用路由的DNS
	lan_ipaddr=`nvram get lan_ipaddr`
	if [ "$ss_DNS_Redirect" == "1" ] && [ ! -z "$lan_ipaddr" ] ; then
	iptables-restore -n <<-EOF
*nat
:AD_BYBY_DNS_LAN_DG - [0:0]
:AD_BYBY_DNS_LAN_AC - [0:0]
:AD_BYBY_DNS_WAN_AC - [0:0]
:AD_BYBY_DNS_WAN_FW - [0:0]
-A AD_BYBY_DNS_LAN_DG -d $lan_ipaddr -p udp -j RETURN
-A AD_BYBY_DNS_LAN_DG -d $ss_DNS_Redirect_IP -p udp -j RETURN
-A AD_BYBY_DNS_LAN_DG -j AD_BYBY_DNS_LAN_AC
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_bp src -j RETURN
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_fw src -j AD_BYBY_DNS_WAN_FW
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_ac src -j AD_BYBY_DNS_WAN_AC
-A AD_BYBY_DNS_LAN_AC -j ${DNS_LAN_TARGET:=AD_BYBY_DNS_WAN_AC}
-A AD_BYBY_DNS_WAN_AC -j AD_BYBY_DNS_WAN_FW
COMMIT
EOF
		logger -t "【ADM】" "udp53端口（DNS）地址重定向为 $ss_DNS_Redirect_IP 强制使用重定向地址的DNS"
		iptables -t nat -A PREROUTING -s $lan_ipaddr/24 -p udp --dport 53 -j AD_BYBY_DNS_LAN_DG
		iptables -t nat -A AD_BYBY_DNS_WAN_FW -j DNAT --to $ss_DNS_Redirect_IP
	fi

}


#检查 dnsmasq 目录参数
if [ -z "$confdir" ] ; then 
	confdir="/tmp/ss/dnsmasq.d"
fi
[ ! -z "$confdir" ] && mkdir -p $confdir
[ -z "$gfwlist" ] && gfwlist=/r.gfwlist.conf
[ -z "$gfw_black_list" ] && gfw_black_list=gfwlist

#killall -9 sh_adblock_hosts.sh
#/tmp/sh_adblock_hosts.sh $confdir &

if [ "$adb" = "D" ] ; then
	logger -t "【iptables】" "删除18309转发规则"
	flush_r
	rm -f /tmp/adbyby_host.conf
	sed -Ei '/adbyby_host.conf/d' /etc/storage/dnsmasq/dnsmasq.conf
	restart_dhcpd
	logger -t "【iptables】" "完成删除18309规则"
fi
if [ "$adb" = "A" ] ; then
	logger -t "【iptables】" "添加18309转发规则"
	# rules规则
	flush_r
	ipset -! restore <<-EOF || return 1
create ad_spec_src_ac hash:ip hashsize 64
create ad_spec_src_bp hash:ip hashsize 64
create ad_spec_src_fw hash:ip hashsize 64
create ad_spec_src_https hash:ip hashsize 64
create ad_spec_dst_sp hash:net hashsize 64
$(gen_special_purpose_ip | sed -e "s/^/add ad_spec_dst_sp /")
EOF
ipset -! -N cflist iphash
ipset -! -N adbybylist iphash
lan_ipaddr=`nvram get lan_ipaddr`
ipset add ad_spec_src_bp $lan_ipaddr
ipset add ad_spec_src_bp 127.0.0.1
ipset add adbybylist 188.188.188.188
/etc/storage/ad_config_script.sh
# 内网(LAN)访问控制
logger -t "【ADM】" "设置内网(LAN)访问控制"
if [ -n "$AD_LAN_AC_IP" ] ; then
	case "${AD_LAN_AC_IP:0:1}" in
		0)
			LAN_TARGET="AD_BYBY_WAN_AC"
			DNS_LAN_TARGET="AD_BYBY_DNS_WAN_AC"
			;;
		1)
			LAN_TARGET="AD_BYBY_to"
			DNS_LAN_TARGET="AD_BYBY_DNS_WAN_FW"
			;;
		2)
			LAN_TARGET="RETURN"
			DNS_LAN_TARGET="RETURN"
			;;
	esac
fi
grep -v '^#' /tmp/ad_spec_lan_DOMAIN.txt | sort -u | grep -v "^$" | sed s/！/!/g > /tmp/ad_spec_lan.txt
while read line
do
for host in $line; do
	case "${host:0:1}" in
		n|N)
			ipset add ad_spec_src_ac ${host:2}
			;;
		b|B)
			ipset add ad_spec_src_bp ${host:2}
			;;
		g|G)
			ipset add ad_spec_src_fw ${host:2}
			;;
		s|S)
			ipset add ad_spec_src_https ${host:2}
			;;
	esac
done
done < /tmp/ad_spec_lan.txt
	[ "$ipsets" == 0 ] && WAN_TARGET="AD_BYBY_to"
	[ "$ipsets" == 0 ] && ADBYBYLIST_TARGET="AD_BYBY_to"
	[ "$ipsets" == 1 ] && WAN_TARGET="RETURN"
	[ "$ipsets" == 1 ] && ADBYBYLIST_TARGET="AD_BYBY_to"
	include_ac_rules nat
	wifidognx=""
		#wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## SS_SPEC
		#if [ -z "$wifidogn" ] ; then
			wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## Outgoing
			if [ -z "$wifidogn" ] ; then
				wifidogn=`iptables -t nat -L PREROUTING --line-number | grep vserver | awk '{print $1}' | awk 'END{print $1}'`  ## vserver
				if [ -z "$wifidogn" ] ; then
					wifidognx=1
				else
					wifidognx=`expr $wifidogn + 1`
				fi
			else
				wifidognx=`expr $wifidogn + 1`
			fi
		#else
		#	wifidognx=`expr $wifidogn + 1`
		#fi
	wifidogn=$wifidognx
	echo "AD_BYBY-number:$wifidogn"

	if [ -f /tmp/7620adm/adm_hookport.txt ] && [ "$adm_hookport" == 1 ] ; then
		hookport443='|'
		sed -e "s/443$hookport443//" -i /tmp/7620adm/adm_hookport.txt
		i=1 && hookport1="" && hookport2="" && hookport3="" && hookport4="" && hookport5=""
		for hookport in $(cat /tmp/7620adm/adm_hookport.txt | sed s/\|/\ /g)
		do
			[ "$i" -eq 1 ] && hookport1=$hookport
			[ "$i" -eq 15 ] && hookport2=$hookport
			[ "$i" -eq 30 ] && hookport3=$hookport
			[ "$i" -eq 45 ] && hookport4=$hookport
			[ "$i" -eq 60 ] && hookport5=$hookport
			[ "$i" -gt 1 ] && [ "$i" -lt 15 ] && hookport1=$hookport1","$hookport
			[ "$i" -gt 15 ] && [ "$i" -lt 30 ] && hookport2=$hookport2","$hookport
			[ "$i" -gt 30 ] && [ "$i" -lt 45 ] && hookport3=$hookport3","$hookport
			[ "$i" -gt 45 ] && [ "$i" -lt 60 ] && hookport4=$hookport4","$hookport
			[ "$i" -gt 60 ] && [ "$i" -lt 75 ] && hookport5=$hookport5","$hookport
			i=`expr $i + 1`
		done
		[ ! -z "$hookport1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport1 -j AD_BYBY
		[ ! -z "$hookport2" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport2 -j AD_BYBY
		[ ! -z "$hookport3" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport3 -j AD_BYBY
		[ ! -z "$hookport4" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport4 -j AD_BYBY
		[ ! -z "$hookport5" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport5 -j AD_BYBY
		iptables -t nat -I PREROUTING $wifidogn -p tcp -m set --match-set ad_spec_src_https src --dport 443 -j AD_BYBY
		[ "$adm_https" = "1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp --dport 443 -j AD_BYBY
	else
		[ "$adm_https" = "1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports 80,443,8080 -j AD_BYBY
		[ "$adm_https" != "1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports 80,8080 -j AD_BYBY
	fi
	iptables -t nat -A AD_BYBY_to -p tcp -j REDIRECT --to-port 18309
	dns_redirect
	sleep 1
	gen_include &
	logger -t "【iptables】" "完成添加18309规则"
	[ "$ipsets" == 1 ] && [ -f /tmp/7620adm/adm_ipset.txt ] && ln -sf /tmp/7620adm/adm_ipset.txt /tmp/adbyby_host.conf
	[ "$ipsets" == 1 ] && /tmp/sh_adm18309.sh C &
fi
#去除gfw donmain中与 adbyby host 包含的域名，这部分域名交由adbyby处理。
# 参考的awk指令写法
#  awk  'NR==FNR{a[$0]}NR>FNR{ if($1 in a) print $0}' file1 file2 #找出两文件中相同的值
#  awk  'NR==FNR{a[$0]}NR>FNR{ if(!($1 in a)) print $0}' file1 file2 #去除 file2 中file1的内容
#  awk 'NR==FNR{a[$0]++} NR>FNR&&a[$0]' file1 file2 #找出两个文件之间的相同部分
#  awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' file1 file2 #去除 file2 中file1的内容
if [ "$ipsets" == 1 ] && [ -s /tmp/adbyby_host.conf ] && [ "$adb" = "C" ] ; then
logger -t "【iptables】" "添加 ipset 转发规则"
sed -Ei '/adbyby_host.conf|cflist.conf/d' /etc/storage/dnsmasq/dnsmasq.conf
	sed  "s/\/adm_list/\/adbybylist/" -i  /tmp/adbyby_host.conf
	[ -f "$confdir$gfwlist" ] && gfw_black=$(grep "/$gfw_black_list" "$confdir$gfwlist" | sed 's/.*\=//g')
	if [ -s "$confdir$gfwlist" ] && [ -s /tmp/adbyby_host.conf ]  && [ ! -z "$gfw_black" ] ; then
		logger -t "【iptables】" "admlist 规则处理开始"
		mkdir -p /tmp/b/
		sed -e '/^\#/d' -e "s/ipset=\/www\./ipset=\/\./" -e "s/ipset=\/bbs\./ipset=\/\./" -e "s/ipset=\/\./ipset=\//" -e "s/ipset=\//ipset=\/\./" -i /tmp/adbyby_host.conf
		sed -e '/^\#/d' -e "s/ipset=\/www\./ipset=\/\./" -e "s/ipset=\/bbs\./ipset=\/\./" -e "s/ipset=\/\./ipset=\//" -e "s/ipset=\//ipset=\/\./" -i "$confdir$gfwlist"
		sed -e '/^\#/d' -e "s/ipset=\///" -e "s/adbybylist//" /tmp/adbyby_host.conf > /tmp/b/adbyby_host去干扰.conf
		sed -e '/^\#/d' -e "s/ipset=\///" -e "s/$gfw_black_list//" -e "/server=\//d" "$confdir$gfwlist" > /tmp/b/gfwlist去干扰.conf
		awk 'NR==FNR{a[$0]++} NR>FNR&&a[$0]' /tmp/b/adbyby_host去干扰.conf /tmp/b/gfwlist去干扰.conf > /tmp/b/host相同行.conf
		if [ -s /tmp/b/host相同行.conf ] ; then
			logger -t "【iptables】" "gfwlist 规则处理开始"
			sed -e "s/^/ipset=\//" -e "s/$/adbybylist/" /tmp/b/host相同行.conf > /tmp/b/host相同行2.conf
			awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' /tmp/b/host相同行2.conf /tmp/adbyby_host.conf > /tmp/b/adbyby_host不重复.conf
			sed -e "s/^/ipset=\//" -e "s/$/$gfw_black_list/" /tmp/b/host相同行.conf > /tmp/b/host相同行2.conf
			awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' /tmp/b/host相同行2.conf "$confdir$gfwlist" > /tmp/b/gfwlist不重复.conf
			sed -e "s/^/ipset=\//" -e "s/$/cflist/" /tmp/b/host相同行.conf > /tmp/b/list重复.conf
			cp -a -v /tmp/b/adbyby_host不重复.conf /tmp/adbyby_host.conf
			cp -a -v /tmp/b/gfwlist不重复.conf "$confdir$gfwlist"
			#rm -f "$confdir/cflist.conf"
			#cp -a -v /tmp/b/list重复.conf "$confdir/cflist.conf"
			cat /tmp/b/list重复.conf >> "$confdir/cflist.conf"
			logger -t "【iptables】" "gfwlist 规则处理完毕"
		fi
		grep -v '^#' $confdir/cflist.conf | sort -u | grep -v "^$" > /tmp/ss/cflist.conf
		grep -v '^#' /tmp/ss/cflist.conf | sort -u | grep -v "^$" > $confdir/cflist.conf
		echo "conf-file=$confdir/cflist.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
	fi
echo "conf-file=/tmp/adbyby_host.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
ipset flush cflist
ipset flush adbybylist
ipset add adbybylist 188.188.188.188
if [ -f /tmp/7620adm/adm_blockip.txt ] ; then
	grep -v '^#' /tmp/7620adm/adm_blockip.txt | sort -u | grep -v "^$" | sed -e "s/^/-A adbybylist &/g" | ipset -R -!
fi
restart_dhcpd
logger -t "【iptables】" "admlist 规则处理完毕"
rm -f /tmp/b/*
fi
sleep 1
/etc/storage/ez_buttons_script.sh 3 &
#restart_dhcpd
EOFAD
chmod 777 "/tmp/sh_adm18309.sh"

cat > "/tmp/sh_adb8118.sh" <<-\EOFAD
#!/bin/sh
#初始化开始
TAG="AD_BYBY"		  # iptables tag
FWI="/tmp/firewall.adbyby.pdcn" # firewall include file
AD_LAN_AC_IP=`nvram get AD_LAN_AC_IP`
AD_LAN_AC_IP=${AD_LAN_AC_IP:-"0"}

adb=$1
confdir=$2
gfwlist=$3
gfw_black_list=$4
ipsets=`nvram get adbyby_mode_x`
ss_mode_x=`nvram get ss_mode_x`
# AD规则

gen_special_purpose_ip() {
#处理肯定不走通道的目标网段
lan_ipaddr=`nvram get lan_ipaddr`
kcptun_enable=`nvram get kcptun_enable`
kcptun_enable=${kcptun_enable:-"0"}
kcptun_server=`nvram get kcptun_server`
if [ "$kcptun_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $kcptun_server | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $kcptun_server | awk 'NR==5{print $3}'` 
kcptun_server=$resolveip
fi

[ "$kcptun_enable" = "0" ] && kcptun_server=""
ss_enable=`nvram get ss_enable`
ss_enable=${ss_enable:-"0"}
[ "$ss_enable" = "0" ] && ss_s1_ip="" && ss_s2_ip=""
nvram set ss_server1=`nvram get ss_server`
ss_server1=`nvram get ss_server1`
ss_server2=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_server2=""
if [ "$ss_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server1 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server1 | awk 'NR==5{print $3}'` 
ss_s1_ip=$resolveip
fi
if [ ! -z "$ss_server2" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server2 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server2 | awk 'NR==5{print $3}'` 
ss_s2_ip=$resolveip
fi
	cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.25.61.0/24
192.31.196.0/24
192.52.193.0/24
192.88.99.0/24
192.168.0.0/16
192.175.48.0/24
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4
255.255.255.255
$lan_ipaddr
$ss_s1_ip
$ss_s2_ip
$kcptun_server
EOF
}

include_ac_rules() {
	iptables-restore -n <<-EOF
*$1
:AD_BYBY - [0:0]
:AD_BYBY_LAN_AC - [0:0]
:AD_BYBY_WAN_AC - [0:0]
:AD_BYBY_to - [0:0]
-A AD_BYBY -m set --match-set ad_spec_dst_sp dst -j RETURN
-A AD_BYBY -j AD_BYBY_LAN_AC
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_bp src -j RETURN
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_fw src -j AD_BYBY_to
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_ac src -j AD_BYBY_WAN_AC
-A AD_BYBY_LAN_AC -j ${LAN_TARGET:=AD_BYBY_WAN_AC}
-A AD_BYBY_WAN_AC -m set --match-set adbybylist dst -j ${ADBYBYLIST_TARGET:=AD_BYBY_to}
-A AD_BYBY_WAN_AC -m set --match-set cflist dst -j ${ADBYBYLIST_TARGET:=AD_BYBY_to}
-A AD_BYBY_WAN_AC -j ${WAN_TARGET:=AD_BYBY_to}
COMMIT
EOF
}

gen_include() {
[ -n "$FWI" ] || return 0
cat <<-CAT >>$FWI
iptables-restore -n <<-EOF
$(iptables-save | sed  "s/webstr--url/webstr --url/g" | grep -E "$TAG|^\*|^COMMIT" |sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/")
EOF
CAT
return $?
}

flush_r() {
	iptables-save -c | sed  "s/webstr--url/webstr --url/g" | grep -v "$TAG" | iptables-restore -c
	for setname in $(ipset -n list | grep -i "ad_spec"); do
		ipset destroy $setname 2>/dev/null
	done
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	ipset -F adbybylist &> /dev/null
	ipset destroy adbybylist &> /dev/null
	ipset -F cflist &> /dev/null
	iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8118 &> /dev/null
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	return 0
}
lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr

dns_redirect() {
	# 强制使用路由的DNS
	lan_ipaddr=`nvram get lan_ipaddr`
	if [ "$ss_DNS_Redirect" == "1" ] && [ ! -z "$lan_ipaddr" ] ; then
	iptables-restore -n <<-EOF
*nat
:AD_BYBY_DNS_LAN_DG - [0:0]
:AD_BYBY_DNS_LAN_AC - [0:0]
:AD_BYBY_DNS_WAN_AC - [0:0]
:AD_BYBY_DNS_WAN_FW - [0:0]
-A AD_BYBY_DNS_LAN_DG -d $lan_ipaddr -p udp -j RETURN
-A AD_BYBY_DNS_LAN_DG -d $ss_DNS_Redirect_IP -p udp -j RETURN
-A AD_BYBY_DNS_LAN_DG -j AD_BYBY_DNS_LAN_AC
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_bp src -j RETURN
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_fw src -j AD_BYBY_DNS_WAN_FW
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_ac src -j AD_BYBY_DNS_WAN_AC
-A AD_BYBY_DNS_LAN_AC -j ${DNS_LAN_TARGET:=AD_BYBY_DNS_WAN_AC}
-A AD_BYBY_DNS_WAN_AC -j AD_BYBY_DNS_WAN_FW
COMMIT
EOF
		logger -t "【Adbyby】" "udp53端口（DNS）地址重定向为 $ss_DNS_Redirect_IP 强制使用重定向地址的DNS"
		iptables -t nat -A PREROUTING -s $lan_ipaddr/24 -p udp --dport 53 -j AD_BYBY_DNS_LAN_DG
		iptables -t nat -A AD_BYBY_DNS_WAN_FW -j DNAT --to $ss_DNS_Redirect_IP
	fi

}

#检查 dnsmasq 目录参数
if [ -z "$confdir" ] ; then 
	confdir="/tmp/ss/dnsmasq.d"
fi
[ ! -z "$confdir" ] && mkdir -p $confdir
[ -z "$gfwlist" ] && gfwlist=/r.gfwlist.conf
[ -z "$gfw_black_list" ] && gfw_black_list=gfwlist

#killall -9 sh_adblock_hosts.sh
#/tmp/sh_adblock_hosts.sh $confdir &

if [ "$adb" = "D" ] ; then
	logger -t "【iptables】" "删除8118转发规则"
	flush_r
	rm -f /tmp/adbyby_host.conf
	sed -Ei '/adbyby_host.conf/d' /etc/storage/dnsmasq/dnsmasq.conf
	restart_dhcpd
	logger -t "【iptables】" "完成删除8118规则"
fi
if [ "$adb" = "A" ] ; then
	logger -t "【iptables】" "添加8118转发规则"
	# rules规则
	flush_r
	ipset -! restore <<-EOF || return 1
create ad_spec_src_ac hash:ip hashsize 64
create ad_spec_src_bp hash:ip hashsize 64
create ad_spec_src_fw hash:ip hashsize 64
create ad_spec_dst_sp hash:net hashsize 64
$(gen_special_purpose_ip | sed -e "s/^/add ad_spec_dst_sp /")
EOF
ipset -! -N cflist iphash
ipset -! -N adbybylist iphash
lan_ipaddr=`nvram get lan_ipaddr`
ipset add ad_spec_src_bp $lan_ipaddr
ipset add ad_spec_src_bp 127.0.0.1
ipset add adbybylist 100.100.100.100
/etc/storage/ad_config_script.sh
# 内网(LAN)访问控制
logger -t "【Adbyby】" "设置内网(LAN)访问控制"
if [ -n "$AD_LAN_AC_IP" ] ; then
	case "${AD_LAN_AC_IP:0:1}" in
		0)
			LAN_TARGET="AD_BYBY_WAN_AC"
			DNS_LAN_TARGET="AD_BYBY_DNS_WAN_AC"
			;;
		1)
			LAN_TARGET="AD_BYBY_to"
			DNS_LAN_TARGET="AD_BYBY_DNS_WAN_FW"
			;;
		2)
			LAN_TARGET="RETURN"
			DNS_LAN_TARGET="RETURN"
			;;
	esac
fi
grep -v '^#' /tmp/ad_spec_lan_DOMAIN.txt | sort -u | grep -v "^$" | sed s/！/!/g > /tmp/ad_spec_lan.txt
while read line
do
for host in $line; do
	case "${host:0:1}" in
		n|N)
			ipset add ad_spec_src_ac ${host:2}
			;;
		b|B)
			ipset add ad_spec_src_bp ${host:2}
			;;
		g|G)
			ipset add ad_spec_src_fw ${host:2}
			;;
	esac
done
done < /tmp/ad_spec_lan.txt
	[ "$ipsets" == 0 ] && WAN_TARGET="AD_BYBY_to"
	[ "$ipsets" == 0 ] && ADBYBYLIST_TARGET="AD_BYBY_to"
	[ "$ipsets" == 1 ] && WAN_TARGET="RETURN"
	[ "$ipsets" == 1 ] && ADBYBYLIST_TARGET="AD_BYBY_to"
	include_ac_rules nat
	wifidognx=""
		#wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## SS_SPEC
		#if [ -z "$wifidogn" ] ; then
			wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## Outgoing
			if [ -z "$wifidogn" ] ; then
				wifidogn=`iptables -t nat -L PREROUTING --line-number | grep vserver | awk '{print $1}' | awk 'END{print $1}'`  ## vserver
				if [ -z "$wifidogn" ] ; then
					wifidognx=1
				else
					wifidognx=`expr $wifidogn + 1`
				fi
			else
				wifidognx=`expr $wifidogn + 1`
			fi
		#else
		#	wifidognx=`expr $wifidogn + 1`
		#fi
	wifidognx=$wifidognx
	echo "AD_BYBY-number:$wifidogn"
	iptables -t nat -I PREROUTING $wifidognx -p tcp -m multiport --dports 80,8080 -j AD_BYBY
	iptables -t nat -A AD_BYBY_to -p tcp -j REDIRECT --to-port 8118
	dns_redirect
	sleep 1
	gen_include &
	logger -t "【iptables】" "完成添加8118规则"
fi
#去除gfw donmain中与 adbyby host 包含的域名，这部分域名交由adbyby处理。
# 参考的awk指令写法
#  awk  'NR==FNR{a[$0]}NR>FNR{ if($1 in a) print $0}' file1 file2 #找出两文件中相同的值
#  awk  'NR==FNR{a[$0]}NR>FNR{ if(!($1 in a)) print $0}' file1 file2 #去除 file2 中file1的内容
#  awk 'NR==FNR{a[$0]++} NR>FNR&&a[$0]' file1 file2 #找出两个文件之间的相同部分
#  awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' file1 file2 #去除 file2 中file1的内容
if [ "$ipsets" == 1 ] && [ -s /tmp/adbyby_host.conf ] && [ "$adb" = "C" ] ; then
logger -t "【iptables】" "添加 ipset 转发规则"
sed -Ei '/adbyby_host.conf|cflist.conf/d' /etc/storage/dnsmasq/dnsmasq.conf
	sed  "s/\/adbyby_list/\/adbybylist/" -i  /tmp/adbyby_host.conf
	whitehost=`sed -n 's/.*whitehost=\(.*\)/\1/p' /tmp/bin/adhook.ini`
	[ ! -z $whitehost ] && sed -Ei "/$(echo $whitehost | tr , \|)/d" /tmp/adbyby_host.conf
	[ -f "$confdir$gfwlist" ] && gfw_black=$(grep "/$gfw_black_list" "$confdir$gfwlist" | sed 's/.*\=//g')
	if [ -s "$confdir$gfwlist" ] && [ -s /tmp/adbyby_host.conf ]  && [ ! -z "$gfw_black" ] ; then
		logger -t "【iptables】" "adbybylist 规则处理开始"
		mkdir -p /tmp/b/
		sed -e '/^\#/d' -e "s/ipset=\/www\./ipset=\/\./" -e "s/ipset=\/bbs\./ipset=\/\./" -e "s/ipset=\/\./ipset=\//" -e "s/ipset=\//ipset=\/\./" -i /tmp/adbyby_host.conf
		sed -e '/^\#/d' -e "s/ipset=\/www\./ipset=\/\./" -e "s/ipset=\/bbs\./ipset=\/\./" -e "s/ipset=\/\./ipset=\//" -e "s/ipset=\//ipset=\/\./" -i "$confdir$gfwlist"
		sed -e '/^\#/d' -e "s/ipset=\///" -e "s/adbybylist//" /tmp/adbyby_host.conf > /tmp/b/adbyby_host去干扰.conf
		sed -e '/^\#/d' -e "s/ipset=\///" -e "s/$gfw_black_list//" -e "/server=\//d" "$confdir$gfwlist" > /tmp/b/gfwlist去干扰.conf
		awk 'NR==FNR{a[$0]++} NR>FNR&&a[$0]' /tmp/b/adbyby_host去干扰.conf /tmp/b/gfwlist去干扰.conf > /tmp/b/host相同行.conf
		if [ -s /tmp/b/host相同行.conf ] ; then
			logger -t "【iptables】" "gfwlist 规则处理开始"
			sed -e "s/^/ipset=\//" -e "s/$/adbybylist/" /tmp/b/host相同行.conf > /tmp/b/host相同行2.conf
			awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' /tmp/b/host相同行2.conf /tmp/adbyby_host.conf > /tmp/b/adbyby_host不重复.conf
			sed -e "s/^/ipset=\//" -e "s/$/$gfw_black_list/" /tmp/b/host相同行.conf > /tmp/b/host相同行2.conf
			awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' /tmp/b/host相同行2.conf "$confdir$gfwlist" > /tmp/b/gfwlist不重复.conf
			sed -e "s/^/ipset=\//" -e "s/$/cflist/" /tmp/b/host相同行.conf > /tmp/b/list重复.conf
			cp -a -v /tmp/b/adbyby_host不重复.conf /tmp/adbyby_host.conf
			cp -a -v /tmp/b/gfwlist不重复.conf "$confdir$gfwlist"
			#rm -f "$confdir/cflist.conf"
			#cp -a -v /tmp/b/list重复.conf "$confdir/cflist.conf"
			cat /tmp/b/list重复.conf >> "$confdir/cflist.conf"
			logger -t "【iptables】" "gfwlist 规则处理完毕"
		fi
		grep -v '^#' $confdir/cflist.conf | sort -u | grep -v "^$" > /tmp/ss/cflist.conf
		grep -v '^#' /tmp/ss/cflist.conf | sort -u | grep -v "^$" > $confdir/cflist.conf
		echo "conf-file=$confdir/cflist.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
	fi
echo "conf-file=/tmp/adbyby_host.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
ipset flush cflist
ipset flush adbybylist
ipset add adbybylist 100.100.100.100
restart_dhcpd
logger -t "【iptables】" "adbybylist 规则处理完毕"
rm -f /tmp/b/*
fi
sleep 1
/etc/storage/ez_buttons_script.sh 3 &
#restart_dhcpd

EOFAD
chmod 777 "/tmp/sh_adb8118.sh"
cat > "/tmp/sh_mon.sh" <<-\EOF
#!/bin/sh
logger -t "【Adbyby】" "adbyby 进程守护启动"
rm -f /tmp/cron_adb.lock
reb=1
runx="1"
while [ "1" ];
do
if [ -s "/tmp/bin/adbyby" ] ; then
	sleep 61
	if [ ! -f /tmp/cron_adb.lock ] ; then
		if [ "$reb" -gt 5 ] && [ $(cat /tmp/reb.lock) == "1" ] ; then
			LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
			echo '['$LOGTIME'] 网络连接中断['$reb']，reboot.' >> /opt/log.txt 2>&1
			sleep 5
			reboot
		fi
		#wget --continue --no-check-certificate --spider --quiet --timeout=6 www.163.com
		#if [ "$?" == "0" ] ; then
		baidu='http://gb.corp.163.com/gb/images/spacer.gif'
		/tmp/sh_download.sh /tmp/small_blank.gif $baidu
		if [ ! -s /tmp/small_blank.gif ] && [ ! -f /tmp/cron_adb.lock ] ; then
			restart_dhcpd
			sleep 30
			/tmp/sh_download.sh /tmp/small_blank.gif $baidu
		fi
		if [ -s /tmp/small_blank.gif ] && [ ! -f /tmp/cron_adb.lock ] ; then
		reb=1
			PIDS=$(ps | grep "/tmp/bin/adbyby" | grep -v "grep" | grep -v "adbybyupdate.sh" | grep -v "adbybyfirst.sh" | wc -l)
			if [ "$PIDS" = 0 ] ; then 
				logger -t "【Adbyby】" "网络连接正常"
				logger -t "【Adbyby】" "找不到进程, 重启 adbyby"
				/tmp/sh_adb8118.sh D
				killall -15 adbyby
				killall -9 adbyby
				sleep 3
				/tmp/bin/adbyby >/dev/null 2>&1 &
				sleep 20
				reb=`expr $reb + 1`
			fi
			if [ "$PIDS" -gt 2 ] ; then 
				logger -t "【Adbyby】" "进程重复, 重启 adbyby"
				/tmp/sh_adb8118.sh D
				killall -15 adbyby
				killall -9 adbyby
				sleep 3
				/tmp/bin/adbyby >/dev/null 2>&1 &
				sleep 20
			fi
			port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
				if [ "$port" -gt 1 ] && [ ! -f /tmp/cron_adb.lock ] ; then
					logger -t "【Adbyby】" "有多个8118转发规则, 删除多余"
					/tmp/sh_adb8118.sh D
				fi
			port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
				if [ "$port" = 0 ] && [ ! -f /tmp/cron_adb.lock ] ; then
					logger -t "【Adbyby】" "找不到8118转发规则, 重新添加"
					/tmp/sh_adb8118.sh A
				fi
			runx=`expr $runx + 1`
			if [ "$runx" -gt 720 ] ; then
			runx="1"
			checka="/tmp/var/video.txt"
			rm -f /tmp/var/video.txt
			urla="http://update.adbyby.com/rule3/video.txt"
			checkb="/tmp/bin/data/video.txt"
			wgetcurl.sh $checka $urla
				if [ "`md5sum $checka|cut -d" " -f1`" != "`md5sum $checkb|cut -d" " -f1`" ] ; then
					logger -t "【Adbyby】" "守护检查:有更新 $urla , 重启进程"
					/tmp/sh_adb8118.sh D
					killall -15 adbyby
					killall -9 adbyby
					rm -f /tmp/cron_adb.lock
					nvram set adbyby_status="restart_firewall"
					restart_firewall &
					sleep 62
				else
					logger -t "【Adbyby】" "守护检查:不需更新 $urla "
				fi
			fi
		else
			# logger -t "【Adbyby】" "网络连接中断 $reb, 关闭 adbyby"
			port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
			while [[ "$port" != 0 ]] 
			do
				logger -t "【Adbyby】" "网络连接中断 $reb, 关闭 adbyby"
				/tmp/sh_adb8118.sh D
				port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
				sleep 5
			done
			PIDS=$(ps | grep "adbyby" | grep -v "grep" | wc -l)
			if [ "$PIDS" != 0 ] ; then 
				killall -15 adbyby
				killall -9 adbyby
			fi
			reb=`expr $reb + 1`
		fi
	fi
	/etc/storage/ez_buttons_script.sh 3 &
fi
if [ ! -f /tmp/cron_adb.lock ] && [ -s "/tmp/bin/adbyby" ] ; then
	PIDS=$(ps | grep "/tmp/bin/adbyby" | grep -v "grep" | grep -v "adbybyupdate.sh" | grep -v "adbybyfirst.sh" | wc -l)
	if [ "$PIDS" != 0 ] ; then
		port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【Adbyby】" "守护检查:找不到8118转发规则, 重新添加"
			killall -15 adbyby
			killall -9 adbyby
			rm -f /tmp/cron_adb.lock
			nvram set adbyby_status="restart_firewall"
			restart_firewall &
			sleep 62
		fi
	fi
fi
continue
done
EOF
chmod 777 "/tmp/sh_mon.sh"
cat > "/tmp/sh_CPUAverage.sh" <<-\EOF
#!/bin/sh
logger -t "【Adbyby】" "路由器负载监控启动"
while [ "1" ];
do
if [ ! -f /tmp/cron_adb.lock ] ; then
	CPULoad=`uptime |sed -e 's/\ *//g' -e 's/.*://g' -e 's/,.*//g' -e 's/\..*//g'`
	if [ $((CPULoad)) -ge "2" ] ; then
		logger -t "【Adbyby】" "CPU 负载拥堵, 关闭 adbyby"
		/tmp/sh_adb8118.sh D
		killall -15 adbyby
		killall -9 adbyby
		touch /tmp/cron_adb.lock
		while [[ "$CPULoad" -ge "2" ]] 
		do
			sleep 64
			CPULoad=`uptime |sed -e 's/\ *//g' -e 's/.*://g' -e 's/,.*//g' -e 's/\..*//g'`
		done
		logger -t "【Adbyby】" "CPU 负载正常"
		rm -f /tmp/cron_adb.lock
	fi
fi
sleep 63
done
EOF
chmod 777 "/tmp/sh_CPUAverage.sh"
cat > "/tmp/sh_installs.sh" <<-\EOF
#!/bin/sh
ssfile=$1
installs=$2
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
/tmp/sh_upopt.sh
if [ ! -f "/opt/opti.txt" ] ; then
	logger -t "【opt】" "自动安装（覆盖 opt 文件夹）"
	#rm -f /opt/* -R
	logger -t "【opt】" "opt 第一次下载"
	wgetcurl.sh /opt/opt.tgz $ssfile
	logger -t "【opt】" "opt 下载完成，开始解压"
	tar -xzvf /opt/opt.tgz -C /opt
	if [ ! -s "/opt/opti.txt" ] ; then
		logger -t "【opt】" "/opt/opt.tgz 下载失败"
		rm -f /opt/opt.tgz
		logger -t "【opt】" "opt 第二次下载"
		wgetcurl.sh /opt/opt.tgz $ssfile
		logger -t "【opt】" "opt 下载完成，开始解压"
		tar -xzvf /opt/opt.tgz -C /opt
	fi
	if [ -s "/opt/opti.txt" ] ; then
		logger -t "【opt】" "opt 解压完成"
		chmod 777 /opt -R
	fi
	
fi
if [ "$installs" = "2" ] ; then
	rm -f /opt/opt.tgz
else

chmod -R 777 /opt/bin/
chmod -R 777 /opt/lib/

fi
EOF
chmod 777 "/tmp/sh_installs.sh"
cat > "/tmp/sh_display.sh" <<-\EOF
#!/bin/sh
### script for hiboy
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
display_enable=`nvram get display_enable`
#[ "$display_enable" != "0" ] && nvram set display_enable=0
#exit
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
cp -a -v /etc/storage/display_lcd4linux_script.sh /tmp/lcd4linux.conf
display_enable=`nvram get display_enable`
display_weather=`nvram get display_weather`
display_aqidata=`nvram get display_aqidata`
if [ -z "$display_weather" ] ; then 
display_weather="2151330"
nvram set display_weather="2151330"

fi
if [ -z "$display_aqidata" ] ; then 
display_aqidata="beijing"
nvram set display_aqidata="beijing"
fi



keep_display(){
logger -t "【相框显示】" "获取天气信息"
/opt/lcd4linux/scripts/getweather
logger -t "【相框显示】" "获取AQI数据和数据绘图"
/opt/lcd4linux/scripts/getaqidata
logger -t "【相框显示】" " 守护脚本启动."
killall displaykeep.sh
cat > "/tmp/displaykeep.sh" <<-\DISPLAY
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
PRO_NAME="lcd4linux"
DISPLAYNUM=1
runx="1"

while true ; do
#   用ps获取 $PRO_NAME 进程数量
	NUM=`ps | grep $PRO_NAME | grep -v grep | grep -v scripts |wc -l`
#	echo $NUM
#	logger -t "【相框显示】" " $NUM 进程"
if [ "$NUM" -lt "$DISPLAYNUM" ] ; then
#   少于 $DISPLAYNUM ，重启进程
	logger -t "【相框显示】" "少于 $DISPLAYNUM, 重启进程"
	echo "$PRO_NAME was killed"
	nvram set display_status=00
	/tmp/sh_display.sh &
	sleep 10
elif [ "$NUM" -gt "$DISPLAYNUM" ] ; then
#   大于 $DISPLAYNUM ，杀掉所有进程，重启
	logger -t "【相框显示】" "大于 $DISPLAYNUM, 杀掉所有进程, 重启"
	echo "more than $DISPLAYNUM $PRO_NAME,killall $PRO_NAME"
	nvram set display_status=00
	/tmp/sh_display.sh &
	sleep 10
fi
sleep 180
runx=`expr $runx + 1`
if [ "$runx" -gt 10 ] ; then
# 每半小时获取天气信息
[ "`nvram get display_enable`" = "1" ] && [ -f /opt/lcd4linux/scripts/getweather ] && /opt/lcd4linux/scripts/getweather &
if [ "$runx" -gt 20 ] ; then
# 每1小时获取AQI数据和数据绘图
runx=1
[ "`nvram get display_enable`" = "1" ] && [ -f /opt/lcd4linux/scripts/getaqidata ] && /opt/lcd4linux/scripts/getaqidata &
fi
fi
done
exit 0
DISPLAY
chmod 755 "/tmp/displaykeep.sh"
/tmp/displaykeep.sh &
}



