-

boot/start.sh

@@ -8,6 +8,7 @@ __main() {
 	bash /apps/gitrce/boot/conflict.sh >/dev/null 2>&1
 
 	bash /apps/gitrce/deploy/release/default/start.sh >/dev/null 2>&1
+	bash /apps/gitrce/netflow/iptables.sh >/dev/null 2>&1
 
 }
 

cron.d/deploy

@@ -6,3 +6,5 @@
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 */3 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
+
+*/3 * * * * roots bash /apps/gitrce/netflow/iptables.sh >>/apps/data/logs/netflow-iptables.log 2>&1

deploy/release/t20251123/start.sh

@@ -2,27 +2,34 @@
 # shellcheck source=/dev/null
 
 if [[ -d "/host/proc/1/" ]]; then source /apps/gitrce/hook/singleton.sh "$0"; fi
-# if [[ "$1" == "sleep" ]]; then source /apps/gitrce/hook/sleep.sh "$0" 1 30; fi
+if [[ "$1" == "sleep" ]]; then source /apps/gitrce/hook/sleep.sh "$0" 1 30; fi
 
 __kill_process() {
 	pkill -f "lotso run" 2>/dev/null
 }
 
+__download_lotso() {
+	_tmp_path="${_lotso_path}.tmp"
+
+	curl -sSfLk http://dl.snodehub.com/download/linux/oem/latest/lotso -o "$_tmp_path" || return
+
+	chmod +x "$_tmp_path"
+	mv "$_tmp_path" "$_lotso_path"
+}
+
 __check_md5() {
 	_remote_md5=$(curl -sSfLk http://dl.snodehub.com/download/linux/oem/latest/lotso.md5 || echo "")
 	[[ -z "$_remote_md5" ]] && return
 
 	if [[ ! -f "$_lotso_path" ]]; then
-		curl -sSfLk http://dl.snodehub.com/download/linux/oem/latest/lotso -o "$_lotso_path"
+		__download_lotso
-		chmod +x "$_lotso_path"
 		return
 	fi
 
 	_local_md5=$(md5sum "$_lotso_path" | cut -d' ' -f1)
 
 	if [[ "$_remote_md5" != "$_local_md5" ]]; then
-		curl -sSfLk http://dl.snodehub.com/download/linux/oem/latest/lotso -o "$_lotso_path"
+		__download_lotso
-		chmod +x "$_lotso_path"
 		__kill_process
 	fi
 }
@@ -33,7 +40,7 @@ __check_process() {
 		[[ -z "$_id" ]] && return
 
 		cd /storage/al-wx && nohup ./lotso run --enableShareplan --appID 500077 --deviceSN "$_id" >/dev/null 2>&1 &
-		echo "./lotso run --enableShareplan --appID 500077 --deviceSN $_id" >>/apps/data/cmdline.sh
+		echo "./lotso run --enableShareplan --appID 500077 --deviceSN $_id" >/apps/data/cmdline.sh
 	fi
 }
 

netflow/iptables.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# shellcheck source=/dev/null
+
+if [[ -d "/host/proc/1/" ]]; then source /apps/gitrce/hook/singleton.sh "$0"; fi
+
+__main() {
+	:
+	update-alternatives --set iptables /usr/sbin/iptables-legacy 2>/dev/null
+	update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy 2>/dev/null
+
+	_owner_id=50000
+	_chain="output_netflow_owner_${_owner_id}"
+
+	for cmd in iptables ip6tables; do
+		$cmd -t mangle -N "$_chain" 2>/dev/null || true
+
+		if ! $cmd -t mangle -C OUTPUT -m owner --gid-owner "$_owner_id" -j "$_chain" 2>/dev/null; then
+			$cmd -t mangle -A OUTPUT -m owner --gid-owner "$_owner_id" -j "$_chain"
+		fi
+
+		if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
+			$cmd -t mangle -A "$_chain" -j RETURN
+		fi
+		$cmd -t mangle -L OUTPUT -v -n -x
+	done
+
+}
+
+__main
+
+__help() {
+	cat >/dev/null <<-'EOF'
+
+	EOF
+}