fix(keenetic): use RAW table

Author: maksimkurb

docs/content/docs/cli.md

@@ -17,6 +17,7 @@ Options:
   --config <path>    Path to JSON config file
   --log-level <lvl>  Log level: error, warn, info, verbose, debug
   --no-api           Disable REST API at runtime
+  --use-raw-prerouting  Use raw PREROUTING for IPv4 forwarded traffic (iptables only)
   --version          Show version and exit
   --help             Show this help and exit
 
@@ -38,9 +39,31 @@ The config file is usually `/etc/keen-pbr/config.json` on OpenWrt and Debian, an
 | `--config <path>` | Path to the JSON config file. |
 | `--log-level <lvl>` | Log verbosity: `error`, `warn`, `info`, `verbose`, or `debug`. |
 | `--no-api` | Disable the REST API even if enabled in config. |
+| `--use-raw-prerouting` | Opt in to raw-table IPv4 forwarded-traffic classification; available only with iptables. |
 | `--version` | Print version and exit. |
 | `--help` | Print help and exit. |
 
+### `--use-raw-prerouting`
+
+This disabled-by-default option is intended for systems such as KeeneticOS where
+an external firewall manager periodically replaces the `mangle` table. It moves
+only IPv4 forwarded-traffic classification from `mangle PREROUTING` to `raw
+PREROUTING`; locally generated traffic remains in `mangle OUTPUT`, and IPv6
+continues using its existing mangle path.
+
+The Keenetic service loads the matching `iptable_raw.ko` only when the flag is
+present in `KEEN_PBR_ARGS` in `/opt/etc/keen-pbr/defaults`. Startup fails instead
+of silently falling back if raw is unusable. Raw PREROUTING deliberately does not
+use connmark acceleration: each forwarded packet is classified directly.
+
+Troubleshoot the required capability with:
+
+```sh
+ls -l "/lib/modules/$(uname -r)/iptable_raw.ko"
+grep -x raw /proc/net/ip_tables_names
+iptables -t raw -S
+```
+
 ## Commands
 
 | Command | Description |

packages/keenetic/keen-pbr/files/opt/etc/init.d/S80keen-pbr

@@ -5,7 +5,7 @@
 ENABLED=yes
 PROCS=$(basename "$KEEN_PBR")
 PIDFILE="/opt/var/run/keen-pbr.pid"
-ARGS="--config $CONFIG --pid-file $PIDFILE service"
+ARGS="--config $CONFIG --pid-file $PIDFILE ${KEEN_PBR_ARGS:-} service"
 PREARGS=""
 POSTCMD=""
 DESC="keen-pbr"
@@ -139,6 +139,32 @@ check_runtime_dependencies() {
     ensure_xt_multiport_loaded
 }
 
+has_daemon_arg() {
+    for arg in $ARGS; do
+        [ "$arg" = "$1" ] && return 0
+    done
+    return 1
+}
+
+ensure_raw_table_available() {
+    local raw_module
+
+    grep -qx raw /proc/net/ip_tables_names 2>/dev/null && return 0
+    raw_module="/lib/modules/$(uname -r)/iptable_raw.ko"
+    if [ ! -f "$raw_module" ]; then
+        log_error "--use-raw-prerouting was requested, but $raw_module is unavailable"
+        return 1
+    fi
+    if ! insmod "$raw_module" 2>/dev/null && ! grep -qx raw /proc/net/ip_tables_names 2>/dev/null; then
+        log_error "--use-raw-prerouting was requested, but failed to load $raw_module"
+        return 1
+    fi
+    if ! grep -qx raw /proc/net/ip_tables_names 2>/dev/null || ! iptables -t raw -S >/dev/null 2>&1; then
+        log_error "--use-raw-prerouting was requested, but raw table probe failed after loading $raw_module"
+        return 1
+    fi
+}
+
 enable_hwnat() {
     log "Enabling HW NAT..."
     sysctl -w net.ipv4.netfilter.ip_conntrack_fastnat=1 2>/dev/null || true
@@ -187,6 +213,9 @@ pidof() {
 
 prepare_start() {
     check_runtime_dependencies
+    if has_daemon_arg --use-raw-prerouting; then
+        ensure_raw_table_available || return 1
+    fi
     disable_hwnat
 }
 

packages/keenetic/keen-pbr/files/opt/etc/keen-pbr/defaults

@@ -1,3 +1,5 @@
 KEEN_PBR="/opt/usr/bin/keen-pbr"
 CONFIG="/opt/etc/keen-pbr/config.json"
 DNSMASQ_HELPER="/opt/usr/lib/keen-pbr/dnsmasq.sh"
+# Extra daemon arguments, for example: --use-raw-prerouting
+KEEN_PBR_ARGS=""

packages/keenetic/keen-pbr/files/opt/etc/ndm/netfilter.d/50-keen-pbr-routing.sh

@@ -1,6 +1,7 @@
 #!/opt/bin/sh
 
-[ "$table" != "mangle" -a "$table" != "nat" ] && exit 0
+[ "$type" = "iptables" ] || exit 0
+[ "$table" = "mangle" ] || exit 0
 
 logger -t "keen-pbr" "Refreshing routing state after netfilter change"
 /opt/etc/init.d/S80keen-pbr reapply-firewall >/dev/null 2>&1 || exit 0