A_restart=`nvram get display_status`
display_lcd4linux_script=`cat /tmp/lcd4linux.conf`
B_restart="$display_enable$display_weather$display_aqidata$display_lcd4linux_script"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set display_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
	exit 1
fi
if [ ${display_enable:=0} ] && [ "$display_enable" -eq "0" ] && [ "$needed_restart" = "1" ] ; then
logger -t "【相框显示】" "停止程序"; killall lcd4linux getaqidata getweather sh_display.sh displaykeep.sh ; exit 0;
fi
if [ "$display_enable" = "1" ] ; then
	logger -t "【相框显示】" "启动程序"
	killall lcd4linux getaqidata getweather displaykeep.sh
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	[ ! -s "/etc/storage/display_lcd4linux_script.sh" ] && cp -a -v /opt/lcd4linux/lcd4linux.conf /etc/storage/display_lcd4linux_script.sh
	if [ ! -s "/etc/storage/display_lcd4linux_script.sh" ] || [ ! -s "/opt/bin/lcd4linux" ] ; then
	lcd1="https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/lcd.tgz"
	logger -t "【相框显示】" "下载LCD文件 $lcd1"
	/tmp/sh_download.sh "/opt/lcd.tgz" $lcd1
	/tmp/sh_untar.sh "/opt/lcd.tgz" "/opt/" "/opt/bin/lcd4linux"
	cp -a -v /opt/lcd4linux/lcd4linux.conf /etc/storage/display_lcd4linux_script.sh
	fi
	if [ ! -s "/etc/storage/display_lcd4linux_script.sh" ] ; then
		logger -t "【相框显示】" "缺少 /etc/storage/display_lcd4linux_script.sh 文件, 启动失败"
		logger -t "【相框显示】" "停止程序"
		killall lcd4linux getaqidata getweather sh_display.sh displaykeep.sh
		exit 0
	else
	hash lcd4linux 2>/dev/null || {  logger -t "【相框显示】" "找不到 lcd4linux, 需要手动安装 lcd4linux"; exit 0; }
	killall lcd4linux
	chmod 777 /opt/lcd4linux/scripts/getweather
	chmod 777 /opt/lcd4linux/scripts/getaqidata
	chmod 777 /etc/storage/display_lcd4linux_script.sh
	# 修改显示空间
	upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | sed -n '1p'`
	upanPath2="SpaceDir  \'\/tmp\' #显示空间"
	if [ ! -z "$upanPath" ] ; then 
		upanPath2="SpaceDir  \'\/media\/$upanPath\' #显示空间"
	fi
	sed -e "s/SpaceDir\ \ .*/$upanPath2/" -i /etc/storage/display_lcd4linux_script.sh
	cp -a -v /etc/storage/display_lcd4linux_script.sh /tmp/lcd4linux.conf
	chmod 600 /tmp/lcd4linux.conf
	chmod 777 /opt/bin/lcd4linux
	export LD_LIBRARY_PATH=/opt/lib
	lcd4linux -f /tmp/lcd4linux.conf
	export LD_LIBRARY_PATH=/lib:/opt/lib
	logger -t "【相框显示】" "开始显示数据"
	display_lcd4linux_script=`cat /tmp/lcd4linux.conf`
	B_restart="$display_enable$display_weather$display_aqidata$display_lcd4linux_script"
	B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
	nvram set display_status=$B_restart
	keep_display
	fi
fi


EOF
chmod 777 "/tmp/sh_display.sh"
cat > "/tmp/sh_xun_lei.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
xunleis=`nvram get xunleis`
xunleis_dir=`nvram get xunleis_dir`
[ -z $xunleis_dir ] || [ ! -d "$xunleis_dir" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | sed -n '1p'` && [ ! -z $upanPath ] && nvram set xunleis_dir=/media/$upanPath
xunleis_dir=`nvram get xunleis_dir`
xunleiPath=$xunleis_dir/xunlei
if [ "$xunleis" = "0" ] ; then
nvram set xunleis_sn=""
[ ! -z "`pidof ETMDaemon`" ] && { killall -9 ETMDaemon ; killall -9 EmbedThunderManager ; killall -9 vod_httpserver ; killall -9 sh_Thunder.sh ; killall portal ; } 
fi
if [ -z "`pidof ETMDaemon`" ] && [ "$xunleis" = "1" ] ; then
	{ killall -9 ETMDaemon ; killall -9 EmbedThunderManager ; killall -9 vod_httpserver ; killall -9 sh_Thunder.sh ; killall portal ; } 
	if [ ! -d "$xunleis_dir" ] ; then 
		logger -t "【迅雷下载】" "未挂载储存设备, 请重新检查配置、目录:$xunleis_dir "
		exit
	fi
	killall -9 sh_Thunder.sh
	[ ! -d $xunleiPath ] && mkdir -p -m 777 $xunleiPath
	logger -t "【迅雷下载】" "启动程序"
	[ -f "$xunleiPath/portal" ] && portal_md5=`md5sum "$xunleiPath/portal" | awk -F ' ' '{print $1}'`
	xunleimd5="86f8c2c931687c4876bdd8ca5febe038"
	if [ ! -s $xunleiPath"/lib/libgcc_s.so.1" ] || [ $portal_md5 != $xunleimd5 ] ; then
	logger -t "【迅雷下载】" "Xware1.0.31_mipsel_32_uclibc"
	Xware1="https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/Xware1.0.31_mipsel_32_uclibc.tgz"
	/tmp/sh_download.sh "$xunleiPath/Xware1.tgz" $Xware1
	/tmp/sh_untar.sh $xunleiPath"/Xware1.tgz" $xunleiPath "$xunleiPath/portal"
	fi
	[ -f "$xunleiPath/portal" ] && portal_md5=`md5sum "$xunleiPath/portal" | awk -F ' ' '{print $1}'`
	xunleimd5="86f8c2c931687c4876bdd8ca5febe038"
	if [ $portal_md5 != $xunleimd5 ] ; then
		rm -rf "$xunleiPath/Xware1.tgz" "$xunleiPath/portal"
		logger -t "【迅雷下载】" "xunlei 缺少 portal 文件"
		{ killall -9 ETMDaemon ; killall -9 EmbedThunderManager ; killall -9 vod_httpserver ; killall portal ; }
		logger -t "【迅雷下载】" "启动失败, 注意检查"$xunleiPath/portal", 10秒后自动尝试重新启动" && sleep 10 && /tmp/sh_xun_lei.sh &
	else
		chmod 777 "$xunleiPath/portal"
		#[ -f /opt/lib/libgcc_s.so.1 ] && cp -a -f /lib/libgcc_s.so.1 /opt/lib/libgcc_s.so.1
		#chmod 777 "/opt/lib/libgcc_s.so.1"
		chmod 777 $xunleiPath -R
		rm -f /tmp/xunlei.info
		export LD_LIBRARY_PATH="$xunleiPath/lib:/lib:/opt/lib"
		cd $xunleiPath
		"$xunleiPath/portal" >/dev/null 2>&1 &
		sleep 44
		export LD_LIBRARY_PATH="/lib:/opt/lib"
		/tmp/sh_download.sh "/tmp/xunlei.info" "http://127.0.0.1:9000/getsysinfo" "http://127.0.0.1:9001/getsysinfo"
		[ ! -f /tmp/xunlei.info ] && /tmp/sh_download.sh "/tmp/xunlei.info" "http://`nvram get lan_ipaddr`:9002/getsysinfo" "http://`nvram get lan_ipaddr`:9003/getsysinfo"
		logger -t "【迅雷下载】" "启动 xunlei, 绑定设备页面【http://yuancheng.xunlei.com】"
		logger -t "【迅雷下载】" "在浏览器中输入【http://`nvram get lan_ipaddr`:9000/getsysinfo】"
		logger -t "【迅雷下载】" "显示错误则输入【http://`nvram get lan_ipaddr`:9001/getsysinfo】"
		logger -t "【迅雷下载】" "会看到类似如下信息："
		logger -t "【迅雷下载】" "`cat /tmp/xunlei.info | sed s/[[:space:]]//g `"
		nvram set xunleis_sn=`cat /tmp/xunlei.info | sed s/[[:space:]]//g | sed s/"\["//g | sed s/"\]"//g`
		logger -t "【迅雷下载】" "其中有用的几项为："
		logger -t "【迅雷下载】" "①: 0表示返回结果成功"
		logger -t "【迅雷下载】" "②: 1表示检测网络正常, 0表示检测网络异常"
		logger -t "【迅雷下载】" "④: 1表示已绑定成功, 0表示未绑定"
		logger -t "【迅雷下载】" "⑤: 未绑定的情况下, 为绑定的需要的激活码"
		logger -t "【迅雷下载】" "⑥: 1表示磁盘挂载检测成功, 0表示磁盘挂载检测失败"
		logger -t "【迅雷下载】" "如果出现错误可以手动启动, 输入以下命令测试"
		logger -t "【迅雷下载】" "export LD_LIBRARY_PATH=$xunleiPath/lib:/lib:/opt/lib ; $xunleiPath/portal"
		/tmp/sh_Thunder.sh &
	fi
fi

EOF
chmod 777 "/tmp/sh_xun_lei.sh"
cat > "/tmp/sh_ssmon.sh" <<-\EOF
#!/bin/sh
cat > "/tmp/sh_ssmon_k.sh" <<-\SSMK
#!/bin/sh
ss_enable=`nvram get ss_enable`
if [ ! -f /tmp/cron_ss.lock ] && [ "$ss_enable" = "1" ] ; then
eval $(ps  | grep "/tmp/sh_ssmon.sh" | grep -v grep | awk '{print "kill "$1}')
/tmp/sh_ssmon.sh &
fi
SSMK
chmod 777 "/tmp/sh_ssmon_k.sh"
eval $(ps  | grep "sleep 919" | grep -v grep | awk '{print "kill "$1}')
{ sleep 919; /tmp/sh_ssmon_k.sh ; } &
rebss=1
ss_rdd_server=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
ss_run_ss_local=`nvram get ss_run_ss_local`
ss_mode_x=`nvram get ss_mode_x`
ss_mode_x=${ss_mode_x:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_rdd_server=""
rm -f /tmp/cron_ss.lock
ss_enable=`nvram get ss_enable`
while [ "$ss_enable" = "1" ];
do
ss_internet=`nvram get ss_internet`
sleep 9
#随机延时
if [ "$ss_internet" = "1" ] ; then
	SEED=`tr -cd 0-9 </dev/urandom | head -c 8`
	RND_NUM=`echo $SEED 60 200|awk '{srand($1);printf "%d",rand()*10000%($3-$2)+$2}'`
	sleep $RND_NUM
fi
/etc/storage/ez_buttons_script.sh 3 &
ss_enable=`nvram get ss_enable`
if [ ! -f /tmp/cron_ss.lock ] && [ "$ss_enable" = "1" ] ; then
	if [ "$rebss" -gt 6 ] && [ $(cat /tmp/reb.lock) == "1" ] ; then
		LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
		logger -t "【SS】" "['$LOGTIME'] 网络连接 shadowsocks 中断['$rebss'], 重启路由."
		sleep 5
		reboot
	fi
	if [ "$rebss" -gt 6 ] ; then
	if [ "$kcptun2_enable" = "1" ] || [ -z $ss_rdd_server ] ; then
		logger -t "【SS】" "[$LOGTIME] 网络连接 shadowsocks 中断 ['$rebss'], 重启SS."
		/etc/storage/ez_buttons_script.sh cleanss &
		sleep 5
		exit 0
	fi
	fi
	if [ "$ss_mode_x" = "3" ] || [ "$ss_run_ss_local" = "1" ] ; then
	NUM=`ps | grep ss-local_ | grep -v grep |wc -l`
	SSRNUM=1
	[ ! -z $ss_rdd_server ] && SSRNUM=2
	if [ "$NUM" -lt "$SSRNUM" ] ; then
		logger -t "【SS】" "找不到 $SSRNUM ss-local 进程 $rebss, 重启SS."
		/etc/storage/ez_buttons_script.sh cleanss &
		sleep 5
		exit 0
	fi
	fi
	if [ "$ss_mode_x" != "3" ] ; then
	NUM=`ps | grep ss-redir_ | grep -v grep |wc -l`
	SSRNUM=1
	[ ! -z $ss_rdd_server ] && SSRNUM=2
	if [ "$NUM" -lt "$SSRNUM" ] ; then
		logger -t "【SS】" "找不到 $SSRNUM shadowsocks 进程 $rebss, 重启SS."
		/etc/storage/ez_buttons_script.sh cleanss &
		sleep 5
		exit 0
	fi
	if [ -z "`pidof pdnsd`" ] ; then
		logger -t "【SS】" "找不到 pdnsd 进程 $rebss，重启 pdnsd"
		/tmp/ss.sh repdnsd &
		sleep 10
	fi
	#SS进程监控和双线切换
	#思路：
	#先将所有ss通道全部拉起来，默认服务器为1090端口，新服务器为1091端口，默认走通道0，DNS的ss-tunnel 走8053 和 8054
	#检查SS通道是否可以连接google，如果不能，则看看网易是否正常，如果网易正常，而google无法打开，则说明当前SS通道有问题
	#通道有问题时，先logger记录，然后切换SS通道端口和修改 
	# sh_ssmon 建议不要重启网络，会导致断线。正常来说,ss服务基本上稳定不需要重启，我公司路由的ss客户端跑20多台机器将近3个多月没动过了。



	LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")

	#检查是否存在当前SS服务器，没有则设为0，准备切换服务器设为1
	CURRENT=`nvram get ss_working_port`
	ss_udp_enable=`nvram get ss_udp_enable` #udp转发  0、停用；1、启动
	ss_upd_rules=`nvram get ss_upd_rules`
	ss_pdnsd_wo_redir=`nvram get ss_pdnsd_wo_redir` #pdnsd  1、直连；0、走代理

	[ ${CURRENT:=1090} ] && [ $CURRENT == 1091 ] && Server=1090 || Server=1091

	#检查是否存在SS备份服务器, 这里通过判断 ss_rdd_server 是否填写来检查是否存在备用服务器


	curltest=`which curl`
	if [ -z "$curltest" ] ; then
		wget --continue --no-check-certificate -s -q -T 10 www.163.com
		[ "$?" == "0" ] && check=200 || { check=404; sleep 5; }
		[ "$check" == "404" ] && wget --continue --no-check-certificate -s -q -T 10 www.163.com
		[ "$check" == "404" ] && [ "$?" == "0" ] && check=200 || check=404
	else
		check=`curl -k -s -w "%{http_code}" "www.163.com" -o /dev/null`
	fi
	if [ "$check" == "200" ] ; then
		echo "[$LOGTIME] Internet have no problem."
	else
		logger -t "【SS】" "[$LOGTIME] Internet 问题, 请检查您的服务供应商."
		rebss=`expr $rebss + 1`
		restart_dhcpd ; sleep 1
	fi

	curltest=`which curl`
	if [ -z "$curltest" ] ; then
		wget --continue --no-check-certificate -s -q -T 10 http://www.google.com.hk
		[ "$?" == "0" ] && check=200 || check=404
	else
		check=`curl -k -s -w "%{http_code}" "http://www.google.com.hk" -o /dev/null`
	fi
	if [ "$check" == "200" ] ; then
		eval $(ps  | grep "/tmp/ss.sh" | grep -v grep | awk '{print "kill "$1}')
		echo "[$LOGTIME] SS $CURRENT have no problem."
		rebss="1"
		nvram set ss_internet="1"
	else
		sleep 5
	if [ -n "`pidof ss-redir`" ] && [ "$ss_enable" = "1" ] && [ "$ss_mode_x" != "3" ] ; then
		port=$(iptables -t nat -L | grep 'SS_SPEC' | wc -l)
		if [ "$port" = 0 ] ; then
			sleep 35
		fi
		port=$(iptables -t nat -L | grep 'SS_SPEC' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【SS】" "检测:找不到 SS_SPEC 转发规则, 重新添加"
			/tmp/ss.sh rules
			restart_dhcpd
			sleep 5
		fi
	fi
		curltest=`which curl`
		if [ -z "$curltest" ] ; then
			wget --continue --no-check-certificate -s -q -T 10 http://www.google.com.hk
			[ "$?" == "0" ] && check=200 || check=404
		else
			check=`curl -k -s -w "%{http_code}" "http://www.google.com.hk" -o /dev/null`
		fi
		if [ "$check" == "200" ] ; then
			echo "[$LOGTIME] SS $CURRENT have no problem."
			rebss="1"
			nvram set ss_internet="1"
		else
		if [ "$kcptun2_enable" = "1" ] ; then
			nvram set ss_internet="2"
			rebss=`expr $rebss + 2`
			logger -t "【SS】" "[$LOGTIME] SS 服务器 $CURRENT 检测到问题, $rebss"
			#跳出当前循环
			continue
		fi
		if [ ! -z $ss_rdd_server ] ; then
			logger -t "【SS】" "[$LOGTIME] SS $CURRENT 检测到问题, 尝试切换到 SS $Server"
			nvram set ss_internet="2"
			#端口切换
			iptables -t nat -D SS_SPEC_WAN_FW -p tcp -j REDIRECT --to-port $CURRENT
			iptables -t nat -A SS_SPEC_WAN_FW -p tcp -j REDIRECT --to-port $Server
			if [ "$ss_udp_enable" == 1 ] ; then
				iptables -t mangle -D SS_SPEC_WAN_FW -p udp -j TPROXY --on-port $CURRENT --tproxy-mark 0x01/0x01
				iptables -t mangle -A SS_SPEC_WAN_FW -p udp -j TPROXY --on-port $Server --tproxy-mark 0x01/0x01
			fi
			if [ "$ss_pdnsd_wo_redir" == 0 ] ; then
			# pdnsd 是否直连  1、直连；0、走代理
				iptables -t nat -D OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j REDIRECT --to-port $CURRENT
				iptables -t nat -D OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j REDIRECT --to-port $CURRENT
				iptables -t nat -I OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j REDIRECT --to-port $Server
				iptables -t nat -I OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j REDIRECT --to-port $Server
			fi
			#加上切换标记
			nvram set ss_working_port=$Server
			#检查切换后的状态
			TAG="SS_SPEC"		  # iptables tag
			FWI="/tmp/firewall.shadowsocks.pdcn" # firewall include file

cat <<-CATIP >>$FWI
iptables-restore -n <<-EOFIP
$(iptables-save | sed  "s/webstr--url/webstr --url/g" | grep -E "$TAG|^\*|^COMMIT" |sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/")
EOFIP
CATIP

		fi
		restart_dhcpd
		sleep 5
		curltest=`which curl`
		if [ -z "$curltest" ] ; then
			wget --continue --no-check-certificate -s -q -T 10 http://www.google.com.hk
			[ "$?" == "0" ] && check=200 || check=404
		else
			check=`curl -k -s -w "%{http_code}" "http://www.google.com.hk" -o /dev/null`
		fi
		if [ "$check" == "200" ] ; then
			logger -t "【SS】" "[$LOGTIME] SS 服务器 `nvram get ss_working_port` 连接."
			#exit 0
		else
			nvram set ss_internet="0"
			[ ! -z $ss_rdd_server ] && logger -t "【SS】" "[$LOGTIME] 两个 SS 服务器检测到问题, $rebss"
			[ -z $ss_rdd_server ] && logger -t "【SS】" "[$LOGTIME]  SS 服务器 $CURRENT 检测到问题, $rebss"
			rebss=`expr $rebss + 1`
			restart_dhcpd
			#/etc/storage/crontabs_script.sh &
		fi
		fi
	fi
	fi

fi

done


EOF
chmod 777 "/tmp/sh_ssmon.sh"
cat > "/tmp/sh_syncyquota.sh" <<-\EOF
#!/bin/sh
logger -t "【SyncY】" "等待 SyncY 同步软件启动, SyncY 同步软件技术博客：http://www.syncy.cn/"
while [ ! -s "/tmp/syncy.quota" ] 
do
	sleep 11
	if [ -s "/tmp/syncy.user_code" ] ; then
		user_code_log=`cat /tmp/syncy.user_code`
		logger -t "【SyncY】" "$user_code_log"
		logger -t "【SyncY】" "打开百度授权页面 https://openapi.baidu.com/device"
		logger -t "【SyncY】" "输入用户码【$user_code_log】（请在100秒内输入用户码）"
		while [ ! -s "/tmp/syncy.user_token" ] 
		do
			sleep 12
			if [ -s "/tmp/syncy.user_token" ] ; then
				user_code_log=`cat /tmp/syncy.user_token`
				logger -t "【SyncY】" "$user_code_log"
				logger -t "【SyncY】" "显示【Get device token success.】表示授权完成。"
			fi
		done
	fi
done
[ -s "/tmp/syncy.quota" ] && /tmp/sh_syncyd.sh &
user_code_log=`cat /tmp/syncy.quota`
logger -t "【SyncY】" "$user_code_log"
logger -t "【SyncY】" "SyncY 同步启动成功"
logger -t "【SyncY】" "SyncY 同步软件技术博客:http://www.syncy.cn/"
EOF
chmod 777 "/tmp/sh_syncyquota.sh"
cat > "/tmp/sh_syncyd.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
logger -t "syncy" "SyncY守护进程启动"
pid_file="/var/run/syncy.pid"
start_cmd="/opt/etc/syncy.py &"

while true; do
	localpath=`cat /opt/etc/syncy |grep "localpath" | sed "s/option localpath//g" | sed "s/'//g" | sed "s/#本地同步目录//g"`
	if [ ! -d `echo $localpath` ] ; then
				logger -t "【SyncY】" "错误！！路由器本地同步目录不存在！！"
				logger -t "【SyncY】" "$localpath 设置错误！！请检查U盘文件和设置"
	fi
	running=$(ps | grep "/opt/etc/syncy.py" | grep -v "grep" | wc -l)
	if [ $running -le 0 ] ; then
		cd /opt/etc
		export LD_LIBRARY_PATH=/lib:/opt/lib
		python /opt/etc/syncy.py &
		#eval $start_cmd
		echo "start syncy"
		logger -t "【SyncY】" "SyncY 重新启动"
	else
		echo "syncy is running"
	fi
	sleep 65
done

EOF
chmod 777 "/tmp/sh_syncyd.sh"
cat > "/tmp/sh_orayd.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
logger -t "【花生壳内网版】" "守护进程启动"
online=""
orayslstatus=""
onlinetest()
{
	USER_DATA="/tmp/oraysl.status"
	orayslstatus=`head -n 3 $USER_DATA`
	SN=`head -n 2 $USER_DATA  | tail -n 1 | cut -d= -f2-`;
	STATUS=`head -n 3 $USER_DATA  | tail -n 1 | cut -d= -f2-`;
	szUID=`sed -n 's/.*szUID=*/\1/p' /etc/storage/PhMain.ini`
	nvram set phddns_sn=$SN
	nvram set phddns_st=$STATUS
	nvram set phddns_szUID=$szUID
	online=$(echo $orayslstatus | grep "ONLINE" | wc -l)
}
onlinetest
while [ $online -le 0 ]; do
	sleep 68
	onlinetest
	logger -t "【花生壳内网版】" "$online"
done
logger -t "【花生壳内网版】" "ONLINE"
while true; do
	sleep 68
	onlinetest
	running=$(ps | grep "oraynewph -s 0.0.0.0" | grep -v "grep" | wc -l)
	running2=$(ps | grep "oraysl -a 127.0.0.1" | grep -v "grep" | wc -l)
	if [ $running -gt 1 ] || [ $running2 -gt 1 ] ; then
		logger -t "【花生壳内网版】" "状态:【$orayslstatus 】, 进程重复, 重新启动"
		killall oraynewph oraysl
	fi
	onlinetest
	if [ ! -n "`pidof oraynewph`" ] || [ ! -n "`pidof oraysl`" ] || [ $online -le 0 ] ; then
		killall oraynewph oraysl
		logger -t "【花生壳内网版】" "状态:【$orayslstatus 】, 重新启动"
		/tmp/sh_phddns.sh &
		echo "oray is running2"
	else
		echo "oray is running"
	fi
done

EOF
chmod 777 "/tmp/sh_orayd.sh"
cat > "/tmp/sh_Thunder.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
xunleis_dir=`nvram get xunleis_dir`
[ -z $xunleis_dir ] || [ ! -d "$xunleis_dir" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | sed -n '1p'` && [ ! -z $upanPath ] && nvram set xunleis_dir=/media/$upanPath
xunleis_dir=`nvram get xunleis_dir`
xunleiPath=$xunleis_dir/xunlei
logger -t "【迅雷下载】" "守护进程启动 $upanPath"
if [ -s $xunleiPath/portal ] ; then
	while true; do
		running=$(ps | grep "/xunlei/lib/" | grep -v "grep" | wc -l)
		if [ $running -le 2 ] || [ ! -s $xunleiPath/portal ] ; then
			[ "$xunleis" = "1" ] && { killall -9 ETMDaemon ; killall -9 EmbedThunderManager ; killall -9 vod_httpserver ; killall portal ; }
			/tmp/sh_xun_lei.sh &
			logger -t "【迅雷下载】" "重新启动"
		else
			echo "xunlei is running"
		fi
		sleep 71
	done
else
	logger -t "【迅雷下载】" "找不到文件 $xunleiPath/portal"
	{ killall -9 ETMDaemon ; killall -9 EmbedThunderManager ; killall -9 vod_httpserver ; killall portal ; }
	logger -t "【迅雷下载】" "启动失败, 注意检查"$xunleiPath/portal", 10秒后自动尝试重新启动" && sleep 10 && /tmp/sh_xun_lei.sh &
fi
EOF
chmod 777 "/tmp/sh_Thunder.sh"
cat > "/tmp/sh_FastDick.sh" <<-\EOF
#!/bin/sh
#copyright by hiboy
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
uid=`nvram get FastDick_uid`
pwd=`nvram get FastDick_pwd`
FastDick_enable=`nvram get FastDick_enable`
FastDicks=`nvram get FastDicks`

A_restart=`nvram get FastDicks_status`
B_restart="$uid$pwd$FastDick_enable$FastDicks"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set FastDicks_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi

if [ "$needed_restart" = "1" ] ; then
killall FastDick_script.sh
[ "$FastDick_enable" = "0" ] && eval $(ps  | grep "/opt/FastDick/swjsq" | grep -v grep | awk '{print "kill "$1}')
fi
if [ "$FastDick_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
	killall FastDick_script.sh
	eval $(ps  | grep "/opt/FastDick/swjsq" | grep -v grep | awk '{print "kill "$1}')
	logger -t "【迅雷快鸟】" "迅雷快鸟(diǎo)路由器版:https://github.com/fffonion/Xunlei-FastDick"
	if [ "$FastDicks" = "2" ] ; then
		logger -t "【迅雷快鸟】" "稍等几分钟，ssh 到路由，控制台输入【ps】命令查看[/opt/FastDick/swjsq_wget.sh]进程是否存在，是否正常启动，提速是否成功。"
		logger -t "【迅雷快鸟】" "免 U盘 启动"
		chmod 777 "/etc/storage/FastDick_script.sh"
		/etc/storage/FastDick_script.sh &
	else
		hash python 2>/dev/null || {  logger -t "【迅雷快鸟】" "无法找到 python 程序，请检查系统"; exit 1; }
		rm -f "/opt/FastDick/" -R
		mkdir -p "/opt/FastDick"
		swjsqfile="https://raw.githubusercontent.com/fffonion/Xunlei-FastDick/master/swjsq.py"
		/tmp/sh_download.sh "/opt/FastDick/swjsq.py" $swjsqfile
		chmod 777 "/opt/FastDick/swjsq.py"
		logger -t "【迅雷快鸟】" "程序下载完成, 正在启动 python /opt/FastDick/swjsq.py"
		echo "$uid,$pwd" >/opt/FastDick/swjsq.account.txt
		chmod 777 /opt/FastDick -R
		cd /opt/FastDick
		export LD_LIBRARY_PATH=/lib:/opt/lib
		python /opt/FastDick/swjsq.py 2>&1 > /opt/FastDick/swjsq.log &
		chmod 777 "/opt/FastDick" -R
		sleep 30
		chmod 777 "/opt/FastDick" -R
		if [ -f /opt/FastDick/swjsq_wget.sh ] ; then
		logger -t "【迅雷快鸟】" "自动备份 swjsq 文件到路由, 【写入内部存储】后下次重启可以免U盘启动了"
			cat > "/etc/storage/FastDick_script.sh" <<-\EEF
#!/bin/sh
			# 迅雷快鸟【2免U盘启动】功能需到【自定义脚本0】配置【FastDicks=2】，并在此输入swjsq_wget.sh文件内容
			#【2免U盘启动】需要填写在下方的【迅雷快鸟脚本】，生成脚本两种方法：
			# ①插入U盘，配置自定义脚本【1插U盘启动】启动快鸟一次即可自动生成
			# ②打开https://github.com/fffonion/Xunlei-FastDick，按照网页的说明在PC上运行脚本，登陆成功后会生成swjsq_wget.sh，把swjsq_wget.sh的内容粘贴此处即可
			# 生成后需要到【系统管理】 - 【恢复/导出/上传设置】 - 【路由器内部存储 (/etc/storage)】【写入】保存脚本
EEF
			cat /opt/FastDick/swjsq_wget.sh >> /etc/storage/FastDick_script.sh
			chmod 777 "/etc/storage/FastDick_script.sh"
		fi
		logger -t "【迅雷快鸟】" "启动完成`cat /opt/FastDick/swjsq.log`"
	fi
fi
EOF
chmod 777 "/tmp/sh_FastDick.sh"
cat >/tmp/qos_scheduler.sh <<-\EOF
#!/bin/sh
qosc=$1
echo 0 >/tmp/qos_scheduler.lock
logger -t "【QOS】" "终端在线检查启动"
while [ "1" ];
do
	if [ "$(cat /tmp/qoss_state)" == "0" ] ; then
	logger -t "【QOS】" "终端在线检查暂停"
	rm -f /tmp/qos_scheduler.lock
	exit
	fi
	#qos_t=`cat /proc/net/arp|fgrep -c 0x2`
	qos_t=`cat /tmp/static_ip.num`
	qos_t=`expr $qos_t + 1`
	if [ $((qos_t)) -le $qosc ] ; then
		if [ $(ifconfig |grep -c imq0) -gt 0 ] ; then
		logger -t "【QOS】" "取消限速, 当在线 $qos_t台, 小于或等于 $qosc 台"
			ip link set imq0 down
			ip link set imq1 down
		fi
	else
		if [ $(ifconfig |grep -c imq0) -eq 0 ] ; then
			logger -t "【QOS】" "开始限速, 当在线 $qos_t台, 大于 $qosc 台"
			ip link set imq0 up
			ip link set imq1 up
			sleep 6
			port=$(iptables -t mangle -L | grep 'IMQ: todev 0' | wc -l)
			if [ "$port" = 0 ] ; then
				logger -t "【QOS】" "找不到 QOS 规则, 重新添加"
				/etc/storage/post_iptables_script.sh&
			fi
			
		fi
	fi
	sleep 69
continue
done
EOF
chmod 777 "/tmp/qos_scheduler.sh"
cat > "/tmp/sh_reFastDick.sh" <<-\EOF
#!/bin/sh
if [ "`nvram get FastDick_enable`" = "1" ] ; then
	logger -t "【迅雷快鸟】" "重新启动中……"
	killall FastDick_script.sh
	eval $(ps  | grep "/opt/FastDick/swjsq" | grep -v grep | awk '{print "kill "$1}')
	logger -t "【迅雷快鸟】" "已经关闭，1分钟后启动" && sleep 60
	logger -t "【迅雷快鸟】" "启动 /etc/storage/FastDick_script.sh"
	/etc/storage/FastDick_script.sh &
fi
EOF
chmod 777 "/tmp/sh_reFastDick.sh"
cat > "/tmp/sh_downloads_adblock.sh" <<-\EOF
#!/bin/sh
adblocks=`nvram get adbyby_adblocks`
rm -f /tmp/bin/data/user.bin
rm -f /tmp/bin/data/user.txt
if [ "$adblocks" = "1" ] ; then
	mkdir -p /tmp/data
	logger -t "【Adbyby】" "下载 adblock 规则"
	rm -f /tmp/bin/data/user3adblocks.txt
	while read line
	do
	c_line=`echo $line |grep -v "#"`
	if [ ! -z "$c_line" ] ; then
		logger -t "【Adbyby】" "下载规则:$line"
		/tmp/sh_download.sh /tmp/bin/data/user2.txt $line
		grep -v '^!' /tmp/bin/data/user2.txt | grep -E '^(@@\||\||[[:alnum:]])' | sort -u | grep -v "^$" >> /tmp/bin/data/user3adblocks.txt
		rm -f /tmp/bin/data/user2.txt
	fi
	done < /tmp/rule_DOMAIN.txt
fi
grep -v '^!' /etc/storage/adbyby_rules_script.sh | grep -v "^$" > /tmp/bin/data/user_rules.txt
EOF
chmod 777 "/tmp/sh_downloads_adblock.sh"

cat > "/tmp/sh_white_list.sh" <<-\EOF
#!/bin/sh
whitelist=`nvram get adbyby_whitehost_x`
whitehost=`nvram get adbyby_whitehost`
ipsets=`nvram get adbyby_mode_x`
if [ "$whitelist" = "1" ] ; then
	logger -t "【Adbyby】" "添加过滤白名单地址"
	logger -t "【Adbyby】" "加白地址:$whitehost"
	sed -Ei '/whitehost=/d' /tmp/bin/adhook.ini
	echo whitehost=$whitehost >> /tmp/bin/adhook.ini
	echo @@\|http://\$domain=$(echo $whitehost | tr , \|) >> /tmp/bin/data/user_rules.txt
fi
if [ "$ipsets" == 1 ] ; then
	logger -t "【Adbyby】" "添加 ipset 过滤设置"
	sed -Ei '/ipset=/d' /tmp/bin/adhook.ini
	echo ipset=1 >> /tmp/bin/adhook.ini
	sed -Ei '/sh_adb8118.sh|restart_dhcpd/d' /tmp/bin/adbybyfirst.sh /tmp/bin/adbybyupdate.sh
	echo "/tmp/sh_adb8118.sh C" >> /tmp/bin/adbybyfirst.sh
	echo "/tmp/sh_adb8118.sh C" >> /tmp/bin/adbybyupdate.sh
else
	sed -Ei '/ipset=/d' /tmp/bin/adhook.ini
	echo ipset=0 >> /tmp/bin/adhook.ini
	sed -Ei '/sh_adb8118.sh|restart_dhcpd/d' /tmp/bin/adbybyfirst.sh /tmp/bin/adbybyupdate.sh
fi
EOF
chmod 777 "/tmp/sh_white_list.sh"
cat > "/tmp/sh_func_load_adbyby.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

adbybys=`nvram get adbyby_enable`
ipsets=`nvram get adbyby_mode_x`
adbybyfile=`nvram get adbybyfile`
adbybyfile2=`nvram get adbybyfile2`
adblocks=`nvram get adbyby_adblocks`
ss_sub4=`nvram get ss_sub4`
CPUAverages=`nvram get adbyby_CPUAverages`
whitelist=`nvram get adbyby_whitehost_x`
whitehost=`nvram get adbyby_whitehost`
lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr
A_restart=`nvram get adbyby_status`
B_restart="$adbybys$ipsets$adbybyfile$adbybyfile2$adblocks$CPUAverages$ss_sub4$whitelist$whitehost$lan_ipaddr$lan_ipaddr$ss_DNS_Redirect$ss_DNS_Redirect_IP$ss_DNS_Redirect$(cat /etc/storage/ad_config_script.sh | grep -v "^$" | grep -v "^#")$(cat /etc/storage/adbyby_rules_script.sh | grep -v "^$" | grep -v "^!")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set adbyby_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
if [ ! -f /tmp/cron_adb.lock ] && [ -s "/tmp/bin/adbyby" ] && [ "$adbybys" = "1" ] ; then
	PIDS=$(ps | grep "/tmp/bin/adbyby" | grep -v "grep" | grep -v "adbybyupdate.sh" | grep -v "adbybyfirst.sh" | wc -l)
	if [ "$PIDS" != 0 ] ; then
		port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【Adbyby】" "定时检查:找不到8118转发规则, 重新添加"
			/tmp/sh_adb8118.sh A
		fi
	fi
fi
fi
if [ "$needed_restart" = "1" ] ; then
	nvram set adbybylazy="【adbyby未启动】lazy更新："
	nvram set adbybyvideo="【adbyby未启动】video更新："
	nvram set adbybyuser3="第三方规则行数：行"
	nvram set adbybyuser="自定义规则行数：行"
	killall -9 adbyby ; killall -15 adbyby ; killall sh_mon.sh ; killall sh_CPUAverage.sh ;
	[ "$(iptables -t nat -L | grep 'ports 8118' | wc -l)" != "0" ] && /tmp/sh_adb8118.sh D &
	sleep 1
	[ "$(iptables -t nat -L | grep 'ports 8118' | wc -l)" != "0" ] && /tmp/sh_adb8118.sh D &
	/etc/storage/ez_buttons_script.sh 3 &
	sleep 1
	[ "$adbybys" = "0" ] && { rm -f /tmp/cron_adb.lock; killall sh_func_load_adbyby.sh; }
fi
[ "$needed_restart" = "1" ] && { killall -9 adbyby ; killall -15 adbyby ; killall sh_mon.sh ; killall sh_CPUAverage.sh ; }
if [ -z "`pidof adbyby`" ] && [ "$adbybys" = "1" ] && [ ! -f /tmp/cron_adb.lock ] ; then
for module in ip_set ip_set_bitmap_ip ip_set_bitmap_ipmac ip_set_bitmap_port ip_set_hash_ip ip_set_hash_ipport ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_net ip_set_hash_netport ip_set_list_set xt_set xt_TPROXY
do
	modprobe $module
done 
	sleep 1
	touch /tmp/cron_adb.lock
	nvram set button_script_1_s="Adbyby"
	killall sh_mon.sh
	killall sh_CPUAverage.sh
	/tmp/sh_adb8118.sh D
	killall -15 adbyby
	killall -9 adbyby
	if [ ! -s "/tmp/bin/adbyby" ] ; then
		logger -t "【Adbyby】" "开始下载 7620n.tar.gz"
		/tmp/sh_download.sh /tmp/7620n.tar.gz $adbybyfile $adbybyfile2
		/tmp/sh_untar.sh /tmp/7620n.tar.gz /tmp /tmp/bin/adbyby
	fi
	if [ ! -s "/tmp/bin/adbyby" ] ; then
		logger -t "【Adbyby】" "开始下载 7620n.tar.gz"
		/tmp/sh_download.sh /tmp/7620n.tar.gz $adbybyfile2 $adbybyfile
		/tmp/sh_untar.sh /tmp/7620n.tar.gz /tmp /tmp/bin/adbyby
	fi
	if [ -s "/tmp/bin/adbyby" ] ; then
	sed -e '/^$/d' -i /etc/storage/dnsmasq/hosts
	sed -e '/.*127.0.0.1.*update.adbyby.com.*/d' -i /etc/storage/dnsmasq/hosts
	sed -e '/.*119.147.134.192.*update.adbyby.com/d' -i /etc/storage/dnsmasq/hosts
	sed -e '/.*210.14.141.213.*update.adbyby.com/d' -i /etc/storage/dnsmasq/hosts
	sed -e '/^$/d' -i /etc/storage/dnsmasq/dnsmasq.servers
	sed -Ei '/.*update.adbyby.com\/180.76.76.76.*/d' /etc/storage/dnsmasq/dnsmasq.servers
	curltest=`which curl`
	if [ -z "$curltest" ] ; then
		wget --continue --no-check-certificate -s -q -T 10 http://update.adbyby.com/rule3/video.txt
		[ "$?" == "0" ] && check=200 || check=404
	else
		check=`curl -k -s -w "%{http_code}" "http://update.adbyby.com/rule3/video.txt" -o /dev/null`
	fi
	if [ "$check" == "200" ] ; then
		echo "[$LOGTIME] update.adbyby.com have no problem."
		rm -rf /tmp/bin/data/video_B.txt /tmp/bin/data/lazy_B.txt
	else
		mkdir -p /tmp/bin/data
		logger -t "【Adbyby】" "下载规则失败, 强制 手动同步更新规则"
			xwhyc_rules="http://update.adbyby.com/rule3/video.jpg"
			xwhyc_rules2="https://raw.githubusercontent.com/adbyby/xwhyc-rules/master/video.txt"
		logger -t "【Adbyby】" "下载规则:$xwhyc_rules"
		/tmp/sh_download.sh /tmp/bin/data/video.txt $xwhyc_rules $xwhyc_rules2
		mv -f /tmp/bin/data/video.txt /tmp/bin/data/video_B.txt
			xwhyc_rules="http://update.adbyby.com/rule3/lazy.jpg"
			xwhyc_rules2="https://raw.githubusercontent.com/adbyby/xwhyc-rules/master/lazy.txt"
		logger -t "【Adbyby】" "下载规则:$xwhyc_rules"
		/tmp/sh_download.sh /tmp/bin/data/lazy.txt $xwhyc_rules $xwhyc_rules2
		mv -f /tmp/bin/data/lazy.txt /tmp/bin/data/lazy_B.txt
	fi
		chmod 777 /tmp/bin/adbyby
		# 设置路由ip:8118
		lan_ipaddr="0.0.0.0" #`nvram get lan_ipaddr`
		sed -e "s|^\(listen-address.*\)=[^=]*$|\1=$lan_ipaddr:8118|" -i /tmp/bin/adhook.ini
		/tmp/sh_downloads_adblock.sh
		/tmp/sh_white_list.sh
		grep -v '^!' /tmp/bin/data/user_rules.txt | grep -v "^$" > /tmp/bin/data/user.txt
		grep -v '^!' /tmp/bin/data/user3adblocks.txt | grep -v "^$" >> /tmp/bin/data/user.txt
		grep -v '^!' /tmp/bin/data/video_B.txt | grep -v "^$" >> /tmp/bin/data/user.txt
		grep -v '^!' /tmp/bin/data/lazy_B.txt | grep -v "^$" >> /tmp/bin/data/user.txt
		sleep 1
		logger -t "【Adbyby】" "启动 adbyby 程序"
		/tmp/bin/adbyby >/dev/null 2>&1 &
		if [ "$adblocks" = "1" ] ; then
			logger -t "【Adbyby】" "加载 adblock 规则, 等候10秒"
			sleep 10
		else
			sleep 5
		fi
		if [ -f "/tmp/bin/data/lazy_B.txt" ] ; then
			logger -t "【Adbyby】" "加载手动同步更新规则, 等候10秒"
			mv -f /tmp/bin/data/lazy_B.txt /tmp/bin/data/lazy.txt
			mv -f /tmp/bin/data/video_B.txt /tmp/bin/data/video.txt
			sleep 10
		fi
	fi
	PIDS=$(ps | grep "/tmp/bin/adbyby" | grep -v "grep" | grep -v "adbybyupdate.sh" | grep -v "adbybyfirst.sh" | wc -l)
	if [ "$PIDS" != 0 ] ; then 
		logger -t "【Adbyby】" "启动完成"
		/tmp/sh_adb8118.sh A
		rm -f /tmp/7620n.tar.gz
		rm -f /tmp/cron_adb.lock
		if [ "$ipsets" = "1" ] ; then
			ipsetstxt="【ipset模式】"
		else
			ipsetstxt="【全局模式】"
		fi
		logger -t "【Adbyby】" "$ipsetstxt lazy更新: 更新时间: `sed -n '1p' /tmp/bin/data/lazy.txt | sed 's/^...................//' | sed -nr 's/......$//p' | sed 's/ \+/ /g'`"
		logger -t "【Adbyby】" "$ipsetstxt video更新: 更新时间: `sed -n '1p' /tmp/bin/data/video.txt | sed 's/^...................//' | sed -nr 's/................................................$//p' | sed 's/ \+/ /g'`"
		logger -t "【Adbyby】" "第三方规则行数:  `sed -n '$=' /tmp/bin/data/user3adblocks.txt` 行"
		logger -t "【Adbyby】" "自定义规则行数:  `sed -n '$=' /tmp/bin/data/user_rules.txt` 行"
		nvram set adbybylazy="$ipsetstxt lazy更新: 更新时间: `sed -n '1p' /tmp/bin/data/lazy.txt | sed 's/^...................//' | sed -nr 's/......$//p' | sed 's/ \+/ /g'`"
		nvram set adbybyvideo="$ipsetstxt video更新: 更新时间: `sed -n '1p' /tmp/bin/data/video.txt | sed 's/^...................//' | sed -nr 's/................................................$//p' | sed 's/ \+/ /g'`"
		nvram set adbybyuser3="第三方规则行数:  `sed -n '$=' /tmp/bin/data/user3adblocks.txt | sed s/[[:space:]]//g ` 行"
		nvram set adbybyuser="自定义规则行数:  `sed -n '$=' /tmp/bin/data/user_rules.txt | sed s/[[:space:]]//g ` 行"
		/tmp/sh_mon.sh&
		if [ "$CPUAverages" = "1" ] ; then
			/tmp/sh_CPUAverage.sh &
		fi
	sleep 2
	/etc/storage/ez_buttons_script.sh 3 &
	fi
	rm -f /tmp/cron_adb.lock
fi

EOF
chmod 777 "/tmp/sh_func_load_adbyby.sh"
cat > "/tmp/sh_func_load_koolproxy.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/tmp/7620koolproxy/lib:/lib:/opt/lib

keep_koolproxy(){
logger -t "【koolproxy】" "koolproxy 守护脚本启动."
killall koolproxykeep.sh
cat > "/tmp/koolproxykeep.sh" <<-\koolproxy
#!/bin/sh
cd /tmp/7620koolproxy
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/tmp/7620koolproxy/lib:/lib:/opt/lib

PRO_NAME="/tmp/7620koolproxy/koolproxy"
koolproxyNUM=2
runx="1"

update_kp_rules(){
mkdir -p /tmp/7620koolproxy/rule_store
mkdir -p /tmp/7620koolproxy/rule_tmp
rm -rf /tmp/7620koolproxy/data/koolproxyrule_*
rm -rf /tmp/7620koolproxy/rule_tmp/*
rm -rf /tmp/7620koolproxy/data/1.dat  /tmp/7620koolproxy/data/koolproxy.txt
logger -t "【koolproxy】" "检测规则是否有更新"
if [ ! -f /etc/storage/koolproxy_rules_list.sh ] ; then
cat > "/etc/storage/koolproxy_rules_list.sh" <<-\KPR
# https://rules.ngrok.wang/1.dat
# https://rules.ngrok.wang/koolproxy.txt
http://rules.ngrok.wang:5000/koolproxy.txt
http://rules.ngrok.wang:5000/1.dat
KPR
fi
	while read line
	do
	c_line=`echo $line |grep -v "#"`
	if [ ! -z "$c_line" ] ; then
		file_name=${line##*/}
		/tmp/sh_download.sh /tmp/7620koolproxy/rule_tmp/$file_name $line
		MD5_TMP=`md5sum /tmp/7620koolproxy/rule_tmp/$file_name  | awk '{print $1}'`
		MD5_ORI=`md5sum /tmp/7620koolproxy/rule_store/$file_name| awk '{print $1}'`
		if [ ! -f /tmp/7620koolproxy/rule_store/$file_name ] || [ "$MD5_TMP"x != "$MD5_ORI"x ];then
		logger -t "【koolproxy】" "守护检查:有更新 $urla , 重启进程"
		/tmp/sh_koolproxy3000.sh D
		killall -15 koolproxy
		killall -9 koolproxy
		rm -f /tmp/cron_adb.lock
		nvram set koolproxy_status="restart_firewall"
		restart_firewall &
		sleep 62
		else
			logger -t "【koolproxy】" " 守护检查:不需更新 本地【$file_name】已经是最新！，$line"
		fi
		ln -sf /tmp/7620koolproxy/rule_store/$file_name /tmp/7620koolproxy/data/koolproxyrule_$file_name
	fi
	done < /etc/storage/koolproxy_rules_list.sh
}

while true ; do
#   用ps获取 $PRO_NAME 进程数量
	NUM=`ps | grep $PRO_NAME | grep -v grep |wc -l`
#	echo $NUM
#	logger -t "【koolproxy】" " $NUM 进程"
if [ "$NUM" -lt "$koolproxyNUM" ] ; then
#   少于 $koolproxyNUM ，重启进程
	logger -t "【koolproxy】" "少于 $koolproxyNUM, 重启进程"
	echo "$PRO_NAME was killed"
	/tmp/sh_koolproxy3000.sh D
	eval $(ps  | grep "/tmp/7620koolproxy/koolproxy" | grep -v grep | awk '{print "kill "$1}')
	/tmp/7620koolproxy/koolproxy -d >/dev/null 2>&1 &
	sleep 2
	/tmp/sh_koolproxy3000.sh A
elif [ "$NUM" -gt "$koolproxyNUM" ] ; then
#   大于 $koolproxyNUM ，杀掉所有进程，重启
	logger -t "【koolproxy】" "大于 $koolproxyNUM, 杀掉所有进程, 重启"
	echo "more than $koolproxyNUM $PRO_NAME,killall $PRO_NAME"
	/tmp/sh_koolproxy3000.sh D
	eval $(ps | grep "/tmp/7620koolproxy/koolproxy" | grep -v grep | awk '{print "kill "$1}')
	/tmp/7620koolproxy/koolproxy -d >/dev/null 2>&1 &
	sleep 2
	/tmp/sh_koolproxy3000.sh A
fi
sleep 62
if [ ! -f /tmp/cron_adb.lock ] && [ -s "/tmp/7620koolproxy/koolproxy" ] ; then
	PIDS=$(ps | grep "/tmp/7620koolproxy/koolproxy" | grep -v "grep" | wc -l)
	if [ "$PIDS" != 0 ] ; then
		port=$(iptables -t nat -L | grep 'ports 3000' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【koolproxy】" "守护检查:找不到3000转发规则, 重新添加"
			killall -15 koolproxy
			killall -9 koolproxy
			rm -f /tmp/cron_adb.lock
			nvram set koolproxy_status="restart_firewall"
			restart_firewall &
			sleep 62
		fi
	fi
fi
runx=`expr $runx + 1`
if [ "$runx" -gt 720 ] ; then
runx="1"
update_kp_rules
fi
done
exit 0
koolproxy
chmod 755 "/tmp/koolproxykeep.sh"
/tmp/koolproxykeep.sh &
}

update_kp_rules(){
mkdir -p /tmp/7620koolproxy/rule_store
mkdir -p /tmp/7620koolproxy/rule_tmp
rm -rf /tmp/7620koolproxy/data/koolproxyrule_*
rm -rf /tmp/7620koolproxy/rule_tmp/*
rm -rf /tmp/7620koolproxy/data/1.dat  /tmp/7620koolproxy/data/koolproxy.txt
logger -t "【koolproxy】" "检测规则是否有更新"
if [ ! -f /etc/storage/koolproxy_rules_list.sh ] ; then
cat > "/etc/storage/koolproxy_rules_list.sh" <<-\KPR
# https://rules.ngrok.wang/1.dat
# https://rules.ngrok.wang/koolproxy.txt
http://rules.ngrok.wang:5000/koolproxy.txt
http://rules.ngrok.wang:5000/1.dat
KPR
fi
	while read line
	do
	c_line=`echo $line |grep -v "#"`
	if [ ! -z "$c_line" ] ; then
		file_name=${line##*/}
		/tmp/sh_download.sh /tmp/7620koolproxy/rule_tmp/$file_name $line
		MD5_TMP=`md5sum /tmp/7620koolproxy/rule_tmp/$file_name  | awk '{print $1}'`
		MD5_ORI=`md5sum /tmp/7620koolproxy/rule_store/$file_name| awk '{print $1}'`
		if [ ! -f /tmp/7620koolproxy/rule_store/$file_name ] || [ "$MD5_TMP"x != "$MD5_ORI"x ];then
			logger -t "【koolproxy】" " 更新【$file_name】，$line"
			mv -f /tmp/7620koolproxy/rule_tmp/$file_name /tmp/7620koolproxy/rule_store/$file_name
		else
			logger -t "【koolproxy】" " 本地【$file_name】已经是最新！，$line"
		fi
		ln -sf /tmp/7620koolproxy/rule_store/$file_name /tmp/7620koolproxy/data/koolproxyrule_$file_name
	fi
	done < /etc/storage/koolproxy_rules_list.sh
	nvram set koolproxy_rules_date_local="`sed -n '1p' /tmp/7620koolproxy/rule_store/koolproxy.txt | sed 's/ --- by //g'| sed  -e 's/> </></g' | sed 's/^........................//' | sed -nr 's/$//p' | sed 's/ \+/ /g'`"
	nvram set koolproxy_rules_nu_local="`cat /tmp/7620koolproxy/rule_store/koolproxy.txt | grep -v ! | wc -l`"
	nvram set koolproxy_video_date_local="`sed -n '2p' /tmp/7620koolproxy/rule_store/koolproxy.txt | sed 's/ --- by //g'| sed  -e 's/> </></g' | sed 's/^........................//' | sed -nr 's/$//p' | sed 's/ \+/ /g'`"
}

koolproxy_enable=`nvram get koolproxy_enable`
koolproxyfile=`nvram get koolproxyfile`
koolproxyfile2=`nvram get koolproxyfile2`
koolproxyfile3=`nvram get koolproxyfile3`
koolproxy_https=`nvram get koolproxy_https`

koolproxy_adblock=`nvram get koolproxy_adblock`
adm_hookport=`nvram get adm_hookport`
lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr
ipsets=`nvram get adbyby_mode_x`
A_restart=`nvram get koolproxy_status`
B_restart="$koolproxy_enable$koolproxyfile$koolproxyfile2$koolproxyfile3$lan_ipaddr$koolproxy_https$ipsets$adm_hookport$koolproxy_adblock$ss_DNS_Redirect$ss_DNS_Redirect_IP$ss_DNS_Redirect$(cat /etc/storage/ad_config_script.sh | grep -v "^$" | grep -v "^#")$(cat /etc/storage/koolproxy_rules_script.sh /etc/storage/koolproxy_rules_list.sh | grep -v "^$" | grep -v "^!")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set koolproxy_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi

if [ "$needed_restart" = "0" ] ; then
if [ ! -f /tmp/cron_adb.lock ] && [ -s "/tmp/7620koolproxy/koolproxy" ] && [ "$koolproxy_enable" = "1" ] ; then
	PIDS=$(ps | grep "/tmp/7620koolproxy/koolproxy" | grep -v "grep" | wc -l)
	if [ "$PIDS" != 0 ] ; then
		port=$(iptables -t nat -L | grep 'ports 3000' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【Adbyby】" "定时检查:找不到3000转发规则, 重新添加"
			/tmp/sh_koolproxy3000.sh A
		fi
	fi
fi
fi
if [ "$needed_restart" = "1" ] ; then
	killall -9 koolproxy ; killall -15 koolproxy ; killall koolproxykeep.sh ;
	[ "`iptables -t nat -L | grep 'ports 3000' | wc -l`" != "0" ] && /tmp/sh_koolproxy3000.sh D &
	sleep 1
	[ "`iptables -t nat -L | grep 'ports 3000' | wc -l`" != "0" ] && /tmp/sh_koolproxy3000.sh D &
	/etc/storage/ez_buttons_script.sh 3 &
	sleep 1
	[ "$koolproxy_enable" = "0" ] && { rm -f /tmp/cron_adb.lock; killall sh_func_load_koolproxy.sh; }
fi
[ "$needed_restart" = "1" ] && { killall -9 koolproxy ; killall -15 koolproxy ; killall koolproxykeep.sh ; }
if [ -z "`pidof koolproxy`" ] && [ "$koolproxy_enable" = "1" ] && [ ! -f /tmp/cron_adb.lock ] ; then
	sleep 1
	touch /tmp/cron_adb.lock
	nvram set button_script_1_s="KP"
	/tmp/sh_koolproxy3000.sh D
	killall -15 koolproxy
	killall -9 koolproxy
	killall koolproxykeep.sh
	if [ ! -s "/tmp/7620koolproxy/data/version" ] ; then
		logger -t "【koolproxy】" "开始下载 7620koolproxy.tgz"
		/tmp/sh_download.sh /tmp/7620koolproxy.tgz $koolproxyfile3
		/tmp/sh_untar.sh /tmp/7620koolproxy.tgz /tmp /tmp/7620koolproxy/data/version
	fi
	if [ ! -s "/tmp/7620koolproxy/koolproxy" ] ; then
		logger -t "【koolproxy】" "开始下载 koolproxy"
		/tmp/sh_download.sh /tmp/7620koolproxy/koolproxy $koolproxyfile $koolproxyfile2
	fi
	if [ -s "/tmp/7620koolproxy/koolproxy" ] ; then
		mkdir -p /etc/storage/koolproxy /tmp/7620koolproxy/data/certs /tmp/7620koolproxy/data/private
		[ -f /etc/storage/koolproxy/base.key.pem ] && cp -f /etc/storage/koolproxy/base.key.pem /tmp/7620koolproxy/data/private/base.key.pem
		[ -f /etc/storage/koolproxy/ca.key.pem ] && cp -f /etc/storage/koolproxy/ca.key.pem /tmp/7620koolproxy/data/private/ca.key.pem
		[ -f /etc/storage/koolproxy/ca.crt ] && cp -f /etc/storage/koolproxy/ca.crt /tmp/7620koolproxy/data/certs/ca.crt
		cd /tmp/7620koolproxy/data/
		if [ ! -f /tmp/7620koolproxy/data/private/ca.key.pem ]; then
			logger -t "【koolproxy】" "检测到首次运行https，开始生成koolproxy证书，用于https过滤！"
			chmod 777 /tmp/7620koolproxy/data/gen_ca.sh && sh gen_ca.sh
			[ -f /tmp/7620koolproxy/data/certs/ca.crt ] && cp -f /tmp/7620koolproxy/data/certs/ca.crt /etc/storage/koolproxy/ca.crt
			[ -f /tmp/7620koolproxy/data/private/base.key.pem ] && cp -f /tmp/7620koolproxy/data/private/base.key.pem /etc/storage/koolproxy/base.key.pem
			[ -f /tmp/7620koolproxy/data/private/ca.key.pem ] && cp -f /tmp/7620koolproxy/data/private/ca.key.pem /etc/storage/koolproxy/ca.key.pem && mtd_storage.sh save &
		fi
		touch index.txt
		echo 1000 > serial
		logger -t "【koolproxy】" "koolproxy证书位于/etc/storage/koolproxy/"
		ln -sf /tmp/7620koolproxy/data/user.txt /tmp/7620koolproxy/user.txt
		cat /etc/storage/koolproxy_rules_script.sh | grep -v '^!' | grep -v "^$" > /tmp/7620koolproxy/user.txt
		update_kp_rules
		chmod 777 /tmp/7620koolproxy/koolproxy
		export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
		export LD_LIBRARY_PATH=/tmp/7620koolproxy/lib:/lib:/opt/lib
		logger -t "【koolproxy】" "启动 koolproxy 程序"
		cd /tmp/7620koolproxy
		nvram set koolproxy_h="`/tmp/7620koolproxy/koolproxy -h | awk 'NR==1{print}'`"
		sleep 1
		/tmp/7620koolproxy/koolproxy -d  >/dev/null 2>&1 &
		sleep 2
	fi
	PIDS=$(ps | grep "/tmp/7620koolproxy/koolproxy" | grep -v "grep" | wc -l)
	if [ "$PIDS" != 0 ] ; then 
		logger -t "【koolproxy】" "启动完成"
		rm -f /tmp/7620koolproxy.tgz
		rm -f /tmp/cron_adb.lock
		/tmp/sh_koolproxy3000.sh A
		sleep 5
		keep_koolproxy
		/etc/storage/ez_buttons_script.sh 3 &
	fi
	rm -f /tmp/cron_adb.lock
	PIDS=$(ps | grep "/tmp/7620koolproxy/koolproxy" | grep -v "grep" | wc -l)
	[ "$PIDS" = 0 ] && logger -t "【koolproxy】" "启动失败, 10秒后自动尝试重新启动" && sleep 10 && nvram set koolproxy_status=00 && /tmp/sh_func_load_koolproxy.sh &
fi

EOF
chmod 777 "/tmp/sh_func_load_koolproxy.sh"
cat > "/tmp/sh_koolproxy3000.sh" <<-\EOFAD
#!/bin/sh
#初始化开始
TAG="AD_BYBY"		  # iptables tag
FWI="/tmp/firewall.adbyby.pdcn" # firewall include file
AD_LAN_AC_IP=`nvram get AD_LAN_AC_IP`
AD_LAN_AC_IP=${AD_LAN_AC_IP:-"0"}
koolproxy_https=`nvram get koolproxy_https`
adm_hookport=`nvram get adm_hookport`

adb=$1
confdir=$2
gfwlist="/r.gfwlist.conf"
gfw_black_list="gfwlist"
ipsets=`nvram get adbyby_mode_x`
ss_mode_x=`nvram get ss_mode_x`
confdir=`grep conf-dir /etc/storage/dnsmasq/dnsmasq.conf | sed 's/.*\=//g'`
if [ -z "$confdir" ] ; then 
	confdir="/tmp/ss/dnsmasq.d"
fi
[ ! -z "$confdir" ] && mkdir -p $confdir

# AD规则

gen_special_purpose_ip() {
#处理肯定不走通道的目标网段
lan_ipaddr=`nvram get lan_ipaddr`
kcptun_enable=`nvram get kcptun_enable`
kcptun_enable=${kcptun_enable:-"0"}
kcptun_server=`nvram get kcptun_server`
if [ "$kcptun_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $kcptun_server | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $kcptun_server | awk 'NR==5{print $3}'` 
kcptun_server=$resolveip
fi
[ "$kcptun_enable" = "0" ] && kcptun_server=""
ss_enable=`nvram get ss_enable`
ss_enable=${ss_enable:-"0"}
[ "$ss_enable" = "0" ] && ss_s1_ip="" && ss_s2_ip=""
nvram set ss_server1=`nvram get ss_server`
ss_server1=`nvram get ss_server1`
ss_server2=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_server2=""
if [ "$ss_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server1 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server1 | awk 'NR==5{print $3}'` 
ss_s1_ip=$resolveip
fi
if [ ! -z "$ss_server2" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server2 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server2 | awk 'NR==5{print $3}'` 
ss_s2_ip=$resolveip
fi
	cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.25.61.0/24
192.31.196.0/24
192.52.193.0/24
192.88.99.0/24
192.168.0.0/16
192.175.48.0/24
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4
255.255.255.255
$lan_ipaddr
$ss_s1_ip
$ss_s2_ip
$kcptun_server
EOF
}

include_ac_rules() {
	iptables-restore -n <<-EOF
*$1
:AD_BYBY - [0:0]
:AD_BYBY_LAN_AC - [0:0]
:AD_BYBY_WAN_AC - [0:0]
:AD_BYBY_to - [0:0]
-A AD_BYBY -m set --match-set ad_spec_dst_sp dst -j RETURN
-A AD_BYBY -j AD_BYBY_LAN_AC
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_bp src -j RETURN
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_fw src -j AD_BYBY_to
-A AD_BYBY_LAN_AC -m set --match-set ad_spec_src_ac src -j AD_BYBY_WAN_AC
-A AD_BYBY_LAN_AC -j ${LAN_TARGET:=AD_BYBY_WAN_AC}
-A AD_BYBY_WAN_AC -m set --match-set adbybylist dst -j ${ADBYBYLIST_TARGET:=AD_BYBY_to}
-A AD_BYBY_WAN_AC -m set --match-set cflist dst -j ${ADBYBYLIST_TARGET:=AD_BYBY_to}
-A AD_BYBY_WAN_AC -j ${WAN_TARGET:=AD_BYBY_to}
COMMIT
EOF
}

gen_include() {
[ -n "$FWI" ] || return 0
cat <<-CAT >>$FWI
iptables-restore -n <<-EOF
$(iptables-save | sed  "s/webstr--url/webstr --url/g" | grep -E "$TAG|^\*|^COMMIT" |sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/")
EOF
CAT
return $?
}

flush_r() {
	iptables-save -c | sed  "s/webstr--url/webstr --url/g" | grep -v "$TAG" | iptables-restore -c
	for setname in $(ipset -n list | grep -i "ad_spec"); do
		ipset destroy $setname 2>/dev/null
	done
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	ipset -F adbybylist &> /dev/null
	ipset destroy adbybylist &> /dev/null
	ipset -F cflist &> /dev/null
	iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 3000 &> /dev/null
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	return 0
}
lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr

dns_redirect() {
	# 强制使用路由的DNS
	lan_ipaddr=`nvram get lan_ipaddr`
	if [ "$ss_DNS_Redirect" == "1" ] && [ ! -z "$lan_ipaddr" ] ; then
	iptables-restore -n <<-EOF
*nat
:AD_BYBY_DNS_LAN_DG - [0:0]
:AD_BYBY_DNS_LAN_AC - [0:0]
:AD_BYBY_DNS_WAN_AC - [0:0]
:AD_BYBY_DNS_WAN_FW - [0:0]
-A AD_BYBY_DNS_LAN_DG -d $lan_ipaddr -p udp -j RETURN
-A AD_BYBY_DNS_LAN_DG -d $ss_DNS_Redirect_IP -p udp -j RETURN
-A AD_BYBY_DNS_LAN_DG -j AD_BYBY_DNS_LAN_AC
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_bp src -j RETURN
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_fw src -j AD_BYBY_DNS_WAN_FW
-A AD_BYBY_DNS_LAN_AC -m set --match-set ad_spec_src_ac src -j AD_BYBY_DNS_WAN_AC
-A AD_BYBY_DNS_LAN_AC -j ${DNS_LAN_TARGET:=AD_BYBY_DNS_WAN_AC}
-A AD_BYBY_DNS_WAN_AC -j AD_BYBY_DNS_WAN_FW
COMMIT
EOF
		logger -t "【ADM】" "udp53端口（DNS）地址重定向为 $ss_DNS_Redirect_IP 强制使用重定向地址的DNS"
		iptables -t nat -A PREROUTING -s $lan_ipaddr/24 -p udp --dport 53 -j AD_BYBY_DNS_LAN_DG
		iptables -t nat -A AD_BYBY_DNS_WAN_FW -j DNAT --to $ss_DNS_Redirect_IP
	fi

}

#检查 dnsmasq 目录参数
if [ -z "$confdir" ] ; then 
	confdir="/tmp/ss/dnsmasq.d"
fi
[ ! -z "$confdir" ] && mkdir -p $confdir
[ -z "$gfwlist" ] && gfwlist=/r.gfwlist.conf
[ -z "$gfw_black_list" ] && gfw_black_list=gfwlist

#killall -9 sh_adblock_hosts.sh
#/tmp/sh_adblock_hosts.sh $confdir &

if [ "$adb" = "D" ] ; then
	logger -t "【iptables】" "删除3000转发规则"
	flush_r
	rm -f /tmp/adbyby_host.conf
	sed -Ei '/adbyby_host.conf/d' /etc/storage/dnsmasq/dnsmasq.conf
	restart_dhcpd
	logger -t "【iptables】" "完成删除3000规则"
fi
if [ "$adb" = "A" ] ; then
	logger -t "【iptables】" "添加3000转发规则"
	# rules规则
	flush_r
	ipset -! restore <<-EOF || return 1
create ad_spec_src_ac hash:ip hashsize 64
create ad_spec_src_bp hash:ip hashsize 64
create ad_spec_src_fw hash:ip hashsize 64
create ad_spec_src_https hash:ip hashsize 64
create ad_spec_dst_sp hash:net hashsize 64
$(gen_special_purpose_ip | sed -e "s/^/add ad_spec_dst_sp /")
EOF
ipset -! -N cflist iphash
ipset -! -N adbybylist iphash
lan_ipaddr=`nvram get lan_ipaddr`
ipset add ad_spec_src_bp $lan_ipaddr
ipset add ad_spec_src_bp 127.0.0.1
ipset add adbybylist 110.110.110.110
/etc/storage/ad_config_script.sh
# 内网(LAN)访问控制
logger -t "【koolproxy】" "设置内网(LAN)访问控制"
if [ -n "$AD_LAN_AC_IP" ] ; then
	case "${AD_LAN_AC_IP:0:1}" in
		0)
			LAN_TARGET="AD_BYBY_WAN_AC"
			DNS_LAN_TARGET="AD_BYBY_DNS_WAN_AC"
			;;
		1)
			LAN_TARGET="AD_BYBY_to"
			DNS_LAN_TARGET="AD_BYBY_DNS_WAN_FW"
			;;
		2)
			LAN_TARGET="RETURN"
			DNS_LAN_TARGET="RETURN"
			;;
	esac
fi
grep -v '^#' /tmp/ad_spec_lan_DOMAIN.txt | sort -u | grep -v "^$" | sed s/！/!/g > /tmp/ad_spec_lan.txt
while read line
do
for host in $line; do
	case "${host:0:1}" in
		n|N)
			ipset add ad_spec_src_ac ${host:2}
			;;
		b|B)
			ipset add ad_spec_src_bp ${host:2}
			;;
		g|G)
			ipset add ad_spec_src_fw ${host:2}
			;;
		s|S)
			ipset add ad_spec_src_https ${host:2}
			;;
	esac
done
done < /tmp/ad_spec_lan.txt
	[ "$ipsets" == 0 ] && WAN_TARGET="AD_BYBY_to"
	[ "$ipsets" == 0 ] && ADBYBYLIST_TARGET="AD_BYBY_to"
	[ "$ipsets" == 1 ] && WAN_TARGET="RETURN"
	[ "$ipsets" == 1 ] && ADBYBYLIST_TARGET="AD_BYBY_to"
	include_ac_rules nat
	wifidognx=""
		#wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## SS_SPEC
		#if [ -z "$wifidogn" ] ; then
			wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## Outgoing
			if [ -z "$wifidogn" ] ; then
				wifidogn=`iptables -t nat -L PREROUTING --line-number | grep vserver | awk '{print $1}' | awk 'END{print $1}'`  ## vserver
				if [ -z "$wifidogn" ] ; then
					wifidognx=1
				else
					wifidognx=`expr $wifidogn + 1`
				fi
			else
				wifidognx=`expr $wifidogn + 1`
			fi
		#else
		#	wifidognx=`expr $wifidogn + 1`
		#fi
	wifidogn=$wifidognx
	echo "AD_BYBY-number:$wifidogn"

	if [ -f /tmp/7620koolproxy/koolproxy_hookport.txt ] && [ "$adm_hookport" == 1 ] ; then
		hookport443='|'
		sed -e "s/443$hookport443//" -i /tmp/7620koolproxy/koolproxy_hookport.txt
		i=1 && hookport1="" && hookport2="" && hookport3="" && hookport4="" && hookport5=""
		for hookport in $(cat /tmp/7620koolproxy/koolproxy_hookport.txt | sed s/\|/\ /g)
		do
			[ "$i" -eq 1 ] && hookport1=$hookport
			[ "$i" -eq 15 ] && hookport2=$hookport
			[ "$i" -eq 30 ] && hookport3=$hookport
			[ "$i" -eq 45 ] && hookport4=$hookport
			[ "$i" -eq 60 ] && hookport5=$hookport
			[ "$i" -gt 1 ] && [ "$i" -lt 15 ] && hookport1=$hookport1","$hookport
			[ "$i" -gt 15 ] && [ "$i" -lt 30 ] && hookport2=$hookport2","$hookport
			[ "$i" -gt 30 ] && [ "$i" -lt 45 ] && hookport3=$hookport3","$hookport
			[ "$i" -gt 45 ] && [ "$i" -lt 60 ] && hookport4=$hookport4","$hookport
			[ "$i" -gt 60 ] && [ "$i" -lt 75 ] && hookport5=$hookport5","$hookport
			i=`expr $i + 1`
		done
		[ ! -z "$hookport1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport1 -j AD_BYBY
		[ ! -z "$hookport2" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport2 -j AD_BYBY
		[ ! -z "$hookport3" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport3 -j AD_BYBY
		[ ! -z "$hookport4" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport4 -j AD_BYBY
		[ ! -z "$hookport5" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports $hookport5 -j AD_BYBY
		iptables -t nat -I PREROUTING $wifidogn -p tcp -m set --match-set ad_spec_src_https src --dport 443 -j AD_BYBY
		[ "$koolproxy_https" = "1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp --dport 443 -j AD_BYBY
	else
		[ "$koolproxy_https" = "1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports 80,443,8080 -j AD_BYBY
		[ "$koolproxy_https" != "1" ] && iptables -t nat -I PREROUTING $wifidogn -p tcp -m multiport --dports 80,8080 -j AD_BYBY
	fi
	iptables -t nat -A AD_BYBY_to -p tcp -j REDIRECT --to-port 3000
	dns_redirect

	sleep 1
	gen_include &
	logger -t "【iptables】" "完成添加3000规则"
	#[ "$ipsets" == 1 ] && [ -f /tmp/7620koolproxy/data/koolproxy_ipset.conf ] && ln -sf /tmp/7620koolproxy/data/koolproxy_ipset.conf /tmp/adbyby_host.conf
	[ "$ipsets" == 1 ] && [ -f /tmp/7620koolproxy/data/koolproxy_ipset.conf ] && cp -f /tmp/7620koolproxy/data/koolproxy_ipset.conf /tmp/adbyby_host.conf
	[ "$ipsets" == 1 ] && /tmp/sh_koolproxy3000.sh C &
fi
#去除gfw donmain中与 adbyby host 包含的域名，这部分域名交由adbyby处理。
# 参考的awk指令写法
#  awk  'NR==FNR{a[$0]}NR>FNR{ if($1 in a) print $0}' file1 file2 #找出两文件中相同的值
#  awk  'NR==FNR{a[$0]}NR>FNR{ if(!($1 in a)) print $0}' file1 file2 #去除 file2 中file1的内容
#  awk 'NR==FNR{a[$0]++} NR>FNR&&a[$0]' file1 file2 #找出两个文件之间的相同部分
#  awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' file1 file2 #去除 file2 中file1的内容
if [ "$ipsets" == 1 ] && [ -s /tmp/adbyby_host.conf ] && [ "$adb" = "C" ] ; then
logger -t "【iptables】" "添加 ipset 转发规则"
sed -Ei '/adbyby_host.conf|cflist.conf/d' /etc/storage/dnsmasq/dnsmasq.conf
	sed  "s/\/black_koolproxy/\/adbybylist/" -i  /tmp/adbyby_host.conf
	[ -f "$confdir$gfwlist" ] && gfw_black=$(grep "/$gfw_black_list" "$confdir$gfwlist" | sed 's/.*\=//g')
	if [ -s "$confdir$gfwlist" ] && [ -s /tmp/adbyby_host.conf ]  && [ ! -z "$gfw_black" ] ; then
		logger -t "【iptables】" "koolproxylist 规则处理开始"
		mkdir -p /tmp/b/
		sed -e '/^\#/d' -e "s/ipset=\/www\./ipset=\/\./" -e "s/ipset=\/bbs\./ipset=\/\./" -e "s/ipset=\/\./ipset=\//" -e "s/ipset=\//ipset=\/\./" -i /tmp/adbyby_host.conf
		sed -e '/^\#/d' -e "s/ipset=\/www\./ipset=\/\./" -e "s/ipset=\/bbs\./ipset=\/\./" -e "s/ipset=\/\./ipset=\//" -e "s/ipset=\//ipset=\/\./" -i "$confdir$gfwlist"
		sed -e '/^\#/d' -e "s/ipset=\///" -e "s/adbybylist//" /tmp/adbyby_host.conf > /tmp/b/adbyby_host去干扰.conf
		sed -e '/^\#/d' -e "s/ipset=\///" -e "s/$gfw_black_list//" -e "/server=\//d" "$confdir$gfwlist" > /tmp/b/gfwlist去干扰.conf
		awk 'NR==FNR{a[$0]++} NR>FNR&&a[$0]' /tmp/b/adbyby_host去干扰.conf /tmp/b/gfwlist去干扰.conf > /tmp/b/host相同行.conf
		if [ -s /tmp/b/host相同行.conf ] ; then
			logger -t "【iptables】" "gfwlist 规则处理开始"
			sed -e "s/^/ipset=\//" -e "s/$/adbybylist/" /tmp/b/host相同行.conf > /tmp/b/host相同行2.conf
			awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' /tmp/b/host相同行2.conf /tmp/adbyby_host.conf > /tmp/b/adbyby_host不重复.conf
			sed -e "s/^/ipset=\//" -e "s/$/$gfw_black_list/" /tmp/b/host相同行.conf > /tmp/b/host相同行2.conf
			awk 'NR==FNR{a[$0]++} NR>FNR&&!a[$0]' /tmp/b/host相同行2.conf "$confdir$gfwlist" > /tmp/b/gfwlist不重复.conf
			sed -e "s/^/ipset=\//" -e "s/$/cflist/" /tmp/b/host相同行.conf > /tmp/b/list重复.conf
			cp -a -v /tmp/b/adbyby_host不重复.conf /tmp/adbyby_host.conf
			cp -a -v /tmp/b/gfwlist不重复.conf "$confdir$gfwlist"
			#rm -f "$confdir/cflist.conf"
			#cp -a -v /tmp/b/list重复.conf "$confdir/cflist.conf"
			cat /tmp/b/list重复.conf >> "$confdir/cflist.conf"
			logger -t "【iptables】" "gfwlist 规则处理完毕"
		fi
		grep -v '^#' $confdir/cflist.conf | sort -u | grep -v "^$" > /tmp/ss/cflist.conf
		grep -v '^#' /tmp/ss/cflist.conf | sort -u | grep -v "^$" > $confdir/cflist.conf
		echo "conf-file=$confdir/cflist.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
	fi
echo "conf-file=/tmp/adbyby_host.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
ipset flush cflist
ipset flush adbybylist
ipset add adbybylist 110.110.110.110
if [ -f /tmp/7620koolproxy/koolproxy_blockip.txt ] ; then
	grep -v '^#' /tmp/7620koolproxy/koolproxy_blockip.txt | sort -u | grep -v "^$" | sed -e "s/^/-A adbybylist &/g" | ipset -R -!
fi
restart_dhcpd
logger -t "【iptables】" "koolproxylist 规则处理完毕"
rm -f /tmp/b/*
fi
sleep 1
/etc/storage/ez_buttons_script.sh 3 &
#restart_dhcpd

EOFAD
chmod 777 "/tmp/sh_koolproxy3000.sh"
cat > "/tmp/sh_phddns.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
stop()
{
	killall oraynewph
	killall oraysl
	echo "Oraynewph already stopped !"
	logger -t "【花生壳内网版】" "Oraynewph already stopped !"
}
phddns=`nvram get phddns`
if [ "$phddns" = "0" ] ; then
	if [ ! -z "`pidof oraysl`" ] ; then
		nvram set phddns_sn=""
		nvram set phddns_st=""
		nvram set phddns_szUID=""
		logger -t "【花生壳内网版】" "停止运行 stopped !"
	fi
	nvram set phddns_sn="" && { killall -9 oraysl oraynewph ; killall sh_orayd.sh; }
fi
if [ -z "`pidof oraysl`" ] && [ "$phddns" = "1" ] ; then
	killall -9 oraysl oraynewph
	killall sh_orayd.sh;
	logger -t "【花生壳内网版】" "启动程序"
	ln -sf "/etc/storage/PhMain.ini" "/etc/PhMain.ini"
	ln -sf "/etc/storage/init.status" "/etc/init.status"
	SVC_PATH="/usr/bin/oraysl"
	SVC_PATH2="/usr/bin/oraynewph"
	wphddns2="https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/phddns2/bin"
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【花生壳内网版】" "自动安装花生壳内网版程序"
		# 找不到 花生壳内网版，安装 opt
		SVC_PATH="/opt/bin/oraysl"
		SVC_PATH2="/opt/bin/oraynewph"
		if [ ! -d "/opt/bin" ] ; then
			upanPath=""
			ss_opt_x=`nvram get ss_opt_x`
			[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
			[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
			[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
			if [ ! -z $upanPath ] ; then
				mkdir -p /media/$upanPath/opt
				mount -o bind /media/$upanPath/opt /opt
				ln -sf /media/$upanPath /tmp/AiDisk_00
			else
				mkdir -p /tmp/AiDisk_00/opt
				mount -o bind /tmp/AiDisk_00/opt /opt
			fi
			mkdir -p /opt/bin
		fi
		wphddns2="https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/phddns2/bin"
		if [ ! -f "$SVC_PATH" ] ; then
			logger -t "【花生壳内网版】" "找不到 $SVC_PATH 下载程序"
			[ ! -s "$SVC_PATH2" ] && /tmp/sh_download.sh $SVC_PATH2 "$wphddns2/oraynewph"
			[ ! -s "$SVC_PATH" ] && /tmp/sh_download.sh $SVC_PATH "$wphddns2/oraysl"
		else
			logger -t "【花生壳内网版】" "找到 $SVC_PATH"
		fi
	fi
	[ ! -s "$SVC_PATH" ] && {  logger -t "【花生壳内网版】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; stop; }
	[ ! -s "$SVC_PATH2" ] && {  logger -t "【花生壳内网版】" "找不到 $SVC_PATH2 ，需要手动安装 $SVC_PATH2"; stop; }
	[ ! -s "$SVC_PATH" ] && exit 0
	[ ! -s "$SVC_PATH2" ] &&  exit 0
	# export LD_LIBRARY_PATH=/opt/phddns2/lib:/lib:/opt/lib
	oraynewph -s 0.0.0.0 >/dev/null 2>/dev/null &
	oraysl -a 127.0.0.1 -p 16062 -s phsle01.oray.net:80 -d >/dev/null 2>/dev/null &
	echo "Oraynewph start success !"
	logger -t "【花生壳内网版】" "Oraynewph start success !"
	sleep 28
	export LD_LIBRARY_PATH=/lib:/opt/lib
	USER_DATA="/tmp/oraysl.status"

	SN=`head -n 2 $USER_DATA  | tail -n 1 | cut -d= -f2-`;
	STATUS=`head -n 3 $USER_DATA  | tail -n 1 | cut -d= -f2-`;

	echo  "RUNSTATUS= $STATUS"
	echo  "SN= $SN"
	echo  "LoginAddress= http://b.oray.com/"
	logger -t "【花生壳内网版】" "RUNSTATUS= $STATUS"
	logger -t "【花生壳内网版】" "SN= $SN "
	nvram set phddns_sn=$SN
	nvram set phddns_st=$STATUS
	szUID=0
	if [ -f /etc/storage/PhMain.ini ] ; then
		szUID=`sed -n 's/.*szUID=*/\1/p' /etc/storage/PhMain.ini`
	fi
	if [ "$szUID" != "0" ] ; then
		logger -t "【花生壳内网版】" "已经绑定的花生壳账号:$szUID"
		nvram set phddns_szUID=$szUID
		logger -t "【花生壳内网版】" "使用SN账号在【 http://b.oray.com 】登录."
	else
		logger -t "【花生壳内网版】" "没绑定的花生壳账号，请尽快绑定"
		logger -t "【花生壳内网版】" "使用 SN 账号在【 http://b.oray.com 】默认密码是 admin 登录."
		logger -t "【花生壳内网版】" "默认密码:admin, 默认密码:admin, 然后进行修改默认密码、手机验证、邮箱验证和花生壳账号绑定"
		logger -t "【花生壳内网版】" "!!>>绑定后需【写入】内部存储, 不然重启会丢失绑定.<<!!"
		logger -t "【花生壳内网版】" " !>>绑定后需【写入】内部存储, 不然重启会丢失绑定.<<!"
		logger -t "【花生壳内网版】" "  !>绑定后需【写入】内部存储, 不然重启会丢失绑定.<!"
		logger -t "【花生壳内网版】" "系统管理 - 恢复/导出/上传设置 - 路由器内部存储 /etc/storage - 【提交】"
	fi
	/tmp/sh_orayd.sh &
fi
EOF
chmod 777 "/tmp/sh_phddns.sh"
cat > "/tmp/sh_syncys.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
syncys=`nvram get syncys`
if [ "$syncys" = "0" ] ; then
[ ! -z "`ps |grep "/opt/etc/syncy.py"|grep -v grep| awk '{print $1}'`" ] && {  eval $(ps  | grep "/opt/etc/syncy" | grep -v grep | awk '{print "kill "$1}') ; killall sh_syncyquota.sh; killall sh_syncyd.sh; }
fi
if [ -z "`ps |grep "/opt/etc/syncy.py"|grep -v grep| awk '{print $1}'`" ] && [ "$syncys" = "1" ] ; then
	killall sh_syncyquota.sh; killall sh_syncyd.sh;
	if [ ! -f "/opt/opti.txt" ] ; then
		ssfile=`nvram get ssfile`
		ssfile2=`nvram get ssfile2`
		upanPath=""
		ss_opt_x=`nvram get ss_opt_x`
		[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
		[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
		if [ ! -z $upanPath ] ; then
			mkdir -p /media/$upanPath/opt
			mount -o bind /media/$upanPath/opt /opt
			ln -sf /media/$upanPath /tmp/AiDisk_00
			/tmp/sh_installs.sh $ssfile 1
		fi
	fi
	if [ ! -f "/opt/opti.txt" ] ; then
		nvram set syncys=0
		nvram commit
		logger -t "【SyncY】" "opt 缺少 opt 文件, 请更新 opt, 并检查 U盘 文件和设置"
	fi
	if [ ! -s "/opt/etc/syncy.py" ] ; then
		logger -t "【SyncY】" "opt 缺少 syncy.py 文件, 请更新 opt, 并检查 U盘 文件和 Entware 设置"
	else
		# 设置路由器本地同步目录
		upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | sed -n '1p'`
		syncyPath="/media/$upanPath/"
		if [ ! -d "/tmp/AiDisk_SyncY" ] ; then
			mkdir -p -m 777 /media/$upanPath/SyncY
			ln -sf /media/$upanPath/SyncY /tmp/AiDisk_SyncY
			logger -t "【SyncY】" "设置路由器本地同步目录 /media/$upanPath/SyncY"
			sed -e 's/'"\/media\/AiDisk_a1\/SyncY'#本地同步目录"/"\/tmp\/AiDisk_SyncY' #本地同步目录"'/g' -i /opt/etc/syncy
			#option localpath '/media/AiDisk_a1/SyncY'#本地同步目录
			localpath=`cat /opt/etc/syncy |grep "localpath" | sed "s/option localpath//g" | sed "s/'//g" | sed "s/#本地同步目录//g"`
			if [ ! -d `echo $localpath` ] ; then
				logger -t "【SyncY】" "错误！！路由器本地同步目录不存在！！"
				logger -t "【SyncY】" "$localpath 设置错误！！请检查 U盘 文件和设置"
			fi
		fi
		logger -t "【SyncY】" "启动 syncy 服务"
		dos2unix -u /opt/etc/syncy
#	   sed -i "s/\\r//g" /opt/etc/syncy
		rm -f /tmp/syncy.quota
		rm -f /tmp/syncy.user_code
		rm -f /tmp/syncy.user_token
		cd /opt/etc
		export LD_LIBRARY_PATH=/lib:/opt/lib
		python /opt/etc/syncy.py &
		sleep 25
		/tmp/sh_syncyquota.sh &
	fi
fi
EOF
chmod 777 "/tmp/sh_syncys.sh"
cat > "/tmp/youku_install.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/opt/youku/lib:/lib

#wget --continue --no-check-certificate -O /opt/youku_install.sh http://code.taobao.org/svn/test43/youku/youku_install.sh
#sh /opt/youku_install.sh &
#自定义缓存目录
hc_dir=`nvram get youku_hc_dir`
hc_dir=`echo $hc_dir`
[ -z $hc_dir ] && hc_dir=$(df|grep '/media/'|awk '{print$6}'|head -n 1) && nvram set youku_hc_dir=$hc_dir
#自定义16位sn：2115663623336666
sn_youku=`nvram get youku_sn`
[ -z $sn_youku ] && sn_youku="2115$(cat /sys/class/net/ra0/address |tr -d ':'|md5sum |tr -dc [0-9]|cut -c 0-12)" && nvram set youku_sn=$sn_youku
#缓存大小，单位MB。
hc=`nvram get youku_hc`
[ -z $hc ] && hc=6000 && nvram set youku_hc=$hc
#速度模式
#"0" "激进模式：赚取收益优先"
#"2" "平衡模式：赚钱上网兼顾"
#"3" "保守模式：上网体验优先"
spd=`nvram get youku_spd`
youku_enable=`nvram get youku_enable`

A_restart=`nvram get youku_status`
B_restart="$youku_enable$hc_dir$sn_youku$hc$spd"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set youku_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
	exit 1
fi
	[ ${youku_enable:=0} ] && [ "$youku_enable" -eq "0" ] && [ "$needed_restart" = "1" ] && { killall -9 ikuacc; nvram set youku_bdlink=""; killall -9 youku_install.sh youku_ssmon.sh; exit 0; }
if [ "$youku_enable" = "1" ] ; then
	localpath=`echo $hc_dir`
	if [ ! -d `echo $localpath` ] ; then
				logger -t "【路由宝】" "错误！！自定义缓存目录不存在！！"
				logger -t "【路由宝】" "$localpath 设置错误！！请检查 U盘 文件和设置"
	fi
	SVC_PATH=/opt/youku/bin/ikuacc
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【路由宝】" "自动安装 ikuacc 程序"
		# 找不到ikuacc，安装opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
		mkdir -p /opt/youku
		chmod -R 777 /opt/youku
		if [ ! -f "$SVC_PATH" ] ; then
			logger -t "【路由宝】" "找不到 $SVC_PATH 下载程序"
			/tmp/sh_download.sh "/opt/youku.tgz" "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/youku.tgz"
			/tmp/sh_untar.sh /opt/youku.tgz /opt/youku /opt/youku/bin/ikuacc
		else
			logger -t "【路由宝】" "找到 $SVC_PATH"
		fi
	fi

	[ ! -s "$SVC_PATH" ] && {  logger -t "【路由宝】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; exit 0; }

path=$hc_dir/youku
mkdir -p $path/meta
mkdir -p $path/data
mkdir -p /opt/youku
chmod -R 777 /opt/youku
chmod -R 777 $path/meta
chmod -R 777 $path/data



export LD_LIBRARY_PATH=/opt/youku/lib:/lib
#youku_Total=`cat /proc/meminfo | grep  MemTotal | sed -e s/"MemTotal:"//g | sed -e s/" "//g | sed -e s/"kB"//g`
#youku_Total=`expr $youku_Total - 26472`
killall -9 ikuacc
#ulimit -v $youku_Total
#nvram set youku_Total=$youku_Total
cd /opt/youku/bin/
/opt/youku/bin/ikuacc  --device-serial-number="0000$sn_youku"  --mobile-meta-path="$path/meta" --mobile-data-path="$path/data:$hc"  &
logger -t "【路由宝】" "开始运行"
sleep 5
#速度模式
wget --continue --no-check-certificate -O - http://127.0.0.1:8908/peer/limit/network/set?upload_model=$spd > /dev/null 2>&1 &
wget --continue --no-check-certificate -O - http://`nvram get lan_ipaddr`:8908/peer/limit/network/set?upload_model=$spd > /dev/null 2>&1 &

#获取绑定地址
rm /tmp/youku_sn.log
/opt/youku/bin/getykbdlink 0000$sn_youku >/tmp/youku_sn.log
sleep 3
bdlink=$(grep http -r /tmp/youku_sn.log)
nvram set youku_bdlink=$bdlink
logger -t "【路由宝】" "绑定地址："
logger -t "【路由宝】" "$bdlink"
echo "Youku $bdlink"
logger -t "【路由宝】" "SN:$sn_youku"
#logger -t "【路由宝】" "虚存最大值：$youku_Total"

#进程保护
/tmp/youku_ssmon.sh &

fi

EOF
chmod 777 "/tmp/youku_install.sh"

cat > "/tmp/youku_ssmon.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/opt/youku/lib:/lib
logger -t "【路由宝】" "进程保护启动"
hc_dir=`nvram get youku_hc_dir`
hc_dir=`echo $hc_dir`
sn_youku=`nvram get youku_sn`
#youku_Total=`nvram get youku_Total`
#ulimit -v $youku_Total
spd=`nvram get youku_spd`
path=$hc_dir/youku
hc=`nvram get youku_hc`
[ -z $hc ] && hc=6000 && nvram set youku_hc=$hc
while true; do
	localpath=`echo $hc_dir`
	if [ ! -d `echo $localpath` ] ; then
				logger -t "【路由宝】" "错误！！自定义缓存目录不存在！！"
				logger -t "【路由宝】" "$localpath 设置错误！！请检查 U盘 文件和设置"
	fi
	pids=$(ps | grep "ikuacc" | grep -v "grep" | wc -l)
	if [ "$pids" -ne 1 ] ; then
		logger -t "【路由宝】" "找不到优酷进程 $pids"
		sleep 1
		if [ ! -n "`pidof ikuacc`" ] ; then
			logger -t "【路由宝】" "找不到优酷进程(复查)，重启优酷"
		else
			continue
		fi
		killall -9 ikuacc
		sleep 1
		export LD_LIBRARY_PATH=/opt/youku/lib:/lib
		/opt/youku/bin/ikuacc  --device-serial-number="0000$sn_youku"  --mobile-meta-path="$path/meta" --mobile-data-path="$path/data:$hc"  &
		sleep 5
		export LD_LIBRARY_PATH=/lib:/opt/lib
		logger -t "【路由宝】" "开始运行. PID:【$(pidof ikuacc)】"
		#速度模式
		wget --continue --no-check-certificate -O - http://127.0.0.1:8908/peer/limit/network/set?upload_model=$spd > /dev/null 2>&1 &
		wget --continue --no-check-certificate -O - http://`nvram get lan_ipaddr`:8908/peer/limit/network/set?upload_model=$spd > /dev/null 2>&1 &
	fi

	pids=$(ps | grep "ikuacc" | grep -v "grep" | wc -l)
	if [ "$pids" -gt 4 ] ; then 
		echo "优酷进程重复，重启优酷"
		logger -t "【路由宝】" "优酷进程重复，重启优酷"
		killall -9 ikuacc
		sleep 3
		export LD_LIBRARY_PATH=/opt/youku/lib:/lib
		/opt/youku/bin/ikuacc  --device-serial-number="0000$sn_youku"  --mobile-meta-path="$path/meta" --mobile-data-path="$path/data:$hc"  &
		logger -t "【路由宝】" "开始运行"
		sleep 5
		export LD_LIBRARY_PATH=/lib:/opt/lib
		#速度模式
		wget --continue --no-check-certificate -O - http://127.0.0.1:8908/peer/limit/network/set?upload_model=$spd > /dev/null 2>&1 &
		wget --continue --no-check-certificate -O - http://`nvram get lan_ipaddr`:8908/peer/limit/network/set?upload_model=$spd > /dev/null 2>&1 &
	fi
	sleep 23
done

EOF
chmod 777 "/tmp/youku_ssmon.sh"







cat > "/tmp/sh_mento_hust.sh" <<-\EOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

mentohust_enable=`nvram get mentohust_enable`
mentohust_path=`nvram get mentohust_path`
[ -z $mentohust_path ] && mentohust_path="/usr/bin/mentohust" && nvram set mentohust_path=$mentohust_path
mentohust_u=`nvram get mentohust_u`
mentohust_p=`nvram get mentohust_p`
mentohust_n=`nvram get mentohust_n`
[ -z $mentohust_n ] && mentohust_n=$(nvram get wan0_ifname_t) && nvram set mentohust_n=$mentohust_n
mentohust_i=`nvram get mentohust_i`
[ -z $mentohust_i ] && mentohust_i="0.0.0.0" && nvram set mentohust_i=$mentohust_i
mentohust_m=`nvram get mentohust_m`
[ -z $mentohust_m ] && mentohust_m=$(nvram get lan_netmask) && nvram set mentohust_m=$mentohust_m
mentohust_g=`nvram get mentohust_g`
[ -z $mentohust_g ] && mentohust_g="0.0.0.0" && nvram set mentohust_g=$mentohust_g
mentohust_s=`nvram get mentohust_s`
[ -z $mentohust_s ] && mentohust_s="0.0.0.0" && nvram set mentohust_s=$mentohust_s
mentohust_o=`nvram get mentohust_o`
[ -z $mentohust_o ] && mentohust_o="0.0.0.0" && nvram set mentohust_o=$mentohust_o
mentohust_t=`nvram get mentohust_t`
[ -z $mentohust_t ] && mentohust_t="8" && nvram set mentohust_t=$mentohust_t
mentohust_e=`nvram get mentohust_e`
[ -z $mentohust_e ] && mentohust_e="30" && nvram set mentohust_e=$mentohust_e
mentohust_r=`nvram get mentohust_r`
[ -z $mentohust_r ] && mentohust_r="15" && nvram set mentohust_r=$mentohust_r
mentohust_l=`nvram get mentohust_l`
[ -z $mentohust_l ] && mentohust_l="8" && nvram set mentohust_l=$mentohust_l
mentohust_a=`nvram get mentohust_a`
[ -z $mentohust_a ] && mentohust_a="0" && nvram set mentohust_a=$mentohust_a
mentohust_d=`nvram get mentohust_d`
[ -z $mentohust_d ] && mentohust_d="0" && nvram set mentohust_d=$mentohust_d
mentohust_b=`nvram get mentohust_b`
[ -z $mentohust_b ] && mentohust_b="0" && nvram set mentohust_b=$mentohust_b
mentohust_v=`nvram get mentohust_v`
[ -z $mentohust_v ] && mentohust_v="0.00" && nvram set mentohust_v=$mentohust_v
mentohust_f=`nvram get mentohust_f`
mentohust_c=`nvram get mentohust_c`
[ -z $mentohust_c ] && mentohust_c="dhclinet" && nvram set mentohust_c=$mentohust_c

func_start()
{
logger -t "【MentoHUST】" "启动"

#保存配置到文件
if [ ! -f "/etc/storage/mentohust.conf" ] ; then
	$mentohust_path -u$mentohust_u -p$mentohust_p -n$mentohust_n -i$mentohust_i -m$mentohust_m -g$mentohust_g -s$mentohust_s -o$mentohust_o -t$mentohust_t -e$mentohust_e -r$mentohust_r -l$mentohust_l -a$mentohust_a -d$mentohust_d -b$mentohust_b -v$mentohust_v -f$mentohust_f  -c$mentohust_c -w
	pids=$(pidof process) && killall -9 $pids
fi

mentohust_mode=`nvram get mentohust_mode`
	if [ "$mentohust_mode" = "0" ] ; then
	logger -t "【MentoHUST】" "标准模式"
		$mentohust_path  > /dev/null 2>&1 
	elif [ "$mentohust_mode" = "1" ] ; then
	logger -t "【MentoHUST】" "锐捷模式"
	   $mentohust_path  -y  > /dev/null 2>&1 
	elif [ "$mentohust_mode" = "2" ] ; then
	logger -t "【MentoHUST】" "赛尔模式"
	   $mentohust_path -s8.8.8.8 > /dev/null 2>&1 
	fi
}

func_stop()
{
	pid_num=`pidof mentohust`
	if [ -n pid_num ] ; then
		killall -q -9 mentohust
		logger -t "【MentoHUST】" "关闭"
	fi
}


check_setting()
{
A_restart=`nvram get mentohust_status`
B_restart="$mentohust_enable$mentohust_path$mentohust_u$mentohust_p$mentohust_n$mentohust_i$mentohust_m$mentohust_g$mentohust_s$mentohust_o$mentohust_t$mentohust_e$mentohust_r$mentohust_a$mentohust_d$mentohust_b$mentohust_v$mentohust_f$mentohust_c"

B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set mentohust_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
	exit 0
fi
	#配置有变，重新生成
	rm -f /etc/storage/mentohust.conf

	[ ${mentohust_enable:=0} ] && [ "$mentohust_enable" -eq "0" ] && [ "$needed_restart" = "1" ] && { func_stop; exit 0; }
	

	[ ! -s "$mentohust_path" ] && {  logger -t "【MentoHUST】" "找不到 $mentohust_path, 需要手动安装 mentohust 程序"; func_stop; exit 0; }

	[ $mentohust_u ] && [ $mentohust_p ] && [ $mentohust_path ] \
	&& [ "$needed_restart" = "1" ] ||  { logger -t "【MentoHUST】" "mentohust 配置有错误, 需要手动检查 mentohust 配置"; func_stop; exit 1; }
	func_stop
	func_start
}


case "$1" in
start)
		func_start
		;;
stop)
		func_stop
		;;
*)
		echo "Usage: $0 {start|stop}"
		check_setting
		exit 1
		;;
esac

exit 0


EOF
chmod 777 "/tmp/sh_mento_hust.sh"



cat > "/tmp/ssserver.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

#初始化
ssserver_enable=`nvram get ssserver_enable`
ssserver_enable=${ssserver_enable:-"0"}
ssserver_method=`nvram get ssserver_method`
ssserver_password=`nvram get ssserver_password`
ssserver_port=`nvram get ssserver_port`
ssserver_port2=`nvram get ssserver_port2`
ssserver_time=`nvram get ssserver_time`
ssserver_time=${ssserver_time:-"120"}
ssserver_udp=`nvram get ssserver_udp`
ssserver_ota=`nvram get ssserver_ota`
ssserver_usage=`nvram get ssserver_usage`

# var define
#num=$(iptables -t filter -L INPUT -v -n --line-numbers | grep dpt:$ssserver_port | cut -d " " -f 1 | sort -nr)
#num2=$(iptables -t filter -L INPUT -v -n --line-numbers | grep dpt:$ssserver_port2 | cut -d " " -f 1 | sort -nr)

# kill first
stop_ssserver(){
logger -t "【SS-server】" "关闭 ss-server 服务"
	killall sskeep.sh >/dev/null 2>&1
	killall ss-server >/dev/null 2>&1
#	iptables -t filter -D INPUT $num  >/dev/null 2>&1
#	iptables -t filter -D INPUT $num2  >/dev/null 2>&1
}

# start ssserver
start_ssserver(){
logger -t "【SS-server】" "启动 ss-server 服务"
key_password=""
[ ! -z "$ssserver_password" ] && key_password="-k $ssserver_password" || key_password=""
	if [ "$ssserver_udp" == "1" ] ; then
		ss-server -s 0.0.0.0 -p $ssserver_port $key_password -m $ssserver_method -t $ssserver_time -u $ssserver_usage  -f /tmp/ssserver.pid
	else
		ss-server -s 0.0.0.0 -p $ssserver_port $key_password -m $ssserver_method -t $ssserver_time $ssserver_usage -f /tmp/ssserver.pid
	fi
	logger -t "【SS-server】" "`ps | grep ss-server | grep -v grep`"
	iptables -t filter -I INPUT -p tcp --dport $ssserver_port -j ACCEPT
	nvram set ssserver_port2=`nvram get ssserver_port`
	logger -t "【SS-server】" "ss-server 启动."
	sleep 10
	[ -z "`pidof ss-server`" ] && logger -t "【SS-server】" "启动失败, 注意检查端口是否有冲突,10秒后自动尝试重新启动" && sleep 10 && nvram set ssserver_status=00 && /tmp/ssserver.sh &
	sleep 10
	[ ! -z "`pidof ss-server`" ] && keep_ssserver
}

keep_ssserver(){
logger -t "【SS-server】" "ss-server 守护脚本启动."
killall sskeep.sh
cat > "/tmp/sskeep.sh" <<-\SSS
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
PRO_NAME="ss-server"
SSNUM=1

while true ; do
#   用ps获取 $PRO_NAME 进程数量
	NUM=`ps | grep $PRO_NAME | grep -v grep |wc -l`
#	echo $NUM
#	logger -t "【SS-server】" " $NUM 进程"
if [ "$NUM" -lt "$SSNUM" ] ; then
#   少于 $SSNUM ，重启进程
	logger -t "【SS-server】" "少于 $SSNUM, 重启进程"
	echo "$PRO_NAME was killed"
	nvram set ssserver_status=restart_firewall
	restart_firewall
	sleep 62
elif [ "$NUM" -gt "$SSNUM" ] ; then
#   大于 $SSNUM ，杀掉所有进程，重启
	logger -t "【SS-server】" "大于 $SSNUM, 杀掉所有进程, 重启"
	echo "more than $SSNUM $PRO_NAME,killall $PRO_NAME"
	nvram set ssserver_status=restart_firewall
	restart_firewall
	sleep 62
fi
sleep 37
if [ -n "`pidof ss-server`" ] ; then
	port=$(iptables -t filter -L INPUT -v -n --line-numbers | grep dpt:$ssserver_port | cut -d " " -f 1 | sort -nr | wc -l)
	if [ "$port" = 0 ] ; then
		logger -t "【SS-server】" "检测:找不到 ss-server 端口:$ssserver_port 规则, 重新添加"
		iptables -t filter -I INPUT -p tcp --dport $ssserver_port -j ACCEPT &
	fi
fi
done
exit 0
SSS
chmod 755 "/tmp/sskeep.sh"
/tmp/sskeep.sh &
}


check_setting()
{
A_restart=`nvram get ssserver_status`
B_restart="$ssserver_enable$ssserver_method$ssserver_password$ssserver_port$ssserver_time$ssserver_udp$ssserver_ota$ssserver_usage"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set ssserver_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
	if [ -n "`pidof ss-server`" ] && [ "$ssserver_enable" = "1" ] ; then
		port=$(iptables -t filter -L INPUT -v -n --line-numbers | grep dpt:$ssserver_port | cut -d " " -f 1 | sort -nr | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【SS-server】" "检测:找不到 ss-server 端口:$ssserver_port 规则, 重新添加"
			iptables -t filter -I INPUT -p tcp --dport $ssserver_port -j ACCEPT &
			iptables -t filter -I INPUT -p udp --dport $ssserver_port -j ACCEPT &
		fi
	fi
	exit 0
fi
	[ ${ssserver_enable:=0} ] && [ "$ssserver_enable" -eq "0" ] && [ "$needed_restart" = "1" ] && { stop_ssserver; killall -9 ssserver.sh; exit 0; }
	# Check if have ss-server 

	hash ss-server 2>/dev/null || {  logger -t "【SS-server】" "找不到 ss-server, 需要安装 opt"; }

	ssserver="0"
	hash ss-server 2>/dev/null || ssserver="1"
if [ "$ssserver" = "1" ] ; then
	# 找不到ss-server，安装opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	ssserver="0"
	hash ss-server 2>/dev/null || ssserver="1"
	if [ "$ssserver" = "1" ] ; then
		logger -t "【SS-server】" "找不到 ss-server. opt下载程序"
		/tmp/sh_download.sh "/opt/bin/ss-server" "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/ss-server"
		chmod 777 "/opt/bin/ss-server"
	fi
	hash ss-server 2>/dev/null || { logger -t "【SS-server】" "找不到 ss-server，请检查系统"; nvram set ssserver_enable=0 && nvram set ssserver_status=0 && nvram commit; exit 1; }
fi
	# Check the ss config from nvram

	[ $ssserver_port ] && [ $ssserver_time ] \
	&& [ "$needed_restart" = "1" ] ||  { logger -t "【SS-server】" "ss-server 配置有错误, 需要手动检查 ss-server 配置"; stop_ssserver; exit 1; }

	stop_ssserver
	start_ssserver

}


case $ACTION in
start)
	if [ "$ssserver_enable" == "1" ] ; then
	start_ssserver
	fi
	;;
stop | kill )
	stop_ssserver
	;;
restart)
	stop_ssserver
	start_ssserver
	;;
*)
	check_setting
	echo "Usage: $0 (start|stop|restart)"
	exit 1
	;;
esac

FOF
chmod 777 "/tmp/ssserver.sh"


cat > "/tmp/ssrserver.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib

#初始化
ssrserver_enable=`nvram get ssrserver_enable`
ssrserver_enable=${ssrserver_enable:-"0"}
ssrserver_update=`nvram get ssrserver_update`
ssrserver_update=${ssrserver_update:-"0"}

# kill first
stop_ssrserver(){
logger -t "【SSR】" "关闭 ssr-server 服务"
killall ssrkeep.sh
	eval $(ps  | grep "/opt/shadowsocks-manyuser/shadowsocks/server" | grep -v grep | awk '{print "kill "$1}')
}

# start ssrserver
start_ssrserver(){
logger -t "【SSR】" "ssr-server 检测更新"
rm -rf /opt/shadowsocks-manyuser/shadowsocks/crypto/utilb
wgetcurl.sh /opt/shadowsocks-manyuser/shadowsocks/crypto/utilb https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/util.py
wgetcurl.sh /opt/shadowsocks-manyuser/shadowsocks/crypto/utilc https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/util_taobao.py
A_util=`cat /opt/shadowsocks-manyuser/shadowsocks/crypto/util.py`
B_util=`cat /opt/shadowsocks-manyuser/shadowsocks/crypto/utilb`
C_util=`cat /opt/shadowsocks-manyuser/shadowsocks/crypto/utilc`
A_util=`echo -n "$A_util" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
B_util=`echo -n "$B_util" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
C_util=`echo -n "$C_util" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_util" != "$B_util" ] && [ "$ssrserver_update" = "1" ] ; then
	logger -t "【SSR】" "ssr-server github.com需要更新"
	logger -t "【SSR】" "下载:https://github.com/breakwa11/shadowsocks/archive/manyuser.zip"
	rm -rf /opt/manyuser.zip
	wgetcurl.sh /opt/manyuser.zip https://github.com/breakwa11/shadowsocks/archive/manyuser.zip
	unzip -o /opt/manyuser.zip  -d /opt/
	rm -rf /opt/shadowsocks-manyuser/shadowsocks/crypto/util.py
	cp -a /opt/shadowsocks-manyuser/shadowsocks/crypto/utilb /opt/shadowsocks-manyuser/shadowsocks/crypto/util.py
	logger -t "【SSR】" "ssr-server github.com更新完成"
else
	logger -t "【SSR】" "ssr-server github.com暂时没更新"
fi
if [ "$A_util" != "$C_util" ] && [ "$ssrserver_update" = "2" ] ; then
	logger -t "【SSR】" "ssr-server taobao.org需要更新"
	logger -t "【SSR】" "下载:https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/manyuser.zip"
	rm -rf /opt/manyuser.zip
	wgetcurl.sh /opt/manyuser.zip https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/manyuser.zip
	unzip -o /opt/manyuser.zip  -d /opt/
	rm -rf /opt/shadowsocks-manyuser/shadowsocks/crypto/util.py
	cp -a /opt/shadowsocks-manyuser/shadowsocks/crypto/utilc /opt/shadowsocks-manyuser/shadowsocks/crypto/util.py
	logger -t "【SSR】" "ssr-server taobao.org更新完成"
else
	logger -t "【SSR】" "ssr-server taobao.org暂时没更新"
fi
logger -t "【SSR】" "启动 ssr-server 服务"
rm -rf /opt/shadowsocks-manyuser/user-config.json
cp -a /etc/storage/SSRconfig_script.sh /opt/shadowsocks-manyuser/user-config.json
if [ -s "/opt/shadowsocks-manyuser/user-config.json" ] ; then
	chmod 777 -R /opt/shadowsocks-manyuser
	cd /opt/shadowsocks-manyuser/shadowsocks/
	python /opt/shadowsocks-manyuser/shadowsocks/server.py a >> /tmp/syslog.log 2>&1 &
	logger -t "【SSR】" "ssr-server 启动."
	logger -t "【SSR】" "请手动配置【外部网络 - 端口转发 - 启用手动端口映射】来开启WAN访问."
	keep_ssrserver
else
	logger -t "【SSR】" "/opt/shadowsocks-manyuser/user-config.json配 置写入失败."
	logger -t "【SSR】" "ssr-server 未启动."
	
fi
}


check_setting()
{
A_restart=`nvram get ssrserver_status`
B_restart="$ssrserver_enable$ssrserver_update$(cat /etc/storage/SSRconfig_script.sh | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set ssrserver_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
	
	exit 0
fi
	[ ${ssrserver_enable:=0} ] && [ "$ssrserver_enable" -eq "0" ] && [ "$needed_restart" = "1" ] && { stop_ssrserver; killall -9 ssrserver.sh; exit 0; }
	# Check if have ss-server 

	hash python 2>/dev/null || {  logger -t "【SSR】" "找不到 ssr-server, 需要安装 opt"; nvram set optinstall=1; }

	ssrserver="0"
	hash python 2>/dev/null || ssrserver="1"
	[ ! -f "/opt/shadowsocks-manyuser/shadowsocks/server.py" ] && ssrserver="1"
if [ "$ssrserver" = "1" ] ; then
	# 找不到ssr-server，安装opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	ssrserver="0"
	hash python 2>/dev/null || ssrserver="1"
	[ ! -f "/opt/shadowsocks-manyuser/shadowsocks/server.py" ] && ssrserver="1"
	if [ "$ssrserver" = "1" ] ; then
		logger -t "【SSR】" "找不到 ssr-server, opt 下载程序"
		ssfile=`nvram get ssfile`
		rm -rf /opt/opti.txt
		rm -rf /opt/lnmp.txt
		/tmp/sh_installs.sh $ssfile 1
		chmod 777 -R /opt/shadowsocks-manyuser
	fi
	[ ! -f "/opt/shadowsocks-manyuser/shadowsocks/server.py" ] && { logger -t "【SSR】" "找不到 ssr-server, 请检查系统"; nvram set ssrserver_enable=0 && nvram set ssrserver_status=0 && nvram commit; exit 1; }
fi
	
	stop_ssrserver
	start_ssrserver

}

keep_ssrserver(){
logger -t "【SSR】" "SSR 守护脚本启动."
killall ssrkeep.sh
cat > "/tmp/ssrkeep.sh" <<-\SSR
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
PRO_NAME="/opt/shadowsocks-manyuser/shadowsocks/server"
SSRNUM=1
 
while true ; do
#   用ps获取 $PRO_NAME 进程数量
	NUM=`ps | grep $PRO_NAME | grep -v grep |wc -l`
#	echo $NUM
#	logger -t "【SSR】" " $NUM 进程"
if [ "$NUM" -lt "$SSRNUM" ] ; then
#   少于 $SSRNUM ，重启进程
	logger -t "【SSR】" "少于 $SSRNUM, 重启进程"
	echo "$PRO_NAME was killed"
	eval $(ps  | grep "/opt/shadowsocks-manyuser/shadowsocks/server" | grep -v grep | awk '{print "kill "$1}')
	cd /opt/shadowsocks-manyuser/shadowsocks/
	python /opt/shadowsocks-manyuser/shadowsocks/server.py a >> /tmp/syslog.log 2>&1 &
elif [ "$NUM" -gt "$SSRNUM" ] ; then
#   大于 $SSRNUM ，杀掉所有进程，重启
	logger -t "【SSR】" "大于 $SSRNUM, 杀掉所有进程, 重启"
	echo "more than $SSRNUM $PRO_NAME,killall $PRO_NAME"
	eval $(ps | grep "/opt/shadowsocks-manyuser/shadowsocks/server" | grep -v grep | awk '{print "kill "$1}')
	cd /opt/shadowsocks-manyuser/shadowsocks/
	python /opt/shadowsocks-manyuser/shadowsocks/server.py a >> /tmp/syslog.log 2>&1 &
fi
sleep 23
done
exit 0
SSR
chmod 755 "/tmp/ssrkeep.sh"
/tmp/ssrkeep.sh &
}


case $ACTION in
start)
	if [ "$ssrserver_enable" == "1" ] ; then
	start_ssrserver
	fi
	exit 1
	;;
stop | kill )
	stop_ssrserver
	exit 1
	;;
restart)
	stop_ssrserver
	start_ssrserver
	exit 1
	;;
*)
	check_setting
	echo "Usage: $0 (start|stop|restart)"
	exit 1
	;;
esac

FOF
chmod 777 "/tmp/ssrserver.sh"

	if [ ! -f "/etc/storage/cow_script.sh" ] || [ ! -s "/etc/storage/cow_script.sh" ] ; then
cat > "/etc/storage/cow_script.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
sed -Ei '/UI设置自动生成/d' /etc/storage/cow_config_script.sh
sed -Ei '/^$/d' /etc/storage/cow_config_script.sh
ss_mode_x=`nvram get ss_mode_x`
ss_mode_x=${ss_mode_x:-"0"}
ss_rdd_server=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_rdd_server=""
ss_run_ss_local=`nvram get ss_run_ss_local`
ss_s1_local_port=`nvram get ss_s1_local_port`
ss_s2_local_port=`nvram get ss_s2_local_port`
ss_s1_local_port=${ss_s1_local_port:-"1081"}
ss_s2_local_port=${ss_s2_local_port:-"1082"}
nvram set ss_s1_local_port=$ss_s1_local_port
nvram set ss_s2_local_port=$ss_s2_local_port
lan_ipaddr=`nvram get lan_ipaddr`
sed -Ei "/$lan_ipaddr:$ss_s1_local_port/d" /etc/storage/cow_config_script.sh
sed -Ei "/$lan_ipaddr:$ss_s2_local_port/d" /etc/storage/cow_config_script.sh
if [ "$ss_mode_x" = "3" ] || [ "$ss_run_ss_local" = "1" ] ; then
cat >> "/etc/storage/cow_config_script.sh" <<-EUI
# UI设置自动生成 
proxy = socks5://$lan_ipaddr:$ss_s1_local_port
EUI
if [ ! -z $ss_rdd_server ] ; then
cat >> "/etc/storage/cow_config_script.sh" <<-EUI
# UI设置自动生成 
proxy = socks5://$lan_ipaddr:$ss_s2_local_port
EUI
fi
fi
FOF
chmod 777 "/etc/storage/cow_script.sh"
	fi
	if [ ! -f "/etc/storage/cow_config_script.sh" ] || [ ! -s "/etc/storage/cow_config_script.sh" ] ; then
cat > "/etc/storage/cow_config_script.sh" <<-\COWCON
# 配置文件中 # 开头的行为注释
#
# 代理服务器监听地址，重复多次来指定多个监听地址，语法：
#
#   listen = protocol://[optional@]server_address:server_port
#
# 支持的 protocol 如下：
#
# HTTP (提供 http 代理):
#   listen = http://127.0.0.1:7777
#
#   上面的例子中，cow 生成的 PAC url 为 http://127.0.0.1:7777/pac
#   配置浏览器或系统 HTTP 和 HTTPS 代理时请填入该地址
#   若配置代理时有对所有协议使用该代理的选项，且你不清楚此选项的含义，请勾选
#
# cow (需两个 cow 服务器配合使用):
#   listen = cow://encrypt_method:password@1.2.3.4:5678
#
#   若 1.2.3.4:5678 在国外，位于国内的 cow 配置其为二级代理后，两个 cow 之间可以
#   通过加密连接传输 http 代理流量。目前的加密采用与 shadowsocks 相同的方式。
#
# 其他说明：
# - 若 server_address 为 0.0.0.0，监听本机所有 IP 地址
# - 可以用如下语法指定 PAC 中返回的代理服务器地址（当使用端口映射将 http 代理提供给外网时使用）
#   listen = http://127.0.0.1:7777 1.2.3.4:5678
#
listen = http://0.0.0.0:7777
#
# 日志文件路径，如不指定则输出到 stdout
logFile = /tmp/syslog.log
#
# COW 默认仅对被墙网站使用二级代理
# 下面选项设置为 true 后，所有网站都通过二级代理访问
#alwaysProxy = false
#
# 指定多个二级代理时使用的负载均衡策略，可选策略如下
#
#   backup:  默认策略，优先使用第一个指定的二级代理，其他仅作备份使用
#   hash:	根据请求的 host name，优先使用 hash 到的某一个二级代理
#   latency: 优先选择连接延迟最低的二级代理
#
# 一个二级代理连接失败后会依次尝试其他二级代理
# 失败的二级代理会以一定的概率再次尝试使用，因此恢复后会重新启用
loadBalance = backup
#
#############################
# 指定二级代理
#############################
#
# 二级代理统一使用下列语法指定：
#
#   proxy = protocol://[authinfo@]server:port
#
# 重复使用 proxy 多次指定多个二级代理，backup 策略将按照二级代理出现的顺序来使用
#
# 目前支持的二级代理及配置举例：
#
# SOCKS5:
#   proxy = socks5://127.0.0.1:1080
#
# HTTP:
#   proxy = http://127.0.0.1:8080
#   proxy = http://user:password@127.0.0.1:8080
#
#
# 自动生成ss-local_1.json配置
# 自动生成ss-local_2.json配置
#
#   用户认证信息为可选项
#
# shadowsocks:
#   proxy = ss://encrypt_method:password@1.2.3.4:8388
#   proxy = ss://encrypt_method-auth:password@1.2.3.4:8388
#
#   encrypt_method 添加 -auth 启用 One Time Auth
#   authinfo 中指定加密方法和密码，所有支持的加密方法如下：
#	 aes-128-cfb, aes-192-cfb, aes-256-cfb,
#	 bf-cfb, cast5-cfb, des-cfb, rc4-md5,
#	 chacha20, salsa20, rc4, table
#   推荐使用 aes-128-cfb
#
# cow:
#   proxy = cow://method:passwd@1.2.3.4:4321
#
#   authinfo 与 shadowsocks 相同
#
#
#############################
# 执行 ssh 命令创建 SOCKS5 代理
#############################
#
# 下面的选项可以让 COW 执行 ssh 命令创建本地 SOCKS5 代理，并在 ssh 断开后重连
# COW 会自动使用通过 ssh 命令创建的代理，无需再通过 proxy 选项指定
# 可重复指定多个
#
# 注意这一功能需要系统上已有 ssh 命令，且必须使用 ssh public key authentication
#
# 若指定该选项，COW 将执行以下命令：
#	 ssh -n -N -D <local_socks_port> -p <server_ssh_port> <user@server>
# server_ssh_port 端口不指定则默认为 22
# 如果要指定其他 ssh 选项，请修改 ~/.ssh/config
#sshServer = user@server:local_socks_port[:server_ssh_port]
#
#############################
# 认证
#############################
#
# 指定允许的 IP 或者网段。网段仅支持 IPv4，可以指定 IPv6 地址，用逗号分隔多个项
# 使用此选项时别忘了添加 127.0.0.1，否则本机访问也需要认证
#allowedClient = 127.0.0.1, 192.168.1.0/24, 10.0.0.0/8
#
# 要求客户端通过用户名密码认证
# COW 总是先验证 IP 是否在 allowedClient 中，若不在其中再通过用户名密码认证
#userPasswd = username:password
#
# 如需指定多个用户名密码，可在下面选项指定的文件中列出，文件中每行内容如下
#   username:password[:port]
# port 为可选项，若指定，则该用户只能从指定端口连接 COW
# 注意：如有重复用户，COW 会报错退出
#userPasswdFile = /path/to/file
#
# 认证失效时间
# 语法：2h3m4s 表示 2 小时 3 分钟 4 秒
#authTimeout = 2h
#
#############################
# 高级选项
#############################
#
# 将指定的 HTTP error code 认为是被干扰，使用二级代理重试，默认为空
#httpErrorCode =
#
# 最多允许使用多少个 CPU 核
#core = 2
#
# 检测超时时间使用的网站，最好使用能快速访问的站点
estimateTarget = www.163.com
#
# 允许建立隧道连接的端口，多个端口用逗号分隔，可重复多次
# 默认总是允许下列服务的端口: ssh, http, https, rsync, imap, pop, jabber, cvs, git, svn
# 如需允许其他端口，请用该选项添加
# 限制隧道连接的端口可以防止将运行 COW 的服务器上只监听本机 ip 的服务暴露给外部
#tunnelAllowedPort = 80, 443
#
# GFW 会使 DNS 解析超时，也可能返回错误的地址，能连接但是读不到任何内容
# 下面两个值改小一点可以加速检测网站是否被墙，但网络情况差时可能误判
#
# 创建连接超时（语法跟 authTimeout 相同）
#dialTimeout = 5s
# 从服务器读超时
#readTimeout = 5s
#
# 基于 client 是否很快关闭连接来检测 SSL 错误，只对 Chrome 有效
# （Chrome 遇到 SSL 错误会直接关闭连接，而不是让用户选择是否继续）
# 可能将可直连网站误判为被墙网站，当 GFW 进行 SSL 中间人攻击时可以考虑使用
#detectSSLErr = false
#
# 修改 stat/blocked/direct 文件路径，如不指定，默认在配置文件所在目录下
# 执行 cow 的用户需要有对 stat 文件所在目录的写权限才能更新 stat 文件
#statFile = <dir to rc file>/stat
blockedFile = /etc/storage/basedomain.txt
#directFile = <dir to rc file>/direct
#
#
COWCON
chmod 777 "/etc/storage/cow_config_script.sh"
	fi


cat > "/tmp/sh_cow.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
cow_enable=`nvram get cow_enable`
cow_path=`nvram get cow_path`
[ -z $cow_path ] && cow_path=`which cow` && nvram set cow_path=$cow_path
ss_mode_x=`nvram get ss_mode_x`
ss_mode_x=${ss_mode_x:-"0"}
ss_rdd_server=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_rdd_server=""
ss_run_ss_local=`nvram get ss_run_ss_local`
ss_s1_local_port=`nvram get ss_s1_local_port`
ss_s2_local_port=`nvram get ss_s2_local_port`
ss_s1_local_port=${ss_s1_local_port:-"1081"}
ss_s2_local_port=${ss_s2_local_port:-"1082"}
nvram set ss_s1_local_port=$ss_s1_local_port
nvram set ss_s2_local_port=$ss_s2_local_port
lan_ipaddr=`nvram get lan_ipaddr`
A_restart=`nvram get cow_status`
B_restart="$cow_enable$cow_path$lan_ipaddr$ss_s1_local_port$ss_s2_local_port$ss_mode_x$ss_rdd_server$(cat /etc/storage/cow_script.sh /etc/storage/cow_config_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set cow_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$cow_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof cow`" ] && logger -t "【cow】" "停止 cow"
killall -9 cow cow_script.sh
fi
if [ "$cow_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 cow cow_script.sh
SVC_PATH=$cow_path
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/cow"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【cow】" "自动安装 cow 程序"
	# 找不到 cow，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【cow】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/cow "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/cow"
		chmod 755 "/opt/bin/cow"
	else
		logger -t "【cow】" "找到 $SVC_PATH"
	fi
	cow_path=`which cow` && nvram set cow_path=$cow_path
	SVC_PATH=$cow_path
fi

[ ! -s "$SVC_PATH" ] && {  logger -t "【cow】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【cow】" "运行 cow_script"
killall -9 cow cow_script.sh
/etc/storage/cow_script.sh
$cow_path -rc /etc/storage/cow_config_script.sh &
restart_dhcpd
sleep 3
[ ! -z "`pidof cow`" ] && logger -t "【cow】" "启动成功"
[ -z "`pidof cow`" ] && logger -t "【cow】" "启动失败, 注意检查端口是否有冲突,10秒后自动尝试重新启动" && sleep 10 && nvram set cow_status=00 && /tmp/sh_cow.sh &
fi

FOF
chmod 777 "/tmp/sh_cow.sh"


	if [ ! -f "/etc/storage/meow_script.sh" ] || [ ! -s "/etc/storage/meow_script.sh" ] ; then
cat > "/etc/storage/meow_script.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
sed -Ei '/UI设置自动生成/d' /etc/storage/meow_config_script.sh
sed -Ei '/^$/d' /etc/storage/meow_config_script.sh
ss_mode_x=`nvram get ss_mode_x`
ss_mode_x=${ss_mode_x:-"0"}
ss_rdd_server=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_rdd_server=""
ss_run_ss_local=`nvram get ss_run_ss_local`
ss_s1_local_port=`nvram get ss_s1_local_port`
ss_s2_local_port=`nvram get ss_s2_local_port`
ss_s1_local_port=${ss_s1_local_port:-"1081"}
ss_s2_local_port=${ss_s2_local_port:-"1082"}
nvram set ss_s1_local_port=$ss_s1_local_port
nvram set ss_s2_local_port=$ss_s2_local_port
lan_ipaddr=`nvram get lan_ipaddr`
sed -Ei "/$lan_ipaddr:$ss_s1_local_port/d" /etc/storage/meow_config_script.sh
sed -Ei "/$lan_ipaddr:$ss_s2_local_port/d" /etc/storage/meow_config_script.sh
if [ ! -f "/etc/storage/meow_direct_script.sh" ] || [ ! -s "/etc/storage/meow_direct_script.sh" ] ; then
logger -t "【meow】" "找不到 直连列表 下载 https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/direct.txt"
wgetcurl.sh /etc/storage/meow_direct_script.sh "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/direct.txt"
chmod 666 "/etc/storage/meow_direct_script.sh"
fi
if [ "$ss_mode_x" = "3" ] || [ "$ss_run_ss_local" = "1" ] ; then
cat >> "/etc/storage/meow_config_script.sh" <<-EUI
# UI设置自动生成 
proxy = socks5://$lan_ipaddr:$ss_s1_local_port
EUI
if [ ! -z $ss_rdd_server ] ; then
cat >> "/etc/storage/meow_config_script.sh" <<-EUI
# UI设置自动生成 
proxy = socks5://$lan_ipaddr:$ss_s2_local_port
EUI
fi
fi
FOF
chmod 777 "/etc/storage/meow_script.sh"
	fi
	if [ ! -f "/etc/storage/meow_config_script.sh" ] || [ ! -s "/etc/storage/meow_config_script.sh" ] ; then
cat > "/etc/storage/meow_config_script.sh" <<-\MECON
# 配置文件中 # 开头的行为注释
#
# 代理服务器监听地址，重复多次来指定多个监听地址，语法：
#
#   listen = protocol://[optional@]server_address:server_port
#
# 支持的 protocol 如下：
#
# HTTP (提供 http 代理):
#   listen = http://127.0.0.1:4411
#
#   上面的例子中，MEOW 生成的 PAC url 为 http://127.0.0.1:4411/pac
#
# HTTPS (提供 https 代理):
#   listen = https://example.com:443
#   cert = /path/to/cert.pem
#   key = /path/to/key.pem
#
#   上面的例子中，MEOW 生成的 PAC url 为 https://example.com:443/pac
#
# MEOW (需两个 MEOW 服务器配合使用):
#   listen = meow://encrypt_method:password@1.2.3.4:5678
#
#   若 1.2.3.4:5678 在国外，位于国内的 MEOW 配置其为二级代理后，两个 MEOW 之间可以
#   通过加密连接传输 http 代理流量。采用与 shadowsocks 相同的加密方式。
#
# 其他说明：
# - 若 server_address 为 0.0.0.0，监听本机所有 IP 地址
# - 可以用如下语法指定 PAC 中返回的代理服务器地址（当使用端口映射将 http 代理提供给外网时使用）
#   listen = http://127.0.0.1:4411 1.2.3.4:5678
#
listen = http://0.0.0.0:4411
#
#############################
# 通过IP判断是否直连，默认开启
#############################
#judgeByIP = true

# 日志文件路径，如不指定则输出到 stdout
logFile = /tmp/syslog.log
#
# 指定多个二级代理时使用的负载均衡策略，可选策略如下
#
#   backup:  默认策略，优先使用第一个指定的二级代理，其他仅作备份使用
#   hash:	根据请求的 host name，优先使用 hash 到的某一个二级代理
#   latency: 优先选择连接延迟最低的二级代理
#
# 一个二级代理连接失败后会依次尝试其他二级代理
# 失败的二级代理会以一定的概率再次尝试使用，因此恢复后会重新启用
loadBalance = backup
#
#############################
# 指定二级代理
#############################
#
# 二级代理统一使用下列语法指定：
#
#   proxy = protocol://[authinfo@]server:port
#
# 重复使用 proxy 多次指定多个二级代理，backup 策略将按照二级代理出现的顺序来使用
#
# 目前支持的二级代理及配置举例：
#
# SOCKS5:
#   proxy = socks5://127.0.0.1:1080
#
# HTTP:
#   proxy = http://127.0.0.1:8080
#   proxy = http://user:password@127.0.0.1:8080
#
#   用户认证信息为可选项
#
# HTTPS:
#   proxy = https://example.com:8080
#   proxy = https://user:password@example.com:8080
#
#   用户认证信息为可选项
#
# Shadowsocks:
#   proxy = ss://encrypt_method:password@1.2.3.4:8388
#
#   authinfo 中指定加密方法和密码，所有支持的加密方法如下：
#	 aes-128-cfb, aes-192-cfb, aes-256-cfb,
#	 bf-cfb, cast5-cfb, des-cfb, rc4-md5,
#	 chacha20, salsa20, rc4, table
#
# MEOW:
#   proxy = meow://method:passwd@1.2.3.4:4321
#
#   authinfo 与 shadowsocks 相同
#
#
#############################
# 执行 ssh 命令创建 SOCKS5 代理
#############################
#
# 下面的选项可以让 MEOW 执行 ssh 命令创建本地 SOCKS5 代理，并在 ssh 断开后重连
# MEOW 会自动使用通过 ssh 命令创建的代理，无需再通过 proxy 选项指定
# 可重复指定多个
#
# 注意这一功能需要系统上已有 ssh 命令，且必须使用 ssh public key authentication
#
# 若指定该选项，MEOW 将执行以下命令：
#	 ssh -n -N -D <local_socks_port> -p <server_ssh_port> <user@server>
# server_ssh_port 端口不指定则默认为 22
# 如果要指定其他 ssh 选项，请修改 ~/.ssh/config
#sshServer = user@server:local_socks_port[:server_ssh_port]
#
#############################
# 认证
#############################
#
# 指定允许的 IP 或者网段。网段仅支持 IPv4，可以指定 IPv6 地址，用逗号分隔多个项
# 使用此选项时别忘了添加 127.0.0.1，否则本机访问也需要认证
#allowedClient = 127.0.0.1, 192.168.1.0/24, 10.0.0.0/8
#
# 要求客户端通过用户名密码认证
# MEOW 总是先验证 IP 是否在 allowedClient 中，若不在其中再通过用户名密码认证
#userPasswd = username:password
#
# 如需指定多个用户名密码，可在下面选项指定的文件中列出，文件中每行内容如下
#   username:password[:port]
# port 为可选项，若指定，则该用户只能从指定端口连接 MEOW
# 注意：如有重复用户，MEOW 会报错退出
#userPasswdFile = /path/to/file
#
# 认证失效时间
# 语法：2h3m4s 表示 2 小时 3 分钟 4 秒
#authTimeout = 2h
#
#############################
# 高级选项
#############################
#
# 将指定的 HTTP error code 认为是被干扰，使用二级代理重试，默认为空
#httpErrorCode =
#
# 最多允许使用多少个 CPU 核
#core = 2
#
# 修改 direct/proxy 文件路径，如不指定，默认在配置文件所在目录下
directFile = /etc/storage/meow_direct_script.sh
proxyFile = /etc/storage/basedomain.txt
MECON
chmod 777 "/etc/storage/meow_config_script.sh"
	fi


cat > "/tmp/sh_meow.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
meow_enable=`nvram get meow_enable`
meow_path=`nvram get meow_path`
[ -z $meow_path ] && meow_path=`which meow` && nvram set meow_path=$meow_path
ss_mode_x=`nvram get ss_mode_x`
ss_mode_x=${ss_mode_x:-"0"}
ss_rdd_server=`nvram get ss_server2`
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_rdd_server=""
ss_run_ss_local=`nvram get ss_run_ss_local`
ss_s1_local_port=`nvram get ss_s1_local_port`
ss_s2_local_port=`nvram get ss_s2_local_port`
ss_s1_local_port=${ss_s1_local_port:-"1081"}
ss_s2_local_port=${ss_s2_local_port:-"1082"}
nvram set ss_s1_local_port=$ss_s1_local_port
nvram set ss_s2_local_port=$ss_s2_local_port
lan_ipaddr=`nvram get lan_ipaddr`
A_restart=`nvram get meow_status`
B_restart="$meow_enable$meow_path$lan_ipaddr$ss_s1_local_port$ss_s2_local_port$ss_mode_x$ss_rdd_server$(cat /etc/storage/meow_script.sh /etc/storage/meow_config_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set meow_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$meow_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof meow`" ] && logger -t "【meow】" "停止 meow"
killall -9 meow meow_script.sh
fi
if [ "$meow_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
killall -9 meow meow_script.sh
SVC_PATH=$meow_path
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/bin/meow"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【meow】" "自动安装 meow 程序"
	# 找不到 meow，安装 opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【meow】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/bin/meow "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/meow"
		chmod 755 "/opt/bin/meow"
	else
		logger -t "【meow】" "找到 $SVC_PATH"
	fi
	meow_path=`which meow` && nvram set meow_path=$meow_path
	SVC_PATH=$meow_path
fi

[ ! -s "$SVC_PATH" ] && {  logger -t "【meow】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【meow】" "运行 meow_script"
killall -9 meow meow_script.sh
/etc/storage/meow_script.sh
$meow_path -rc /etc/storage/meow_config_script.sh &
restart_dhcpd
sleep 3
[ ! -z "`pidof meow`" ] && logger -t "【meow】" "启动成功"
[ -z "`pidof meow`" ] && logger -t "【meow】" "启动失败, 注意检查端口是否有冲突,10秒后自动尝试重新启动" && sleep 10 && nvram set meow_status=00 && /tmp/sh_meow.sh &
fi

FOF
chmod 777 "/tmp/sh_meow.sh"


	if [ ! -f "/etc/storage/softether_script.sh" ] || [ ! -s "/etc/storage/softether_script.sh" ] ; then
cat > "/etc/storage/softether_script.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/softether:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
softether_path=`nvram get softether_path`
[ -z $softether_path ] && softether_path=`which vpnserver` && nvram set softether_path=$softether_path
SVC_PATH=$softether_path
[ -f /opt/softether/vpn_server.config ] && [ ! -f /etc/storage/vpn_server.config ] && cp -f /opt/softether/vpn_server.config /etc/storage/vpn_server.config
[ ! -f /etc/storage/vpn_server.config ] && touch /etc/storage/vpn_server.config
ln -sf /etc/storage/vpn_server.config /opt/softether/vpn_server.config
$SVC_PATH start
i=120
until [ ! -z "$tap" ]
do
	i=$(($i-1))
	tap=`ifconfig | grep tap_ | awk '{print $1}'`
	if [ "$i" -lt 1 ];then
		logger -t "【softether】" "错误：不能正确启动 vpnserver!"
		rm -rf /etc/storage/dnsmasq/dnsmasq.d/softether.conf
		restart_dhcpd
		logger -t "【softether】" "错误：不能正确启动 vpnserver!"
		[ -z "`pidof vpnserver`" ] && logger -t "【softether】" "启动失败, 注意检查hamcore.se2、vpncmd、vpnserver是否下载完整,10秒后自动尝试重新启动" && sleep 10 && nvram set softether_status=00 && /tmp/sh_softether.sh &
		exit
	fi
	sleep 1
done

logger -t "【softether】" "正确启动 vpnserver!"
brctl addif br0 $tap
echo interface=tap_vpn > /etc/storage/dnsmasq/dnsmasq.d/softether.conf
restart_dhcpd
mtd_storage.sh save &
FOF
chmod 777 "/etc/storage/softether_script.sh"
	fi



cat > "/tmp/sh_softether.sh" <<-\FOF
#!/bin/sh
export PATH='/opt/usr/sbin:/opt/softether:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
softether_enable=`nvram get softether_enable`
softether_path=`nvram get softether_path`
[ -z $softether_path ] && softether_path=`which vpnserver` && nvram set softether_path=$softether_path
SVC_PATH=$softether_path
A_restart=`nvram get softether_status`
B_restart="$softether_enable$softether_path$(cat /etc/storage/softether_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set softether_status=$B_restart
	needed_restart=1
else
	needed_restart=0
fi
if [ "$softether_enable" = "0" ] && [ "$needed_restart" = "1" ] ; then
[ ! -z "`pidof vpnserver`" ] && logger -t "【softether】" "停止 vpnserver"
$SVC_PATH stop
killall -9 vpnserver softether_script.sh
rm -rf /etc/storage/dnsmasq/dnsmasq.d/softether.conf
restart_dhcpd
fi
if [ "$softether_enable" = "1" ] && [ "$needed_restart" = "1" ] ; then
$SVC_PATH stop
killall -9 vpnserver softether_script.sh
if [ ! -f "$SVC_PATH" ] ; then
	SVC_PATH="/opt/softether/vpnserver"
fi
if [ ! -f "$SVC_PATH" ] ; then
	logger -t "【softether】" "自动安装 softether 程序"
	# 找不到 softether，安装 opt
	if [ ! -d "/opt/softether" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/softether
	fi
	if [ ! -f "$SVC_PATH" ] ; then
		logger -t "【softether】" "找不到 $SVC_PATH 下载程序"
		wgetcurl.sh /opt/softether/vpnserver "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/vpnserver"
		chmod 755 "/opt/softether/vpnserver"
		wgetcurl.sh /opt/softether/vpncmd "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/vpncmd"
		chmod 755 "/opt/softether/vpncmd"
		wgetcurl.sh /opt/softether/hamcore.se2 "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/hamcore.se2"
		chmod 755 "/opt/softether/hamcore.se2"
	else
		logger -t "【softether】" "找到 $SVC_PATH"
	fi
fi
	softether_path=$SVC_PATH && nvram set softether_path=$softether_path
	SVC_PATH=$softether_path
[ ! -s "$SVC_PATH" ] && {  logger -t "【softether】" "找不到 $SVC_PATH ，需要手动安装 $SVC_PATH"; }

logger -t "【softether】" "运行 softether_script"
$SVC_PATH stop
killall -9 vpnserver softether_script.sh
/etc/storage/softether_script.sh &
sleep 20
[ ! -z "`pidof vpnserver`" ] && logger -t "【softether】" "启动成功"
[ -z "`pidof vpnserver`" ] && logger -t "【softether】" "启动失败, 注意检查hamcore.se2、vpncmd、vpnserver是否下载完整,10秒后自动尝试重新启动" && sleep 10 && nvram set softether_status=00 && /tmp/sh_softether.sh &
fi

FOF
chmod 777 "/tmp/sh_softether.sh"



cat > "/tmp/ss.sh" <<-\FOF
#!/bin/sh
#================华丽的分割线====================================
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
#set -x
#初始化开始
TAG="SS_SPEC"		  # iptables tag
FWI="/tmp/firewall.shadowsocks.pdcn" # firewall include file

ss_enable=`nvram get ss_enable`
ss_enable=${ss_enable:-"0"}
ss_type=`nvram get ss_type`
ss_type=${ss_type:-"0"}
ss_run_ss_local=`nvram get ss_run_ss_local`

kcptun_enable=`nvram get kcptun_enable`
kcptun_enable=${kcptun_enable:-"0"}
kcptun2_enable=`nvram get kcptun2_enable`
kcptun2_enable=${kcptun2_enable:-"0"}
kcptun2_enable2=`nvram get kcptun2_enable2`
kcptun2_enable2=${kcptun2_enable2:-"0"}

kcptun_server=`nvram get kcptun_server`
if [ "$kcptun_enable" != "0" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $kcptun_server | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $kcptun_server | awk 'NR==5{print $3}'` 
kcptun_server=$resolveip
fi
[ "$kcptun_enable" = "0" ] && kcptun_server=""
nvram set ss_server1=`nvram get ss_server`
nvram set ss_s1_port=`nvram get ss_server_port`
nvram set ss_s1_key=`nvram get ss_key`
nvram set ss_s1_method=`nvram get ss_method`

#以后多线支持弄个循环，现在只做两线就算了，如果
#如果server2 只设置了ip，则其他配置与S1一样
ss_s1_local_address=`nvram get ss_s1_local_address`
ss_s2_local_address=`nvram get ss_s2_local_address`
ss_s1_local_address=${ss_s1_local_address:-"0.0.0.0"}
ss_s2_local_address=${ss_s2_local_address:-"0.0.0.0"}
nvram set ss_s1_local_address=$ss_s1_local_address
nvram set ss_s2_local_address=$ss_s2_local_address
ss_s1_local_port=`nvram get ss_s1_local_port`
ss_s2_local_port=`nvram get ss_s2_local_port`
ss_s1_local_port=${ss_s1_local_port:-"1081"}
ss_s2_local_port=${ss_s2_local_port:-"1082"}
nvram set ss_s1_local_port=$ss_s1_local_port
nvram set ss_s2_local_port=$ss_s2_local_port
ss_server1=`nvram get ss_server1`
ss_server2=`nvram get ss_server2`

ss_s1_port=`nvram get ss_s1_port`
ss_s2_port=`nvram get ss_s2_port`
ss_s2_port=${ss_s2_port:-$ss_s1_port}
ss_s1_method=`nvram get ss_s1_method| tr 'A-Z' 'a-z'`
ss_s2_method=`nvram get ss_s2_method| tr 'A-Z' 'a-z'`
ss_s2_method=${ss_s2_method:-$ss_s1_method}
ss_s1_key=`nvram get ss_s1_key`
ss_s2_key=`nvram get ss_s2_key`
ss_s2_key=${ss_s2_key:-$ss_s1_key}
ss_pdnsd_wo_redir=`nvram get ss_pdnsd_wo_redir` #pdnsd  0、走代理；1、直连
ss_pdnsd_wo_redir=${ss_pdnsd_wo_redir:-"0"}
ss_mode_x=`nvram get ss_mode_x` #ss模式，0 为chnroute, 1 为 gfwlist, 2 为全局, 3为ss-local 建立本地 SOCKS 代理
ss_mode_x=${ss_mode_x:-"0"}
ss_working_port=`nvram get ss_working_port` #working port 不需要在界面设置，在watchdog里面设置。
ss_working_port=${ss_working_port:-"1090"}
ss_multiport=`nvram get ss_multiport`
[ -z "$ss_multiport" ] && ss_multiport="22,80,443" && nvram set ss_multiport=$ss_multiport
[ -n "$ss_multiport" ] && ss_multiport="-m multiport --dports $ss_multiport" || ss_multiport="-m multiport --dports 22,80,443" # 处理多端口设定
# 严重警告，如果走chnrouter 和全局模式，又不限制端口，下载流量都会通过你的ss服务器往外走，随时导致你的ss服务器被封或ss服务商封你帐号，设置连累你的SS服务商被封

# DNS 端口，用于防止域名污染用的PDNSD
DNS_Server=127.0.0.1#8053

ss_pdnsd_all=`nvram get ss_pdnsd_all`
[ "$ss_mode_x" != "0" ] && kcptun2_enable=$kcptun2_enable2
[ "$kcptun2_enable" = "2" ] && ss_server2=""
[ -z "$ss_server2" ] && [ "$kcptun2_enable" != "2" ] && kcptun2_enable=2 && logger -t "【SS】" "设置内容:非 chnroute 模式, 备服务器 停用"
[ "$ss_mode_x" != "0" ] && [ ! -z "$ss_server2" ] && [ "$kcptun2_enable" != "2" ] && kcptun2_enable=0 && logger -t "【SS】" "设置内容:非 chnroute 模式，备服务器 故障转移 模式"
[ "$ss_mode_x" != "0" ] && nvram set kcptun2_enable2=$kcptun2_enable
[ "$ss_mode_x" = "0" ] && nvram set kcptun2_enable=$kcptun2_enable
[ "$ss_pdnsd_all" = "1" ] && [ "$ss_mode_x" != "0" ] && ss_pdnsd_all=0 && logger -t "【SS】" "设置内容:非 chnroute 模式，不转全部发pdnsd"
[ "$ss_pdnsd_all" = "1" ] && [ "$kcptun2_enable" = "1" ] && ss_pdnsd_all=0 && logger -t "【SS】" "设置内容:开启 kcptun+gfwlist 模式，不转全部发 pdnsd"
nvram set ss_pdnsd_all=$ss_pdnsd_all
ss_3p_enable=`nvram get ss_3p_enable`
ss_3p_gfwlist=`nvram get ss_3p_gfwlist`
ss_3p_kool=`nvram get ss_3p_kool`


ss_sub1=`nvram get ss_sub1`
ss_sub2=`nvram get ss_sub2`
ss_sub3=`nvram get ss_sub3`
ss_sub4=`nvram get ss_sub4`

ss_tochina_enable=`nvram get ss_tochina_enable`
ss_tochina_enable=${ss_tochina_enable:-"0"}
ss_udp_enable=`nvram get ss_udp_enable` #udp转发  0、停用；1、启动
ss_udp_enable=${ss_udp_enable:-"0"}
ss_upd_rules=`nvram get ss_upd_rules`
if [ ! -z "$ss_upd_rules" ] ; then
	ss_upd_rules="-s $ss_upd_rules" 
fi
# ss_upd_rules UDP参数用法，暂时不考虑字符安全过滤的问题，单用户系统输入，并且全root开放的平台，你愿意注入自己的路由器随意吧。
# 范例 
# 单机全部 192.168.123.10 
# 多台单机 192.168.123.10,192.168.123.12
# 子网段  192.168.123.16/28  不知道怎么设置自己找在线子网掩码工具计算
# 单机但限定目的端口  192.168.123.10 --dport 3000:30010
# 如果需要更加细节的设置，可以让用户自己修改一个iptables 文件来处理。

ss_usage=`nvram get ss_usage`
ss_s2_usage=`nvram get ss_s2_usage`

# 混淆参数
ssr_type_obfs_custom=`nvram get ssr_type_obfs_custom`
ssr2_type_obfs_custom=`nvram get ssr2_type_obfs_custom`
[ ! -z "$ssr_type_obfs_custom" ] && [ "$ss_type" = "1" ] && ss_usage_json=" -g $ssr_type_obfs_custom"
[ ! -z "$ssr2_type_obfs_custom" ] && [ "$ss_type" = "1" ] && ss_s2_usage_json=" -g $ssr2_type_obfs_custom"
# 协议参数
ssr_type_protocol_custom=`nvram get ssr_type_protocol_custom`
ssr2_type_protocol_custom=`nvram get ssr2_type_protocol_custom`
[ ! -z "$ssr_type_protocol_custom" ] && [ "$ss_type" = "1" ] && ss_usage_json="$ss_usage_json -G $ssr_type_protocol_custom"
[ ! -z "$ssr2_type_protocol_custom" ] && [ "$ss_type" = "1" ] && ss_s2_usage_json="$ss_s2_usage_json -G $ssr2_type_protocol_custom"
# 插件参数
ss_plugin_config=`nvram get ss_plugin_config`
ss2_plugin_config=`nvram get ss2_plugin_config`
[ ! -z "$ss_plugin_config" ] && [ "$ss_type" = "0" ] && ss_usage_json="$ss_usage_json $ss_plugin_config"
[ ! -z "$ss2_plugin_config" ] && [ "$ss_type" = "0" ] && ss_s2_usage_json="$ss_s2_usage_json $ss2_plugin_config"

touch /etc/storage/shadowsocks_mydomain_script.sh
LAN_AC_IP=`nvram get LAN_AC_IP`
LAN_AC_IP=${LAN_AC_IP:-"0"}

lan_ipaddr=`nvram get lan_ipaddr`
ss_DNS_Redirect=`nvram get ss_DNS_Redirect`
ss_DNS_Redirect_IP=`nvram get ss_DNS_Redirect_IP`
[ -z "$ss_DNS_Redirect_IP" ] && ss_DNS_Redirect_IP=$lan_ipaddr

ss_updatess=`nvram get ss_updatess`
ss_updatess=${ss_updatess:-"0"}

##  bigandy modify 
##  1. 增加xbox的支持 （未实现，下一版本）
##  2. 改写获取gfwlist逻辑
##  3. 增加对自定义域名的支持
##  4. 订阅机制，提供网站加速的列表订阅功能
##ss_xbox=`nvram get ss_xbox`  //andy
ss_s1_ip=""
ss_s2_ip=""

# 
GFWLIST_TARGET="SS_SPEC_WAN_FW"
LAN_TARGET=""
WAN_TARGET=""
SH_TARGET=""
ip_list=""
wifidognx=""

#检查 dnsmasq 目录参数
confdir=`grep conf-dir /etc/storage/dnsmasq/dnsmasq.conf | sed 's/.*\=//g'`
if [ -z "$confdir" ] ; then 
	confdir="/tmp/ss/dnsmasq.d"
fi
[ ! -z "$confdir" ] && mkdir -p $confdir

# 创建JSON
cat > "/tmp/SSJSON.sh" <<-\SSJSONSH
while getopts ":o:O:g:G:s:p:b:l:k:m:f:" arg; do
	case "$arg" in
		o)
			obfs=$OPTARG
			;;
		O)
			protocol=$OPTARG
			;;
		g)
			obfs_param=$OPTARG
			;;
		G)
			protocol_param=$OPTARG
			;;
		s)
			server=$OPTARG
			;;
		p)
			server_port=$OPTARG
			;;
		b)
			local_address=$OPTARG
			;;
		l)
			local_port=$OPTARG
			;;
		k)
			password=$OPTARG
			;;
		m)
			method=$OPTARG
			;;
		f)
			config_file=$OPTARG
			;;
	esac
done
cat > "$config_file" <<-SSJSON
{
"server": "$server",
"server_port": "$server_port",
"local_address": "$local_address",
"local_port": "$local_port",
"password": "$password",
"timeout": "180",
"method": "$method",
"protocol": "$protocol",
"protocol_param": "$protocol_param",
"obfs": "$obfs",
"obfs_param": "$obfs_param"
}
SSJSON
SSJSONSH
chmod 755 /tmp/SSJSON.sh

start_ss_redir()
{
logger -t "【ss-redir】" "启动所有的 SS 连线, 出现的 SS 日志并不是错误报告, 只是使用状态日志, 请不要慌张, 只要系统正常你又看不懂就无视它！"
logger -t "【SS】" "SS服务器1 设置内容：$ss_server1 端口:$ss_s1_port 加密方式:$ss_s1_method "
[ -z "$ss_server1" ] && { logger -t "【SS】" "[错误!!] SS服务器没有设置"; stop_SS; clean_SS; } 
[ ! -z "$ss_server1" ] && ss_s1_ip=`/usr/bin/resolveip -4 -t 4 $ss_server1 | grep -v : | sed -n '1p'`
[ -z "$ss_s1_ip" ] && ss_s1_ip=`nslookup $ss_server1 | awk 'NR==5{print $3}'` 
[ -z "$ss_s1_ip" ] && { logger -t "【SS】" "[错误!!] 实在找不到你的SS1服务器IP，麻烦看看哪里错了？"; clean_SS; } 
[ ! -z "$ss_server2" ] && ss_s2_ip=`/usr/bin/resolveip -4 -t 4 $ss_server2 | grep -v : | sed -n '1p'`
[ ! -z "$ss_server2" ] && [ -z "$ss_s2_ip" ] && ss_s2_ip=`nslookup $ss_server2 | awk 'NR==5{print $3}'`
[ ! -z "$ss_server2" ] && [ -z "$ss_s2_ip" ] && { logger -t "【SS】" "[错误!!] 实在找不到你的SS2服务器IP，麻烦看看哪里错了？"; } 
[ ! -z "$ss_s2_ip" ] && ss_ip="$ss_s1_ip,$ss_s2_ip" || ss_ip=$ss_s1_ip
if [ "$ss_udp_enable" == 1 ] ; then
ss_usage="$ss_usage -u"
ss_s2_usage="$ss_s2_usage -u"
fi

options1=""
options1=${ss_usage//-o/}
options1=${options1//-O/}
options1=${options1//origin/}
options1=${options1//verify_simple/}
options1=${options1//verify_deflate/}
options1=${options1//verify_sha1/}
options1=${options1//auth_simple/}
options1=${options1//auth_sha1_v2/}
options1=${options1//auth_sha1_v4/}
options1=${options1//auth_aes128_md5/}
options1=${options1//auth_aes128_sha1/}
options1=${options1//auth_sha1/}
options1=${options1//plain/}
options1=${options1//http_simple/}
options1=${options1//http_post/}
options1=${options1//tls_simple/}
options1=${options1//random_head/}
options1=${options1//tls1.2_ticket_auth/}
options2=""
options2=${ss_s2_usage//-o/}
options2=${options2//-O/}
options2=${options2//origin/}
options2=${options2//verify_simple/}
options2=${options2//verify_deflate/}
options2=${options2//verify_sha1/}
options2=${options2//auth_simple/}
options2=${options2//auth_sha1_v2/}
options2=${options2//auth_sha1_v4/}
options2=${options2//auth_aes128_md5/}
options2=${options2//auth_aes128_sha1/}
options2=${options2//auth_sha1/}
options2=${options2//plain/}
options2=${options2//http_simple/}
options2=${options2//http_post/}
options2=${options2//tls_simple/}
options2=${options2//random_head/}
options2=${options2//tls1.2_ticket_auth/}

# 启动程序

	pidof ss-redir  >/dev/null 2>&1 && killall ss-redir && killall -9 ss-redir 2>/dev/null
	/tmp/SSJSON.sh -f /tmp/ss-redir_1.json $ss_usage $ss_usage_json -s $ss_s1_ip -p $ss_s1_port -l 1090 -b 0.0.0.0 -k $ss_s1_key -m $ss_s1_method
	ss-redir -c /tmp/ss-redir_1.json $options1 >/dev/null 2>&1 &
	if [ ! -z $ss_server2 ] ; then
		#启动第二个SS 连线
		[  -z "$ss_s2_ip" ] && { logger -t "【SS】" "[错误!!] 无法获得 SS 服务器2的IP, 请核查设置"; stop_SS; clean_SS; }
		logger -t "【SS】" "SS服务器2 设置内容：$ss_server2 端口:$ss_s2_port 加密方式:$ss_s2_method "
		/tmp/SSJSON.sh -f /tmp/ss-redir_2.json $ss_s2_usage $ss_s2_usage_json -s $ss_s2_ip -p $ss_s2_port -l 1091 -b 0.0.0.0 -k $ss_s2_key -m $ss_s2_method
		ss-redir -c /tmp/ss-redir_2.json $options2 >/dev/null 2>&1 &
	fi
	check_ip
if [ "$ss_mode_x" = "3" ] || [ "$ss_run_ss_local" = "1" ] ; then
	[ "$ss_mode_x" = "3" ] && killall ss-redir
	logger -t "【ss-local】" "启动所有的 ss-local 连线, 出现的 SS 日志并不是错误报告, 只是使用状态日志, 请不要慌张, 只要系统正常你又看不懂就无视它！"
	pidof ss-local  >/dev/null 2>&1 && killall ss-local && killall -9 ss-local 2>/dev/null
	logger -t "【ss-local】" "本地监听地址：$ss_s1_local_address 本地代理端口：$ss_s1_local_port SS服务器1 设置内容：$ss_server1 端口:$ss_s1_port 加密方式:$ss_s1_method "
	/tmp/SSJSON.sh -f /tmp/ss-local_1.json $ss_usage $ss_usage_json -s $ss_s1_ip -p $ss_s1_port -b $ss_s1_local_address -l $ss_s1_local_port -k $ss_s1_key -m $ss_s1_method
	ss-local -c /tmp/ss-local_1.json $options1 >/dev/null 2>&1 &
	if [ ! -z $ss_server2 ] ; then
		#启动第二个SS 连线
		[  -z "$ss_s2_ip" ] && { logger -t "【ss-local】" "[错误!!] 无法获得 SS 服务器2的IP,请核查设置"; stop_SS; clean_SS; }
		logger -t "【ss-local】" "本地监听地址：$ss_s2_local_address 本地代理端口：$ss_s2_local_port SS服务器2 设置内容：$ss_server2 端口:$ss_s2_port 加密方式:$ss_s2_method "
		/tmp/SSJSON.sh -f /tmp/ss-local_2.json $ss_s2_usage $ss_s2_usage_json -s $ss_s2_ip -p $ss_s2_port -b $ss_s2_local_address -l $ss_s2_local_port -k $ss_s2_key -m $ss_s2_method
		ss-local -c /tmp/ss-local_2.json $options2 >/dev/null 2>&1 &
	fi
fi
}


check_ssr()
{
umount /usr/sbin/ss-redir
umount /usr/sbin/ss-local
if [ "$ss_type" = "1" ] ; then
	if [ -s "/usr/sbin/ssr-redir" ] ; then
		mount --bind /usr/sbin/ssr-redir /usr/sbin/ss-redir
	else
		if [ ! -s "/tmp/bin/ssr-redir" ] ; then
			logger -t "【SSR】" "找不到 ssr-redir. tmp下载程序"
			mkdir -p /tmp/bin
			/tmp/sh_download.sh "/tmp/bin/ssr-redir" "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/ssr-redir"
			chmod 777 "/tmp/bin/ssr-redir"
		fi
		mount --bind /tmp/bin/ssr-redir /usr/sbin/ss-redir
	fi
	if [ -s "/usr/sbin/ssr-local" ] ; then
		mount --bind /usr/sbin/ssr-local /usr/sbin/ss-local
	else
		if [ ! -s "/tmp/bin/ssr-local" ] ; then
			logger -t "【SSR】" "找不到 ssr-local. tmp下载程序"
			mkdir -p /tmp/bin
			/tmp/sh_download.sh "/tmp/bin/ssr-local" "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/ssr-local"
			chmod 777 "/tmp/bin/ssr-local"
		fi
		mount --bind /tmp/bin/ssr-local /usr/sbin/ss-local
	fi
fi
}


check_ip()
{
ss_check=`nvram get ss_check`
if [ "$ss_check" = "1" ] ; then
	# 检查主服务器是否能用
	checkip=0
	sleep 3
for action_port in 1090 1091
do
	action_port=$action_port
	echo $action_port
	[ $action_port == 1090 ] && action_ssip=$ss_s1_ip
	[ $action_port == 1091 ] && action_ssip=$ss_s2_ip
if [ ! -z "$action_ssip" ] ; then
	logger -t "【ss-redir】" "check_ip 检查 SS 服务器$action_port是否能用"
	lan_ipaddr=`nvram get lan_ipaddr`
	BP_IP="$ss_s1_ip,$ss_s2_ip,$kcptun_server"
	ss-rules -s "$action_ssip" -l "$action_port" -b $BP_IP -d "RETURN" -a "g,$lan_ipaddr" -e '-m multiport --dports 80' -o -O
	sleep 1
	curltest=`which curl`
	if [ -z "$curltest" ] ; then
		wget --continue --no-check-certificate -s -q -T 10 http://www.163.com
		[ "$?" == "0" ] && check=200 || check=404
	else
		check=`curl -k -s -w "%{http_code}" "http://www.163.com" -o /dev/null`
	fi
	if [ "$check" == "200" ] ; then
		logger -t "【ss-redir】" "check_ip 检查 SS 服务器 $action_port 代理连接 www.163.com 成功"
		checkip=1
	else
		logger -t "【ss-redir】" "check_ip 检查 SS 服务器 $action_port 代理连接 www.163.com 失败"
		[ ${action_port:=1090} ] && [ $action_port == 1091 ] && Server=1090 || Server=1091
		#加上切换标记
		nvram set ss_working_port=$Server
		ss_working_port=`nvram get ss_working_port`
		[ "$checkip" == "0" ] && checkip=0
	fi
	# #使用高春辉的IPIP.net来解析ip，感觉应该会稳定吧。
	# getip=`wget --continue --no-check-certificate www.ipip.net -O- -q | grep ip_text | grep -o '\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}'`
	# echo "ssip: "$action_ssip
	# echo "ipip.net: "$getip
	# if [ "$action_ssip" != "$getip" ] ; then
		# logger -t "【ss-redir】" "check_ip 检查 SS 服务器 $action_port 代理连接失败，由于代理ip不符，启动设置ip为： $action_ssip 规则获取ip为： $getip"
		# [ ${action_port:=1090} ] && [ $action_port == 1091 ] && Server=1090 || Server=1091
		# #加上切换标记
		# nvram set ss_working_port=$Server
		# ss_working_port=`nvram get ss_working_port`
		# [ "$checkip" == "0" ] && checkip=0
	# else
		# logger -t "【ss-redir】" "check_ip 检查 SS 服务器 $action_port 代理连接成功, 规则获取ip为:$getip"
		# nvram set ss_working_port=$action_port
		# ss_working_port=`nvram get ss_working_port`
		# checkip=1
	# fi
fi
	ss-rules -f
done
echo "checkip: "$checkip
if [ "$checkip" == "0" ] ; then
	logger -t "【ss-redir】" "check_ip 检查两个 SS 服务器代理连接失败, 请检查配置, 10秒后重启shadowsocks"

	killall ss-local ss-redir
	sleep 10
	/etc/storage/ez_buttons_script.sh cleanss &
	sleep 5
	exit 0
fi
fi
}

start_pdnsd()
{
	logger -t "【SS】" "启动 pdnsd 防止域名污染"
	pidof pdnsd >/dev/null 2>&1 && killall pdnsd && killall -9 pdnsd 2>/dev/null
pdnsd_conf="/etc/storage/pdnsd.conf"
if [ ! -f "$pdnsd_conf" ] ; then
	cat > $pdnsd_conf <<-\END
global {
perm_cache=2048;
cache_dir="/var/pdnsd";
run_as="nobody";
server_port = 8053;
server_ip = 0.0.0.0;
status_ctl = on;
query_method=tcp_only;
min_ttl=1m;
max_ttl=1w;
timeout=5;
}

server {
label= "opendns";
ip = 208.67.222.222, 208.67.220.220; 
port = 443;	   
root_server = on;	
uptest= none;		 
}

server {
label= "google dns";
ip = 8.8.8.8, 8.8.4.4; 
port = 53;	   
root_server = on;	
uptest= none;		 
}


END
fi
	chmod 755 $pdnsd_conf
CACHEDIR=/var/pdnsd
CACHE=$CACHEDIR/pdnsd.cache

USER=nobody
GROUP=nogroup

if ! test -f "$CACHE"; then
	mkdir -p `dirname $CACHE`
	dd if=/dev/zero of="$CACHE" bs=1 count=4 2> /dev/null
	chown -R $USER.$GROUP $CACHEDIR
fi
pdnsd -c $pdnsd_conf -p /var/run/pdnsd.pid &

}


clean_ss_rules()
{
echo "clean_ss_rules"
flush_r
	ipset destroy gfwlist
	iptables -t nat -D OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j REDIRECT --to-port 1090
	iptables -t nat -D OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j REDIRECT --to-port 1090
	iptables -t nat -D OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j REDIRECT --to-port 1091
	iptables -t nat -D OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j REDIRECT --to-port 1091
	iptables -t nat -D OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j RETURN
	iptables -t nat -D OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j RETURN
}

flush_r() {
	iptables-save -c | sed  "s/webstr--url/webstr --url/g" | grep -v "$TAG" | iptables-restore -c
	ip rule del fwmark 1 lookup 100 2>/dev/null
	ip route del local default dev lo table 100 2>/dev/null
	for setname in $(ipset -n list | grep -i "$TAG"); do
		ipset destroy $setname 2>/dev/null
	done
	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
	return 0
}

start_ss_rules()
{
#载入iptables模块
for module in ip_set ip_set_bitmap_ip ip_set_bitmap_ipmac ip_set_bitmap_port ip_set_hash_ip ip_set_hash_ipport ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_net ip_set_hash_netport ip_set_list_set xt_set xt_TPROXY
do
	modprobe $module
done 
	logger -t "【SS】" "设置 SS 的防火墙规则"
	clean_ss_rules
	echo "start_ss_rules"
#内网LAN代理转发白名单设置
#	0  默认值, 常规, 未在以下设定的 内网IP 根据 SS配置工作模式 走 SS
#	1		 全局, 未在以下设定的 内网IP 使用全局代理 走 SS
#	2		 绕过, 未在以下设定的 内网IP 不使用 SS
mkdir /tmp/ss -p
if [ -n "$LAN_AC_IP" ] ; then
	case "${LAN_AC_IP:0:1}" in
		0)
			LAN_TARGET="SS_SPEC_WAN_AC"
			DNS_LAN_TARGET="SS_SPEC_DNS_WAN_AC"
			;;
		1)
			LAN_TARGET="SS_SPEC_WAN_FW"
			DNS_LAN_TARGET="SS_SPEC_DNS_WAN_FW"
			;;
		2)
			LAN_TARGET="RETURN"
			DNS_LAN_TARGET="RETURN"
			;;
	esac
fi
	
	#如果是 gfwlist 模式，则 gfwlist 为 ipash，chnroute 模式，则为 hash:net模式
	ipset -! -N gfwlist iphash
	ipset -! -N cflist iphash

	# rules规则
	ipset -! restore <<-EOF || return 1
create ss_spec_src_ac hash:ip hashsize 64
create ss_spec_src_bp hash:ip hashsize 64
create ss_spec_src_fw hash:ip hashsize 64
create ss_spec_dst_sp hash:net hashsize 64
create ss_spec_dst_bp hash:net hashsize 64
create ss_spec_dst_fw hash:net hashsize 64
create ss_spec_dst_sh hash:net hashsize 64
create ss_spec_src_gfw hash:net hashsize 64
create ss_spec_src_chn hash:net hashsize 64
$(gen_special_purpose_ip | sed -e "s/^/add ss_spec_dst_sp /")
EOF


	if [ "$ss_tochina_enable" = "0" ] ; then
	# 出国模式
		logger -t "【SS】" "出国模式" && echo "ss_tochina_enable:$ss_tochina_enable"
		SH_TARGET="RETURN"
		WAN_TARGET="SS_SPEC_WAN_FW"
	else
	# 回国模式
		logger -t "【SS】" "回国模式" && echo "ss_tochina_enable:$ss_tochina_enable"
		SH_TARGET="SS_SPEC_WAN_FW"
		WAN_TARGET="RETURN"
fi
if [ "$ss_mode_x" = "0" ] ; then
# 0 为 chnroute 规则
	MODE_TARGET="SS_SPEC_WAN_CHN"
	if [ "$kcptun2_enable" = "1" ] ; then
		# Kcptun_enable
		logger -t "【SS】" "备服务器 同时启用 GFW 规则代理"
		MODE_TARGET="SS_SPEC_WAN_CHNGFW"
		GFWLIST_TARGET="SS_SPEC_WAN_KCPTUN"
	fi
	if [ -f /tmp/ss/chnroute.txt ] ; then
		ipset flush ss_spec_dst_sh
		grep -v '^#' /tmp/ss/chnroute.txt | sort -u | grep -v "^$" | sed -e "s/^/-A ss_spec_dst_sh &/g" | ipset -R -!
	fi
fi

if [ "$ss_mode_x" = "1" ] ; then
	MODE_TARGET="SS_SPEC_WAN_GFW"
# 1 为 gfwlist 规则
	GFWLIST_TARGET="SS_SPEC_WAN_FW"
fi

if [ "$ss_mode_x" = "2" ] ; then
# 2 为 全局 规则
	MODE_TARGET="SS_SPEC_WAN_FW"
	#LAN_TARGET="SS_SPEC_WAN_FW"
fi

# /etc/storage/shadowsocks_config_script.sh
# 内网(LAN)IP设定行为设置, 格式如 b,192.168.1.23, 多个值使用空格隔开
#   使用 b/g/n 前缀定义主机行为模式, 使用英文逗号与主机 IP 分隔
#   b: 绕过, 此前缀的主机IP 不使用 SS
#   g: 全局, 此前缀的主机IP 使用 全局代理 走 SS
#   n: 常规, 此前缀的主机IP 使用 SS配置工作模式 走 SS
#   1: 大陆白名单, 此前缀的主机IP 使用 大陆白名单模式 走 SS
#   2: gfwlist, 此前缀的主机IP 使用 gfwlist模式 走 SS
logger -t "【SS】" "设置内网(LAN)访问控制"
grep -v '^#' /etc/storage/shadowsocks_ss_spec_lan.sh | sort -u | grep -v "^$" | sed s/！/!/g > /tmp/ss_spec_lan.txt
while read line
do
for host in $line; do
	case "${host:0:1}" in
		n|N)
			ipset add ss_spec_src_ac ${host:2}
			;;
		b|B)
			ipset add ss_spec_src_bp ${host:2}
			;;
		g|G)
			ipset add ss_spec_src_fw ${host:2}
			;;
		1|1)
			ipset add ss_spec_src_chn ${host:2}
			;;
		2|2)
			ipset add ss_spec_src_gfw ${host:2}
			;;
	esac
done
done < /tmp/ss_spec_lan.txt

# 加载 nat 规则
echo "ss_multiport:$ss_multiport"
EXT_ARGS_TCP="$ss_multiport"
include_ac_rules nat
get_wifidognx
gen_prerouting_rules nat $wifidognx
dns_redirect
iptables -t nat -A SS_SPEC_WAN_KCPTUN -p tcp -j REDIRECT --to-port 1091
iptables -t nat -A SS_SPEC_WAN_FW -p tcp -j REDIRECT --to-port $ss_working_port
wifidognx=""
wifidogn=`iptables -t nat -L OUTPUT --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## Outgoing
if [ -z "$wifidogn" ] ; then
	wifidogn=`iptables -t nat -L OUTPUT --line-number | grep vserver | awk '{print $1}' | awk 'END{print $1}'`  ## vserver
	if [ -z "$wifidogn" ] ; then
		wifidognx=1
	else
		wifidognx=`expr $wifidogn + 1`
	fi
else
	wifidognx=`expr $wifidogn + 1`
fi
iptables -t nat -N SS_SPEC_WAN_DG
iptables -t nat -A SS_SPEC_WAN_DG -m set --match-set ss_spec_dst_sp dst -j RETURN
iptables -t nat -A SS_SPEC_WAN_DG -p tcp $EXT_ARGS_TCP -j SS_SPEC_WAN_AC
iptables -t nat -I OUTPUT $wifidognx -p tcp -j SS_SPEC_WAN_DG
# 加载 mangle 规则
echo "ss_upd_rules:$ss_upd_rules"
EXT_ARGS_UDP="$ss_upd_rules"
if [ "$ss_udp_enable" == 1 ] ; then
	ip rule add fwmark 1 lookup 100
	ip route add local default dev lo table 100
	include_ac_rules mangle
	get_wifidognx_mangle
	gen_prerouting_rules mangle $wifidognx
	[ "$ss_DNS_Redirect" != "1" ] && iptables -t mangle -A SS_SPEC_WAN_KCPTUN -p udp --dport 53  -m set ! --match-set ss_spec_dst_fw dst -j RETURN
	[ "$ss_DNS_Redirect" == "1" ] && iptables -t mangle -A SS_SPEC_WAN_KCPTUN -p udp --dport 53  -j RETURN
	iptables -t mangle -A SS_SPEC_WAN_KCPTUN -p udp -j TPROXY --on-port 1091 --tproxy-mark 0x01/0x01
	[ "$ss_DNS_Redirect" != "1" ] && iptables -t mangle -A SS_SPEC_WAN_FW -p udp --dport 53  -m set ! --match-set ss_spec_dst_fw dst -j RETURN
	[ "$ss_DNS_Redirect" == "1" ] && iptables -t mangle -A SS_SPEC_WAN_FW -p udp --dport 53  -j RETURN
	iptables -t mangle -A SS_SPEC_WAN_FW -p udp -j TPROXY --on-port $ss_working_port --tproxy-mark 0x01/0x01
fi
# 加载 pdnsd 规则
logger -t "【SS】" "pdnsd 模式:$ss_pdnsd_wo_redir, 0走代理 1直连"
echo "ss_pdnsd_wo_redir:$ss_pdnsd_wo_redir"
if [ "$ss_pdnsd_wo_redir" == 0 ] ; then
	# pdnsd 0走代理
	iptables -t nat -I OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j REDIRECT --to-port $ss_working_port
	iptables -t nat -I OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j REDIRECT --to-port $ss_working_port
else
	# pdnsd 1直连
	iptables -t nat -I OUTPUT -p tcp -d 8.8.8.8,8.8.4.4 --dport 53 -j RETURN
	iptables -t nat -I OUTPUT -p tcp -d 208.67.222.222,208.67.220.220 --dport 443 -j RETURN
fi


# 外网(WAN)访问控制
	logger -t "【SS】" "外网(WAN)访问控制，设置 WAN IP 转发或忽略代理中转"
	grep -v '^#' /etc/storage/shadowsocks_ss_spec_wan.sh | sort -u | grep -v "^$" | sed s/！/!/g > /tmp/ss_spec_wan.txt
	rm -f /tmp/ss/wantoss.list
	rm -f /tmp/ss/wannoss.list
	while read line
	do
	del_line=`echo $line |grep "WAN@"`
	if [ ! -z "$del_line" ] ; then
		del_line=`echo $del_line | sed s/WAN@//g` #WAN@开头的 域名 使用 代理中转
		/usr/bin/resolveip -4 -t 4 $del_line | grep -v :  > /tmp/ss/tmp.list
		[ ! -s /tmp/ss/tmp.list ] && nslookup $del_line | tail -n +3 | grep "Address" | awk '{print $3}'| grep -v ":"  >> /tmp/ss/wantoss.list
		[ -s /tmp/ss/tmp.list ] && cat /tmp/ss/tmp.list >> /tmp/ss/wantoss.list && echo "" > /tmp/ss/tmp.list
	fi
	add_line=`echo $line |grep "WAN!"`
	if [ ! -z "$add_line" ] ; then
		add_line=`echo $add_line | sed s/WAN!//g` #WAN!开头的 域名 忽略 代理中转
		/usr/bin/resolveip -4 -t 4 $add_line | grep -v :  > /tmp/ss/tmp.list
		[ ! -s /tmp/ss/tmp.list ] && nslookup $add_line | tail -n +3 | grep "Address" | awk '{print $3}'| grep -v ":"  >> /tmp/ss/wannoss.list
		[ -s /tmp/ss/tmp.list ] && cat /tmp/ss/tmp.list >> /tmp/ss/wannoss.list && echo "" > /tmp/ss/tmp.list
	fi
		net_line=`echo $line |grep "WAN+"`
	if [ ! -z "$net_line" ] ; then
		net_line=`echo $net_line | sed s/WAN+//g` #WAN+开头的 IP网段/掩码 使用 代理
		echo $net_line  >> /tmp/ss/wantoss.list
	fi
		net_line=`echo $line |grep "WAN-"`
	if [ ! -z "$net_line" ] ; then
		net_line=`echo $net_line | sed s/WAN-//g` #WAN-开头的 IP网段/掩码 忽略 代理
		echo $net_line  >> /tmp/ss/wannoss.list
	fi
	done < /tmp/ss_spec_wan.txt
	if [ -s "/tmp/ss/wannoss.list" ] ; then
		sed -e "s/^/-A ss_spec_dst_bp &/g" -e "1 i\-N ss_spec_dst_bp hash:net " /tmp/ss/wannoss.list | ipset -R -!
	fi
	if [ -s "/tmp/ss/wantoss.list" ] ; then
		sed -e "s/^/-A ss_spec_dst_fw &/g" -e "1 i\-N ss_spec_dst_fw hash:net " /tmp/ss/wantoss.list | ipset -R -!
	fi
	logger -t "【SS】" "完成 SS 转发规则设置"
	sleep 1
	gen_include &
}

dns_redirect() {
	# 强制使用路由的DNS
	lan_ipaddr=`nvram get lan_ipaddr`
	if [ "$ss_DNS_Redirect" == "1" ] && [ ! -z "$lan_ipaddr" ] ; then
	iptables-restore -n <<-EOF
*nat
:SS_SPEC_DNS_LAN_DG - [0:0]
:SS_SPEC_DNS_LAN_AC - [0:0]
:SS_SPEC_DNS_WAN_AC - [0:0]
:SS_SPEC_DNS_WAN_FW - [0:0]
-A SS_SPEC_DNS_LAN_DG -d $lan_ipaddr -p udp -j RETURN
-A SS_SPEC_DNS_LAN_DG -d $ss_DNS_Redirect_IP -p udp -j RETURN
-A SS_SPEC_DNS_LAN_DG -j SS_SPEC_DNS_LAN_AC
-A SS_SPEC_DNS_LAN_AC -m set --match-set ss_spec_src_bp src -j RETURN
-A SS_SPEC_DNS_LAN_AC -m set --match-set ss_spec_src_fw src -j SS_SPEC_DNS_WAN_FW
-A SS_SPEC_DNS_LAN_AC -m set --match-set ss_spec_src_ac src -j SS_SPEC_DNS_WAN_AC
-A SS_SPEC_DNS_LAN_AC -m set --match-set ss_spec_src_gfw src -j SS_SPEC_DNS_WAN_AC
-A SS_SPEC_DNS_LAN_AC -m set --match-set ss_spec_src_chn src -j SS_SPEC_DNS_WAN_AC
-A SS_SPEC_DNS_LAN_AC -j ${DNS_LAN_TARGET:=SS_SPEC_DNS_WAN_AC}
-A SS_SPEC_DNS_WAN_AC -j SS_SPEC_DNS_WAN_FW
COMMIT
EOF
		logger -t "【SS】" "udp53端口（DNS）地址重定向为 $ss_DNS_Redirect_IP 强制使用重定向地址的DNS"
		iptables -t nat -A PREROUTING -s $lan_ipaddr/24 -p udp --dport 53 -j SS_SPEC_DNS_LAN_DG
		iptables -t nat -A SS_SPEC_DNS_WAN_FW -j DNAT --to $ss_DNS_Redirect_IP
	fi

}

gen_special_purpose_ip() {
#处理肯定不走通道的目标网段
lan_ipaddr=`nvram get lan_ipaddr`
kcptun_enable=`nvram get kcptun_enable`
kcptun_enable=${kcptun_enable:-"0"}
kcptun_server=`nvram get kcptun_server`
if [ "$kcptun_enable" != "0" ] && [ -z "$kcptun_server" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $kcptun_server | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $kcptun_server | awk 'NR==5{print $3}'` 
kcptun_server=$resolveip
fi
[ "$kcptun_enable" = "0" ] && kcptun_server=""
if [ "$ss_enable" != "0" ] && [ -z "$ss_s1_ip" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server1 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server1 | awk 'NR==5{print $3}'` 
ss_s1_ip=$resolveip
fi
if [ ! -z "$ss_server2" ] ; then
resolveip=`/usr/bin/resolveip -4 -t 4 $ss_server2 | grep -v : | sed -n '1p'`
[ -z "$resolveip" ] && resolveip=`nslookup $ss_server2 | awk 'NR==5{print $3}'` 
ss_s2_ip=$resolveip
fi
	cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.25.61.0/24
192.31.196.0/24
192.52.193.0/24
192.88.99.0/24
192.168.0.0/16
192.175.48.0/24
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4
255.255.255.255
100.100.100.100
188.188.188.188
110.110.110.110
$ss_s1_ip
$ss_s2_ip
$kcptun_server
EOF
}
include_ac_rules() {
	iptables-restore -n <<-EOF
*$1
:SS_SPEC_LAN_DG - [0:0]
:SS_SPEC_LAN_AC - [0:0]
:SS_SPEC_WAN_AC - [0:0]
:SS_SPEC_WAN_FW - [0:0]
:SS_SPEC_WAN_GFW - [0:0]
:SS_SPEC_WAN_CHN - [0:0]
:SS_SPEC_WAN_CHNGFW - [0:0]
:SS_SPEC_WAN_KCPTUN - [0:0]
-A SS_SPEC_LAN_DG -m set --match-set ss_spec_dst_sp dst -j RETURN
-A SS_SPEC_LAN_DG -j SS_SPEC_LAN_AC
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_bp src -j RETURN
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_fw src -j SS_SPEC_WAN_FW
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_ac src -j SS_SPEC_WAN_AC
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_gfw src -j SS_SPEC_WAN_GFW
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_gfw src -j RETURN
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_chn src -j SS_SPEC_WAN_CHN
-A SS_SPEC_LAN_AC -m set --match-set ss_spec_src_chn src -j RETURN
-A SS_SPEC_LAN_AC -j ${LAN_TARGET:=SS_SPEC_WAN_AC}
-A SS_SPEC_WAN_AC -m set --match-set ss_spec_dst_fw dst -j SS_SPEC_WAN_FW
-A SS_SPEC_WAN_AC -m set --match-set ss_spec_dst_bp dst -j RETURN
-A SS_SPEC_WAN_AC -j ${MODE_TARGET:=RETURN}
-A SS_SPEC_WAN_CHN -m set --match-set ss_spec_dst_fw dst -j SS_SPEC_WAN_FW
-A SS_SPEC_WAN_CHN -m set --match-set ss_spec_dst_bp dst -j RETURN
-A SS_SPEC_WAN_CHN -m set --match-set ss_spec_dst_sh dst -j ${SH_TARGET:=RETURN}
-A SS_SPEC_WAN_CHN -j ${WAN_TARGET:=SS_SPEC_WAN_FW}
-A SS_SPEC_WAN_GFW -m set --match-set ss_spec_dst_fw dst -j SS_SPEC_WAN_FW
-A SS_SPEC_WAN_GFW -m set --match-set ss_spec_dst_bp dst -j RETURN
-A SS_SPEC_WAN_GFW -m set --match-set gfwlist dst -j ${GFWLIST_TARGET:=SS_SPEC_WAN_FW}
-A SS_SPEC_WAN_GFW -m set --match-set cflist dst -j ${GFWLIST_TARGET:=SS_SPEC_WAN_FW}
-A SS_SPEC_WAN_GFW -j RETURN
-A SS_SPEC_WAN_CHNGFW -j SS_SPEC_WAN_GFW
-A SS_SPEC_WAN_CHNGFW -j SS_SPEC_WAN_CHN
COMMIT
EOF
}

get_wifidognx() {
	wifidognx=""
	wifidogn=`iptables -t nat -L PREROUTING --line-number | grep AD_BYBY | awk '{print $1}' | awk 'END{print $1}'`  ## AD_BYBY
	if [ -z "$wifidogn" ] ; then
		wifidogn=`iptables -t nat -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## Outgoing
		if [ -z "$wifidogn" ] ; then
			wifidogn=`iptables -t nat -L PREROUTING --line-number | grep vserver | awk '{print $1}' | awk 'END{print $1}'`  ## vserver
			if [ -z "$wifidogn" ] ; then
				wifidognx=1
			else
				wifidognx=`expr $wifidogn + 1`
			fi
		else
			wifidognx=`expr $wifidogn + 1`
		fi
	else
		wifidognx=`expr $wifidogn + 1`
	fi
	wifidognx=$wifidognx
}

get_wifidognx_mangle() {
	wifidognx=""
	wifidogn=`iptables -t mangle -L PREROUTING --line-number | grep Outgoing | awk '{print $1}' | awk 'END{print $1}'`  ## Outgoing
		if [ -z "$wifidogn" ] ; then
			wifidogn=`iptables -t mangle -L PREROUTING --line-number | grep UP | awk '{print $1}' | awk 'END{print $1}'`  ## UP
			if [ -z "$wifidogn" ] ; then
				wifidognx=1
			else
				wifidognx=`expr $wifidogn + 1`
			fi
		else
			wifidognx=`expr $wifidogn + 1`
		fi
	wifidognx=$wifidognx
}

gen_prerouting_rules() {
	local protocol=$([ "$1" = "mangle" ] && echo udp $EXT_ARGS_UDP || echo tcp $EXT_ARGS_TCP )
	iptables -t $1 -I PREROUTING $2 -p $protocol -j SS_SPEC_LAN_DG
}

gen_include() {
[ -n "$FWI" ] || return 0
cat <<-CAT >>$FWI
iptables-restore -n <<-EOF
$(iptables-save | sed  "s/webstr--url/webstr --url/g" | grep -E "$TAG|^\*|^COMMIT" |sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/")
EOF
CAT
return $?
}

#获取所有被墙domain
#1 获取gfwlist 被墙列表
update_gfwlist()
{
echo "gfwlist updating"
if [ -f /tmp/cron_ss.lock ] ; then
	  logger -t "【SS】" "Other SS GFWList updating...."
else
	touch /tmp/cron_ss.lock
	mkdir -p /tmp/ss/dnsmasq.d
	logger -t "【SS】" "正在处理 gfwlist 列表，此时 SS 未能使用，请稍候...."
	sed -Ei '/conf-dir=/d' /etc/storage/dnsmasq/dnsmasq.conf
	[ ! -z "$confdir" ] && echo "conf-dir=$confdir" >> /etc/storage/dnsmasq/dnsmasq.conf
	sleep 1
	echo "从代理获取list"
	sed -Ei '/github|ipip.net/d' /etc/storage/dnsmasq/dnsmasq.conf
	cat >> "/etc/storage/dnsmasq/dnsmasq.conf" <<-\_CONF
ipset=/githubusercontent.com/gfwlist
server=/githubusercontent.com/127.0.0.1#8053
ipset=/github.io/gfwlist
#ipset=/ipip.net/gfwlist
server=/github.io/127.0.0.1#8053
_CONF
	restart_dhcpd ; sleep 1
	ss_updatess2=`nvram get ss_updatess2`
if [ "$ss_updatess" = "0" ] || [ "$ss_updatess2" = "1" ] ; then
	if [ "$ss_3p_enable" = "1" ] ; then
		if [ "$ss_3p_gfwlist" = "1" ] ; then
			logger -t "【SS】" "正在获取官方 gfwlist...."
			wgetcurl.sh /tmp/ss/gfwlist.b64 https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt
			base64 -d  /tmp/ss/gfwlist.b64 > /tmp/ss/gfwlist.txt
			cat /tmp/ss/gfwlist.txt | sort -u |
					sed '/^$\|@@/d'|
					sed 's#!.\+##; s#|##g; s#@##g; s#http:\/\/##; s#https:\/\/##;' | 
					sed '/\*/d; /apple\.com/d; /sina\.cn/d; /sina\.com\.cn/d; /baidu\.com/d; /qq\.com/d' |
					sed '/^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$/d' |
					grep '^[0-9a-zA-Z\.-]\+$' | grep '\.' | sed 's#^\.\+##'  | sort -u > /tmp/ss/gfwlist_domain.txt
		fi
		if [ "$ss_3p_kool" = "1" ] ; then
			#2 获取koolshare.github.io/maintain_files/gfwlist.conf
			logger -t "【SS】" "正在获取 koolshare 列表...."
			wgetcurl.sh /tmp/ss/gfwdomain_tmp.txt http://koolshare.github.io/maintain_files/gfwlist.conf
			cat /tmp/ss/gfwdomain_tmp.txt | sed 's/ipset=\/\.//g; s/\/gfwlist//g; /^server/d' > /tmp/ss/gfwdomain_1.txt
			wgetcurl.sh /tmp/ss/gfwdomain_tmp.txt https://raw.githubusercontent.com/koolshare/koolshare.github.io/master/maintain_files/gfwlist.conf
			cat /tmp/ss/gfwdomain_tmp.txt | sed 's/ipset=\/\.//g; s/\/gfwlist//g; /^server/d' > /tmp/ss/gfwdomain_2.txt
		fi
		rm -rf /tmp/ss/gfwdomain_tmp.txt
	fi
	#合并多个域名列表（自定义域名，GFWLIST，小宝的两个列表）
	logger -t "【SS】" "根据选项不同，分别会合并固件自带、gfwlist官方、koolshare以及自定义列表...."
	touch /etc/storage/shadowsocks_mydomain_script.sh
	cat /etc/storage/shadowsocks_mydomain_script.sh | sed '/^$\|#/d' | sed "s/http://g" | sed "s/https://g" | sed "s/\///g" | sort -u > /tmp/ss/gfwdomain_0.txt
	cat /etc/storage/basedomain.txt /tmp/ss/gfwdomain_0.txt /tmp/ss/gfwdomain_1.txt /tmp/ss/gfwdomain_2.txt /tmp/ss/gfwlist_domain.txt | 
		sort -u > /tmp/ss/gfwall_domain.txt
else
	logger -t "【SS】" "启动时使用 固件内置list规则 列表...."
	touch /etc/storage/shadowsocks_mydomain_script.sh
	cat /etc/storage/shadowsocks_mydomain_script.sh | sed '/^$\|#/d' | sed "s/http://g" | sed "s/https://g" | sed "s/\///g" | sort -u > /tmp/ss/gfwdomain_0.txt
	cat /etc/storage/basedomain.txt /tmp/ss/gfwdomain_0.txt | 
		sort -u > /tmp/ss/gfwall_domain.txt
fi

	#删除忽略的域名
	while read line
	do
	del_line=`echo $line |grep "WAN@"`
	if [ ! -z "$del_line" ] ; then
		del_line=`echo $del_line | sed s/WAN@//g` #WAN@开头的 域名 使用 代理中转
		echo "$del_line" >> /tmp/ss/gfwall_domain.txt
	fi
	add_line=`echo $line |grep "WAN!"`
	if [ ! -z "$add_line" ] ; then
		add_line=`echo $add_line | sed s/WAN!//g` #WAN!开头的 域名 忽略 代理中转
		sed -Ei "/$add_line/d" /tmp/ss/gfwall_domain.txt
	fi
	done < /tmp/ss_spec_wan.txt

	cat /tmp/ss/gfwall_domain.txt | sort -u | grep -v "^$" > /tmp/ss/all_domain.txt

	# 到此全域名列表都已经获取完毕，开始构造dnsmasq.conf
	rm -f /tmp/ss/gfw*.txt
	rm -f $confdir/r.gfwlist.conf


#killall -9 sh_adblock_hosts.sh
#/tmp/sh_adblock_hosts.sh $confdir &

	#用awk代替文件逐行读写，速度快3倍以上。
	awk '{printf("server=/%s/127.0.0.1#8053\nipset=/%s/gfwlist\n", $1, $1 )}' /tmp/ss/all_domain.txt > $confdir/r.gfwlist.conf

	#订阅处理
	#此处订阅有3种内容, 需要在UI里面增加订阅3个列表的选项，对应 ss_sub1,2,3三个值。
	#1. 海外加速，用于直连速度慢的网站  https://coding.net/u/bigandy/p/DogcomBooster/git/raw/master/list.txt
	#2. 域名解释加速，用于有亚洲CDN，但是DNS不能正确识别中国IP返回美国服务器IP的情况，通常用于XBOX Live 联网  https://coding.net/u/bigandy/p/DogcomBooster/git/raw/master/dnsonly.txt 
	#3. 需要忽略的域名处理，用于国内有CDN的节点 https://coding.net/u/bigandy/p/DogcomBooster/git/raw/master/passby.txt
	#处理订阅了加速列表的域名
if [ "$ss_3p_enable" = "1" ] ; then
	if [ "$ss_sub1" = "1" ] ; then
		logger -t "【SS】" "处理订阅列表1...."
		wgetcurl.sh /tmp/ss/tmp_sub.txt https://coding.net/u/bigandy/p/DogcomBooster/git/raw/master/list.txt
		cat /tmp/ss/tmp_sub.txt |
			sort -u | sed 's/^[[:space:]]*//g; /^$/d; /#/d' |
			awk '{printf("server=/%s/127.0.0.1#8053\nipset=/%s/gfwlist\n", $1, $1 )}'  > $confdir/r.sub.conf
	fi
	#处理只做dns解释的域名
	if [ "$ss_sub2" = "1" ] ; then
		logger -t "【SS】" "处理订阅列表2...."
		wgetcurl.sh /tmp/ss/tmp_sub.txt https://coding.net/u/bigandy/p/DogcomBooster/git/raw/master/dnsonly.txt
		cat /tmp/ss/tmp_sub.txt |
			sort -u | sed 's/^[[:space:]]*//g; /^$/d; /#/d' |
			awk '{printf("server=/%s/127.0.0.1#8053\n", $1 )}'  >> $confdir/r.sub.conf
	fi
	#处理需要排除的域名解释
	if [ "$ss_sub3" = "1" ] ; then
		logger -t "【SS】" "处理订阅列表3...."
		DNS=`nvram get wan0_dns |cut -d ' ' -f1`
		[ -z "$DNS" ] && DNS="114.114.114.114"
	awk_cmd="awk '{printf(\"server=/%s/$DNS\\n\", \$1 )}'  >> $confdir/r.sub.conf"
	#echo $awk_cmd
	wgetcurl.sh /tmp/ss/tmp_sub.txt https://coding.net/u/bigandy/p/DogcomBooster/git/raw/master/passby.txt
		cat /tmp/ss/tmp_sub.txt |
			sort -u | sed 's/^[[:space:]]*//g; /^$/d; /#/d' |
			eval $awk_cmd
			#awk '{printf("server=/%s/114.114.114.114\n", $1 )}'  >> $confdir/r.sub.conf
	fi
	rm -rf /tmp/ss/tmp_sub.txt
fi
	#订阅处理完成
	#删除ipset=，留下server=
	# if [ "$ss_mode_x" = "0" ] ; then
		# if [ "$kcptun2_enable" ! = "1" ] ; then
			# logger -t "【SS】" "模式一：DNSList update 重启 dnsmasq 更新列表"
			# cd $confdir
			# ls -R |awk '{print i$0}' i=`pwd`'/' | grep -v ':' > /tmp/tmp_dnsmasqd
			# while read line
			# do
				# logger -t "【SS】" "删除【ipset=】DNSList: $line"
				# sed -Ei '/ipset=/d' $line
			# done < /tmp/tmp_dnsmasqd
		# fi
		# gfwlist3=`nvram get gfwlist3`
		# Update="DNSlist"
	# else
		# gfwlist3=""
		# Update="Update: "$(date)"  GFWlist"
	# fi
	gfwlist3=`nvram get gfwlist3`
	Update="GFWlist"
	lines=`cat $confdir/* | wc -l`
	logger -t "【SS】" "GFWlist 规则 $lines 行  $gfwlist3"
	logger -t "【SS】" "所有规则处理完毕，SS即将开始工作"
	nvram set gfwlist3="$Update 规则 $lines 行  $gfwlist3"
	echo `nvram get gfwlist3`
	rm -f /tmp/cron_ss.lock
	# [ "$ss_mode_x" = "1" ] && adbyby_cflist
	# [ "$ss_mode_x" = "0" ] && [ "$kcptun2_enable" = "1" ] && adbyby_cflist
	adbyby_cflist
	logger -t "【SS】" "GFWList update 重启 dnsmasq 更新列表"
	ipset flush gfwlist
	restart_dhcpd ; sleep 1
fi

}


update_chnroutes()
{
echo "chnroutes updating"
if [ -f /tmp/cron_ss.lock ] ; then
	logger -t "【SS】" "Other SS chnroutes updating...."
else


#killall -9 sh_adblock_hosts.sh
#/tmp/sh_adblock_hosts.sh $confdir &
# if [ "$ss_mode_x" != "2" ] ; then
	touch /tmp/cron_ss.lock
	mkdir /tmp/ss -p
	ss_updatess2=`nvram get ss_updatess2`
if [ "$ss_updatess" = "0" ] || [ "$ss_updatess2" = "1" ] ; then
	# 启动时先用高春辉的这个列表，更新交给守护进程去做。
	# 完整apnic 列表更新指令，不需要去重，ipset -! 会自动去重。此指令暂时屏蔽，这个列表获取10~90秒不等，有时候甚至卡住不动。
	# wget --continue --no-check-certificate -q -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F\| '/CN\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' | sed -e "s/^/-A nogfwnet &/g" | ipset -R -!
	logger -t "【SS】" "下载 chnroutes"
	ip_list="ss_spec_dst_sh"
		echo ss_spec_dst_sh
		# wget --continue --no-check-certificate -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F\| '/CN\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /tmp/ss/chnroute.txt
		# echo ""  >> /tmp/ss/chnroute.txt
		wgetcurl.sh /tmp/ss/tmp_chnroute.txt https://raw.githubusercontent.com/17mon/china_ip_list/master/china_ip_list.txt
		cat /tmp/ss/tmp_chnroute.txt > /tmp/ss/chnroute.txt
		echo ""  >> /tmp/ss/chnroute.txt
		wgetcurl.sh /tmp/ss/tmp_chnroute.txt https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/chnroute.txt
		cat /tmp/ss/tmp_chnroute.txt >> /tmp/ss/chnroute.txt
		[ ! -s /tmp/ss/chnroute.txt ] && logger -t "【SS】" "使用 固件内置chnroutes规则 列表...." && cat /etc/storage/china_ip_list.txt > /tmp/ss/chnroute.txt
else
		logger -t "【SS】" "启动时使用 固件内置chnroutes规则 列表...."
		cat /etc/storage/china_ip_list.txt > /tmp/ss/chnroute.txt
fi
		rm -rf /tmp/ss/tmp_chnroute.txt
		ipset flush ss_spec_dst_sh
		grep -v '^#' /tmp/ss/chnroute.txt | sort -u | grep -v "^$" | sed -e "s/^/-A ss_spec_dst_sh &/g" | ipset -R -!
	
	nvram set gfwlist3="chnroutes规则`ipset list ss_spec_dst_sh -t | awk -F: '/Number/{print $2}'` 行 Update: $(date)"
	echo `nvram get gfwlist3`
# fi
	if [ "$ss_mode_x" = "2" ] || [ "$ss_pdnsd_all" = "1" ] ; then
		# 2 为全局,模式3全局代理。加速国内dns访问
		logger -t "【SS】" "加速国内 dns 访问，模式:$ss_mode_x, pdnsd_all:$ss_pdnsd_all, 下载 accelerated-domains.china.conf"
		DNS_china=`nvram get wan0_dns |cut -d ' ' -f1`
		[ -z "$DNS_china" ] && DNS_china="114.114.114.114"
		wgetcurl.sh /tmp/ss/tmp_accelerated-domains.china.conf https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/accelerated-domains.china.conf
		cat /tmp/ss/tmp_accelerated-domains.china.conf |
			sort -u | sed 's/^[[:space:]]*//g; /^$/d; /#/d' |
			sed -e "s|^\(server.*\)/[^/]*$|\1/$DNS_china|" > /tmp/ss/accelerated-domains.china.conf
		rm -rf /tmp/ss/tmp_accelerated-domains.china.conf
		sed -Ei '/accelerated-domains/d' /etc/storage/dnsmasq/dnsmasq.conf
		echo "conf-file=/tmp/ss/accelerated-domains.china.conf" >> "/etc/storage/dnsmasq/dnsmasq.conf"
	fi
	logger -t "【SS】" "chnroutes update 重启 dnsmasq 更新列表"
	restart_dhcpd ; sleep 1
	rm -f /tmp/cron_ss.lock

fi
}



#================华丽的分割线====================================



adbyby_cflist()
{
	logger -t dnsmasq "restart adbyby_cflist"
	ipsets=`nvram get adbyby_mode_x`
if [ "$ipsets" == 1 ] ; then
	if [ -s "/tmp/7620adm/adm" ] ; then
		port=$(iptables -t nat -L | grep 'ports 18309' | wc -l)
		PIDS=$(ps | grep "/tmp/7620adm/adm" | grep -v "grep" | wc -l)
		if [ "$port" -ge 1 ] || [ "$PIDS" != 0 ] ; then
			/tmp/sh_adm18309.sh D &
			sleep 1
			killall -15 adm
			killall -9 adm
			/tmp/7620adm/adm >/dev/null 2>&1 &
			sleep 10
			/tmp/sh_adm18309.sh A &
		fi
	fi
	if [ -s "/tmp/7620koolproxy/koolproxy" ] ; then
		port=$(iptables -t nat -L | grep 'ports 3000' | wc -l)
		PIDS=$(ps | grep "/tmp/7620koolproxy/koolproxy" | grep -v "grep" | wc -l)
		if [ "$port" -ge 1 ] || [ "$PIDS" != 0 ] ; then
			/tmp/sh_koolproxy3000.sh D &
			sleep 1
			killall -15 koolproxy
			killall -9 koolproxy
			/tmp/7620koolproxy/koolproxy >/dev/null 2>&1 &
			sleep 10
			/tmp/sh_koolproxy3000.sh A &
		fi
	fi
	if [ -s "/tmp/bin/adbyby" ] ; then
		sed -Ei '/ipset=/d' /tmp/bin/adhook.ini
		echo ipset=1 >> /tmp/bin/adhook.ini
		sed -Ei '/sh_adb8118.sh|restart_dhcpd/d' /tmp/bin/adbybyfirst.sh /tmp/bin/adbybyupdate.sh
		echo /tmp/sh_adb8118.sh C $confdir "/r.gfwlist.conf" "gfwlist" >> /tmp/bin/adbybyfirst.sh
		echo /tmp/sh_adb8118.sh C $confdir "/r.gfwlist.conf" "gfwlist" >> /tmp/bin/adbybyupdate.sh
		port=$(iptables -t nat -L | grep 'ports 8118' | wc -l)
		PIDS=$(ps | grep "/tmp/bin/adbyby" | grep -v "grep" | grep -v "adbybyupdate.sh" | grep -v "adbybyfirst.sh" | wc -l)
		if [ "$port" -ge 1 ] || [ "$PIDS" != 0 ] ; then
			/tmp/sh_adb8118.sh D &
			sleep 1
			killall -15 adbyby
			killall -9 adbyby
			/tmp/bin/adbyby >/dev/null 2>&1 &
			sleep 10
			/tmp/sh_adb8118.sh A &
		fi
	else
		sed -Ei '/ipset=/d' /tmp/bin/adhook.ini
		echo ipset=0 >> /tmp/bin/adhook.ini
		sed -Ei '/sh_adb8118.sh|restart_dhcpd/d' /tmp/bin/adbybyfirst.sh /tmp/bin/adbybyupdate.sh
	fi
fi
}

dnsmasq_reconf()
{
	#防火墙转发规则加载
	# for dnsmasq 
	sed -Ei '/no-resolv|server=|server=127.0.0.1|server=208.67.222.222|dns-forward-max=1000|min-cache-ttl=1800|github/d' /etc/storage/dnsmasq/dnsmasq.conf
if [ "$ss_mode_x" = "2" ] || [ "$ss_pdnsd_all" = "1" ] ; then 
#   #方案三
	cat >> "/etc/storage/dnsmasq/dnsmasq.conf" <<-\EOF
no-resolv
server=127.0.0.1#8053
dns-forward-max=1000
min-cache-ttl=1800
EOF
fi
#启动PDNSD防止域名污染
start_pdnsd
sed -Ei '/github/d' /etc/storage/dnsmasq/dnsmasq.conf
cat >> "/etc/storage/dnsmasq/dnsmasq.conf" <<-\_CONF
server=/githubusercontent.com/127.0.0.1#8053
server=/github.io/127.0.0.1#8053
_CONF
restart_dhcpd ; sleep 1
}


start_SS()
{
	restart_dhcpd
	logger -t "【SS】" "启动 SS"
	stop_SS
	nvram set ss_internet="2"
	optssredir="0"
if [ "$ss_mode_x" != "3" ] ; then
	hash ss-redir 2>/dev/null || optssredir="1"
else
	hash ss-local 2>/dev/null || optssredir="1"
fi
if [ "$optssredir" = "1" ] ; then
	# 找不到ss-redir，安装opt
	if [ ! -d "/opt/bin" ] ; then
	upanPath=""
	ss_opt_x=`nvram get ss_opt_x`
	[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
	[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
	if [ ! -z $upanPath ] ; then
		mkdir -p /media/$upanPath/opt
		mount -o bind /media/$upanPath/opt /opt
		ln -sf /media/$upanPath /tmp/AiDisk_00
	else
		mkdir -p /tmp/AiDisk_00/opt
		mount -o bind /tmp/AiDisk_00/opt /opt
	fi
	mkdir -p /opt/bin
	fi
	optssredir="0"
	if [ "$ss_mode_x" != "3" ] ; then
		hash ss-redir 2>/dev/null || optssredir="1"
	else
		hash ss-local 2>/dev/null || optssredir="1"
	fi
	if [ "$optssredir" = "1" ] ; then
		if [ "$ss_mode_x" != "3" ] ; then
			optssredir="0"
			hash ss-redir 2>/dev/null || optssredir="1"
			if [ "$optssredir" = "1" ] ; then
				logger -t "【SS】" "找不到 ss-redir. opt下载程序"
				/tmp/sh_download.sh "/opt/bin/ss-redir" "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/ss-redir"
				chmod 777 "/opt/bin/ss-redir"
			fi
			hash ss-redir 2>/dev/null || { logger -t "【SS】" "找不到 ss-redir, 请检查系统"; nvram set ss_enable=0 && nvram set ss_status=0 && nvram commit; exit 1; }
		else
			optssredir="0"
			hash ss-local 2>/dev/null || optssredir="1"
			if [ "$optssredir" = "1" ] ; then
				logger -t "【SS】" "找不到 ss-local. opt 下载程序"
				/tmp/sh_download.sh "/opt/bin/ss-local" "https://code.aliyun.com/hiboyhiboy/padavan-opt/raw/master/ss-local"
				chmod 777 "/opt/bin/ss-local"
			fi
			hash ss-local 2>/dev/null || { logger -t "【SS】" "找不到 ss-local, 请检查系统"; nvram set ss_enable=0 && nvram set ss_status=0 && nvram commit; exit 1; }
		fi
	fi
fi
check_ssr
echo "Debug: $DNS_Server"
	rm -f /tmp/cron_ss.lock
	logger -t "【SS】" "###############启动程序###############"
	if [ "$ss_mode_x" = "3" ] ; then
		start_ss_redir
	logger -t "【ss-local】" "启动. 可以配合 Proxifier、chrome(switchysharp、SwitchyOmega) 代理插件使用."
	logger -t "【SS】" "shadowsocks 进程守护启动"
	/tmp/sh_ssmon.sh &
	exit 0
	fi
	dnsmasq_reconf
	start_ss_redir
	start_ss_rules
	sleep5
	# [ "$ss_mode_x" != "1" ] && update_chnroutes
	# [ "$ss_mode_x" != "2" ] && [ "$ss_pdnsd_all" != "1" ] && update_gfwlist
	nvram set ss_updatess2=0
	update_chnroutes
	update_gfwlist
	nvram set ss_updatess2=1
	#检查网络
	logger -t "【SS】" "SS 检查网络连接"
	sleep 1
	resolveip=`/usr/bin/resolveip -4 -t 4 "www.163.com" | grep -v : | sed -n '1p'`
	[ -z "$resolveip" ] && resolveip=`nslookup www.163.com | tail -n +3 | grep "Address" | awk '{print $3}'| grep -v ":" | tail -n 1`
if [ -z "$resolveip" ] ; then 
	logger -t "【SS】" "连 www.163.com 的域名都解析不了, 你的网络能用？？"
	#nvram set ss_enable=0
	nvram set ss_status=00
	#nvram commit
	logger -t "【SS】" "SS 网络连接有问题, 请更新 opt 文件夹、检查 U盘 文件和 SS 设置"
	stop_SS
	/etc/storage/crontabs_script.sh &
	clean_SS
fi
	/etc/storage/ez_buttons_script.sh 3 &
	logger -t "【SS】" "SS 启动成功"
	logger -t "【SS】" "启动后若发现一些网站打不开, 估计是 DNS 被污染了. 解决 DNS 被污染方法："
	logger -t "【SS】" "①路由 SS 设置选择其他 DNS 服务模式；"
	logger -t "【SS】" "②电脑设置 DNS 自动获取路由 ip。检查 hosts 是否有错误规则。"
	logger -t "【SS】" "③电脑运行 cmd 输入【ipconfig /flushdns】, 清理浏览器缓存。"
	logger -t "【SS】" "shadowsocks 进程守护启动"
	nvram set ss_internet="1"
	/tmp/sh_ssmon.sh &
}



clean_SS()
{
/etc/storage/ez_buttons_script.sh cleanss &
exit 0
}


stop_SS()
{
ss-rules -f
	nvram set ss_internet="0"
	nvram set ss_working_port="1090" #恢复主服务器端口
	ss_working_port=`nvram get ss_working_port`
	sed -Ei '/no-resolv|server=|dns-forward-max=1000|min-cache-ttl=1800|accelerated-domains|github|ipip.net/d' /etc/storage/dnsmasq/dnsmasq.conf
	restart_dhcpd
	clean_ss_rules
	eval $(ps  | grep "/tmp/sh_ssmon.sh" | grep -v grep | awk '{print "kill "$1}')
	killall -9 sh_ssmon.sh &
	[ -n "`pidof ss-redir`" ] &&  killall ss-redir 2>/dev/null
	[ -n "`pidof ss-tunnel`" ] &&  killall ss-tunnel 2>/dev/null
	[ -n "`pidof ss-local`" ] &&  killall ss-local 2>/dev/null
	[ -n "`pidof pdnsd`" ] &&  killall pdnsd 2>/dev/null
	[ -n "`pidof ss-redir`" ] &&  killall -9 ss-redir 2>/dev/null
	[ -n "`pidof ss-tunnel`" ] &&  killall -9 ss-tunnel 2>/dev/null
	[ -n "`pidof ss-local`" ] &&  killall -9 ss-local 2>/dev/null
	[ -n "`pidof pdnsd`" ] &&  killall -9 pdnsd 2>/dev/null
	rm -f /var/log/ss-tunnel.lock
	rm -f $confdir/r.gfwlist.conf
	rm -f $confdir/r.sub.conf
	rm -f $confdir/r.adhost.conf
	rm -f $confdir/accelerated-domains.china.conf
	[ -f /opt/etc/init.d/S24chinadns ] && { rm -f /var/log/chinadns.lock; /opt/etc/init.d/S24chinadns stop& }
	[ -f /opt/etc/init.d/S26pdnsd ] && { rm -f /var/log/pdnsd.lock; /opt/etc/init.d/S26pdnsd stop& }
	[ -f /opt/etc/init.d/S27pcap-dnsproxy ] && { rm -f /var/log/pcap-dnsproxy.lock; /opt/etc/init.d/S27pcap-dnsproxy stop& }
	logger -t "【SS】" "ss-redir stop."
	nvram set gfwlist3="ss-redir stop."
	sleep 1
	/etc/storage/ez_buttons_script.sh 3 &
umount /usr/sbin/ss-redir
umount /usr/sbin/ss-local

}

check_setting()
{
A_restart=`nvram get ss_status`
B_restart="$ss_enable$lan_ipaddr$ss_updatess$ss_DNS_Redirect$ss_DNS_Redirect_IP$ss_DNS_Redirect$ss_type$ss_check$ss_run_ss_local$ss_s1_local_address$ss_s2_local_address$ss_s1_local_port$ss_s2_local_port$ss_server1$ss_server2$ss_s1_port$ss_s2_port$ss_s1_method$ss_s2_method$ss_s1_key$ss_s2_key$ss_pdnsd_wo_redir$ss_mode_x$ss_multiport$ss_sub4$ss_sub1$ss_sub2$ss_sub3$ss_upd_rules$ss_plugin_config$ss2_plugin_config$ss_usage$ss_s2_usage$ss_usage_json$ss_s2_usage_json$ss_tochina_enable$ss_udp_enable$LAN_AC_IP$ss_3p_enable$ss_3p_gfwlist$ss_3p_kool$ss_pdnsd_all$kcptun_server$ss_xbox`nvram get wan0_dns |cut -d ' ' -f1`$(cat /etc/storage/shadowsocks_ss_spec_lan.sh /etc/storage/shadowsocks_ss_spec_wan.sh /etc/storage/shadowsocks_config_script.sh /etc/storage/shadowsocks_mydomain_script.sh | grep -v '^#' | grep -v "^$")"
B_restart=`echo -n "$B_restart" | md5sum | sed s/[[:space:]]//g | sed s/-//g`
if [ "$A_restart" != "$B_restart" ] ; then
	nvram set ss_status=$B_restart
	needed_restart=1
	/etc/storage/ez_buttons_script.sh ping &
else
	needed_restart=0
fi
if [ "$needed_restart" = "0" ] ; then
	if [ -n "`pidof ss-redir`" ] && [ "$ss_enable" = "1" ] && [ "$ss_mode_x" != "3" ] ; then
		port=$(iptables -t nat -L | grep 'SS_SPEC' | wc -l)
		if [ "$port" = 0 ] ; then
			logger -t "【SS】" "检测:找不到 SS_SPEC 转发规则, 重新添加"
			/tmp/ss.sh rules &
		fi
	fi
	exit 0
fi
	[ ${ss_enable:=0} ] && [ "$ss_enable" -eq "0" ] && [ "$needed_restart" = "1" ] && { stop_SS; eval $(ps  | grep "/tmp/ss.sh" | grep -v grep | awk '{print "kill "$1}'); exit 0; }
	# Check if have ss-redir and ss-tunnel
if [ "$ss_mode_x" != "3" ] ; then
	hash ss-redir 2>/dev/null || {  logger -t "【SS】" "找不到, 需要安装 ss-redir"; }
	hash pdnsd 2>/dev/null || { logger -t "【SS】" "找不到, 需要安装 pdnsd"; }
fi
	# Check the ss config from nvram

	[ $ss_server1 ] || logger -t "【SS】" "服务器地址:未填写"
	[ $ss_s1_port ] || logger -t "【SS】" "服务器端口:未填写"
	[ $ss_s1_method ] || logger -t "【SS】" "加密方式:未填写"
	[ $ss_server1 ] && [ $ss_s1_port ] && [ $ss_s1_method ] \
	 ||  { logger -t "【SS】" "SS配置有错误，请到扩展功能检查SS配置页面"; stop_SS; exit 1; }
}

##############################
### ready go
##############################



case "$1" in
start)
		check_setting
		start_SS
		;;
rules)
		start_ss_rules
		;;
flush)
		clean_ss_rules
		;;
update)
		#check_setting
		[ ${ss_enable:=0} ] && [ "$ss_enable" -eq "0" ] && exit 0
		# [ "$ss_mode_x" = "3" ] && exit 0
		#随机延时
		if [ -z "$RANDOM" ] ; then
		SEED=`tr -cd 0-9 </dev/urandom | head -c 8`
		else
		SEED=$RANDOM
		fi
		RND_NUM=`echo $SEED 1 120|awk '{srand($1);printf "%d",rand()*10000%($3-$2)+$2}'`
		# echo $RND_NUM
		logger -t "【SS】" "$RND_NUM 秒后进入处理状态, 请稍候"
		sleep $RND_NUM
		# start_ss_rules
		# [ "$ss_mode_x" != "1" ] && update_chnroutes
		# [ "$ss_mode_x" != "2" ] && [ "$ss_pdnsd_all" != "1" ] && update_gfwlist
		nvram set ss_updatess2=1
		update_chnroutes
		update_gfwlist
		;;
		
updatess)
		logger -t "【SS】" "手动更新 SS 规则文件 5 秒后进入处理状态, 请稍候"
		sleep 5
		nvram set ss_updatess2=1
		update_chnroutes
		update_gfwlist
		;;
stop)
		stop_SS
		;;
repdnsd)
		start_pdnsd
		;;
help)
		echo "Usage: $0 {start|rules|flush|update|stop}"
		;;
*)
		check_setting
		start_SS
		exit 0
		;;
esac





FOF
chmod 777 "/tmp/ss.sh"

cat > "/tmp/sh_adblock_hosts.sh" <<-\EOFH
#!/bin/sh
sleep 20
confdir=$1
ss_sub4=`nvram get ss_sub4`
mkdir /tmp/ss -p
	# adblock hosts广告过滤规则
	#处理最基础的广告域名替换为127.0.0.1 感谢 phrnet 的原帖：http://www.right.com.cn/forum/thread-184121-1-4.html
if [ "$ss_sub4" = "1" ] ; then
	wgetcurl.sh /tmp/ss/tmp_adhost.txt http://c.nnjsx.cn/GL/dnsmasq/update/adblock/malwaredomainlist.txt
	cat /tmp/ss/tmp_adhost.txt | sed 's/127.0.0.1  //g' | dos2unix > /tmp/ss/adhost.txt
	wgetcurl.sh /tmp/ss/tmp_adhost.txt http://c.nnjsx.cn/GL/dnsmasq/update/adblock/yhosts.txt
	cat /tmp/ss/tmp_adhost.txt | sed 's/127.0.0.1 //g' | dos2unix >> /tmp/ss/adhost.txt
	wgetcurl.sh /tmp/ss/tmp_adhost.txt http://c.nnjsx.cn/GL/dnsmasq/update/adblock/easylistchina.txt
	cat /tmp/ss/tmp_adhost.txt | sed 's/address=\///g; s/\/127.0.0.1//g' | dos2unix >> /tmp/ss/adhost.txt
	cat /tmp/ss/adhost.txt | sort -u | sed '/^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$/d; s/^/address=\//; s/$/\/127.0.0.1/' > $confdir/r.adhost.conf
	rm -rf /tmp/ss/tmp_adhost.txt
	sed -Ei '/conf-dir=/d' /etc/storage/dnsmasq/dnsmasq.conf
	[ ! -z "$confdir" ] && echo "conf-dir=$confdir" >> /etc/storage/dnsmasq/dnsmasq.conf
else
	rm -f $confdir/r.adhost.conf
fi
	logger -t "【Adblock hosts】" "规则： `sed -n '$=' $confdir/r.adhost.conf | sed s/[[:space:]]//g ` 行"
	nvram set adhosts="ad hosts规则： `sed -n '$=' $confdir/r.adhost.conf | sed s/[[:space:]]//g ` 行"
restart_dhcpd
EOFH
chmod 755 "/tmp/sh_adblock_hosts.sh"

. /etc/storage/script0_script.sh
ln -sf "/etc/storage/PhMain.ini" "/etc/PhMain.ini"
ln -sf "/etc/storage/init.status" "/etc/init.status"
rm -f "/opt/etc/init.d/S96sh3.sh"
echo "" > /var/log/shadowsocks_watchdog.log
echo "" > /var/log/Pcap_DNSProxy_watchdog.log
echo "" > /var/log/chinadns_watchdog.log
nvram set dnspod_status=000
nvram set cloudxns_status=000
nvram set aliddns_status=000
nvram set adbyby_status=000
nvram set adm_status=000
nvram set ss_status=000
nvram set FastDicks_status=000
nvram set youku_status=000
nvram set ngrok_status=000
nvram set frp_status=000
nvram set serverchan_status=000
nvram set kcptun_status=000
nvram set tinyproxy_status=000
nvram set vpnproxy_status=000
nvram set shellinabox_status=000
nvram set theme_status=000
nvram set mproxy_status=000
nvram set lnmp_status=000
nvram set mentohust_status=000
nvram set ssserver_status=000
nvram set ssrserver_status=000
nvram set wifidog_status=000
nvram set display_status=000
nvram set softether_status=000
nvram set cow_status=000
nvram set meow_status=000
upopt=`nvram get upopt_enable`
http_username=`nvram get http_username`
export PATH='/opt/usr/sbin:/opt/usr/bin:/opt/sbin:/opt/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin'
export LD_LIBRARY_PATH=/lib:/opt/lib
sed -Ei '/taobao.org/d' /etc/storage/dnsmasq/dnsmasq.servers
echo 'server=/taobao.org/223.5.5.5' >> /etc/storage/dnsmasq/dnsmasq.servers
sed -Ei '/adbyby_host.conf|cflist.conf|AiDisk_00|server=|accelerated-domains|tmp|github/d' /etc/storage/dnsmasq/dnsmasq.conf
rm -f /tmp/ss/dnsmasq.d/*
killall crond
restart_dhcpd ; sleep 1
nvram set ss_internet="0"
/etc/storage/inet_state_script.sh 12 t
/tmp/sh_mento_hust.sh &
baidu='http://gb.corp.163.com/gb/images/spacer.gif'
/tmp/sh_download.sh /tmp/small_blank.gif $baidu
rb=1
while [ ! -s /tmp/small_blank.gif ];
do
logger -t "【自定义脚本】" "等待联网后开始脚本"
/tmp/sh_download.sh /tmp/small_blank.gif $baidu
rb=`expr $rb + 1`
if [ "$rb" -gt 3 ] ; then
	logger -t "【自定义脚本】" "等待联网超时"
	echo "等待联网超时" > /tmp/small_blank.gif
fi
done
/tmp/sh_theme.sh &
rm -f /tmp/small_blank.gif
if [[ $(cat /tmp/apauto.lock) == 1 ]] ; then
	killall sh_apauto.sh
	/tmp/sh_apauto.sh &
fi
adbybys=`nvram get adbyby_enable`
ipsets=`nvram get adbyby_mode_x`
CPUAverages=`nvram get adbyby_CPUAverages`
ssproxys=`nvram get ss_enable`
gfwlists=`nvram get ss_mode_x`
syncys=`nvram get syncys`
xunleis=`nvram get xunleis`
FastDick_enable=`nvram get FastDick_enable`
FastDicks=`nvram get FastDicks`
uid=`nvram get FastDick_uid`
pwd=`nvram get FastDick_pwd`
phddns=`nvram get phddns`
youku_enable=`nvram get youku_enable`
upanPath=""
ss_opt_x=`nvram get ss_opt_x`
[ -z "$ss_opt_x" ] || [ "$ss_opt_x" = "0" ] && nvram set ss_opt_x=1
[ "$ss_opt_x" = "3" ] || [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}'| grep AiCard | sed -n '1p'`
[ -z $upanPath ] && [ "$ss_opt_x" = "1" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
[ "$ss_opt_x" = "4" ] && upanPath=`ls -l /media/ | awk '/^d/ {print $NF}' | grep -v AiCard | sed -n '1p'`
installs=1
[ -z $upanPath ] && installs=2
optinstall=`nvram get optinstall`
optw_enable=`nvram get optw_enable`
if [ "$optw_enable" != "2" ] && [ "$installs" = "1" ] && [ "$optinstall" = "1" ] ; then
	nvram set optw_enable=2
	nvram commit
fi
if [ "$optw_enable" != "0" ] && [ "$installs" = "2" ] && [ "$optinstall" = "1" ] ; then
	nvram set optw_enable=0
	nvram commit
fi
mountpoint -q /opt && installs=1 && logger -t "【opt】" "U盘 已经挂载，自动转换 U盘 安装"
shadowsockssh="/tmp/AiDisk_00/shadowsocks/shadowsocks"
if [ "$FastDick_enable" = "1" ] && [ "$FastDicks" = "1" ] ; then
installs=1
optinstall=1
fi

if [ "$syncys" = "1" ] ; then
installs=1
optinstall=1
fi
. /tmp/sh_upopt.sh
if [ "$optinstall" = "1" ] && [ "$installs" = "1" ] ; then
	logger -t "【opt】" "opt U盘 安装，模式:$installs"
	[ ! -z $upanPath ] && /tmp/sh_installs.sh $ssfile 1
	if [ ! -f "/opt/opti.txt" ] ; then
		logger -t "【opt】" "U盘 安装失败, 请插入 U盘，按要求设置"
		logger -t "【opt】" "U盘 安装失败, 自动转换内存安装"
		[ "$installs" = "1" ] && installs=2
		[ "$FastDicks" = "1" ] && FastDicks=2
	fi
fi
if [ "$optinstall" = "1" ] && [ "$installs" = "2" ] ; then
	logger -t "【opt】" "opt 内存安装, 模式:$installs, 没有百度云"
	/tmp/sh_installs.sh $ssfile2 2
	syncys=0
	if [ ! -f "/opt/opti.txt" ] ; then
		logger -t "【opt】" "内存安装失败"
	fi
fi
rm -f /tmp/cron_adb.lock
#/tmp/sh_func_load_adbyby.sh
echo "2017-2-25" > /etc/storage/scripti.txt
[ -f /tmp/scripti.txt ] && { nvram set scriptt=`cat /tmp/scripti.txt`; scriptx1=$(cat /tmp/scripti.txt); }
[ -f /etc/storage/scripti.txt ] && { nvram set scripto=`cat /etc/storage/scripti.txt`; scriptx2=$(cat /etc/storage/scripti.txt); }
[ -f /opt/lnmpi.txt ] && nvram set lnmpt=`cat /tmp/lnmpi.txt`
[ -f /opt/lnmp.txt ] && nvram set lnmpo=`cat /opt/lnmp.txt`
[ ! -f /etc/storage/PhMain.ini ] && touch /etc/storage/PhMain.ini
[ ! -f /etc/storage/init.status ] && touch /etc/storage/init.status
restart_firewall &
sleep 10
touch /tmp/webui_yes
nvram set ssserver_status=0000
nvram set ssrserver_status=0000
/etc/storage/crontabs_script.sh &
rm -f /tmp/script.lock
logger -t "【自定义脚本】" "脚本完成"