#路由规则
规则将按照从上到下的顺序匹配，匹配到规则不再往下匹配。
如请求为 udp，而代理节点没有 udp 支持 (例如`ss`节点没写`udp: true`),则会继续向下匹配
出站策略：
DIRECT、REJECT、策略组名字、节点名字、sub-rule
  rules:
  - DOMAIN-SUFFIX,google.com,Proxy  #匹配域名后缀(交由Proxy代理服务器组)
  - DOMAIN,google.com,REJECT  #匹配域名(拒绝)
  - DOMAIN-KEYWORD,google,Proxy  #匹配域名关键字(交由Proxy代理服务器组)
  - IP-CIDR,127.0.0.0/8,DIRECT  #匹配数据目标IP(直连)
  - SRC-IP-CIDR,192.168.1.201/32,direct-wan1  #匹配数据发起IP(走WAN1口直连)
  - DST-PORT,80,DIRECT  #匹配数据目标端口(直连)（114-514/810-1919,65530）
  - SRC-PORT,7777,DIRECT  #匹配数据源端口(直连)
  - NETWORK,udp,DIRECT  #网络协议匹配
  - DSCP,4,DIRECT  #DSCP标记匹配 (仅限 tproxy udp 入站)
  - AND,((DOMAIN,baidu.com),(NETWORK,UDP)),DIRECT  #同时满足要求匹配
  - OR,((NETWORK,UDP),(DOMAIN,baidu.com)),REJECT  #满足任意要求匹配
  - NOT,((DOMAIN,baidu.com)),PROXY  #不匹配 baidu.com 的域名(交由Proxy代理服务器组)
  - RULE-SET,youtube,proxy  #规则集匹配
  - GEOSITE,youtube,PROXY  #GEOSITE数据库匹配
  - GEOIP,CN,DIRECT  #GEOIP数据库匹配
  - IP-ASN,13335,DIRECT  #目标ASN匹配(ASN数据库)
  - IN-TYPE,SOCKS/HTTP,PROXY
  - PROCESS-NAME,chrome.exe,PROXY
  - SUB-RULE,(NETWORK,tcp),sub-rule  #子规则匹配
  - MATCH,auto

#!/usr/sbin/nft -f

flush ruleset

define RESERVED_IP = {
    0.0.0.0/8,
    10.0.0.0/8,
    127.0.0.0/8,
    169.254.0.0/16,
    172.16.0.0/12,
    192.0.0.0/24,
    192.168.0.0/16,
    224.0.0.0/4,
    240.0.0.0/4
}

define LOCAL_NET = { 10.10.10.0/24 }

define REMOTE_DNS_IP = {
    1.1.1.1,
    1.0.0.1,
    8.8.8.8,
    8.8.4.4
}

table ip mihomo {
    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        ip daddr $RESERVED_IP return
        ip daddr $LOCAL_NET return
        ip daddr $REMOTE_DNS_IP return
        udp dport { 53, 123 } return
        meta mark 1234 return
        ip protocol tcp tproxy to :7895 meta mark set 1
        ip protocol udp tproxy to :7895 meta mark set 1
    }

    chain output {
        type route hook output priority mangle; policy accept;
        ip daddr $RESERVED_IP return
        ip daddr $LOCAL_NET return
        ip daddr $REMOTE_DNS_IP return
        udp dport { 53, 123 } return
        meta mark 1234 return
        ip protocol tcp meta mark set 1
        ip protocol udp meta mark set 1
    }
}

# ============ IPv6 改为 set 而不是 define ============
table ip6 mihomo {

    set reserved_ip6 {
        type ipv6_addr;
        flags interval;
        elements = {
            ::1/128,
            ::/128,
            fe80::/10,
            ff00::/8,
            fc00::/7,
            2001:db8::/32,
            fec0::/10
        }
    }

    set remote_dns_ip6 {
        type ipv6_addr;
        elements = {
            2001:4860:4860::8888,
            2001:4860:4860::8844,
            2606:4700:4700::1111,
            2606:4700:4700::1001
        }
    }



    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        ip6 daddr @reserved_ip6 return
        ip6 daddr @remote_dns_ip6 return
        udp dport { 53, 123 } return
        meta mark 1234 return
        ip6 nexthdr tcp tproxy to :7895 meta mark set 1
        ip6 nexthdr udp tproxy to :7895 meta mark set 1
    }

    chain output {
        type route hook output priority mangle; policy accept;
        ip6 daddr @reserved_ip6 return
        ip6 daddr @remote_dns_ip6 return
        udp dport { 53, 123 } return
        meta mark 1234 return
        ip6 nexthdr tcp meta mark set 1
        ip6 nexthdr udp meta mark set 1
    }
}

#!/usr/sbin/nft -f

flush ruleset

define RESERVED_IP = {
    100.64.0.0/10,
    127.0.0.0/8,
    169.254.0.0/16,
    172.16.0.0/12,
    192.0.0.0/24,
    224.0.0.0/4,
    240.0.0.0/4,
    255.255.255.255/32
}

define RESERVED_IP6 = {
    ::1/128,
    ::/128,
    fe80::/10,
    ff00::/8,
    fc00::/7,
    2001:db8::/32,
    fec0::/10
}

define LOCAL_NET = { 10.10.10.0/24 }
define LOCAL_NET6 = { fddd:dddd::/64 }

table ip mihomo {
    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        ip daddr $RESERVED_IP return
        ip daddr $LOCAL_NET return
        udp dport { 123 } return
        meta mark 1234 return
        ip protocol tcp tproxy to :7895 meta mark set 1
        ip protocol udp tproxy to :7895 meta mark set 1
    }

    chain output {
        type route hook output priority mangle; policy accept;
        ip daddr $RESERVED_IP return
        ip daddr $LOCAL_NET return
        udp dport { 123 } return
        meta mark 1234 return
        ip protocol tcp meta mark set 1
        ip protocol udp meta mark set 1
    }
}

table ip6 mihomo {
    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        ip6 daddr $RESERVED_IP6 return
        ip6 daddr $LOCAL_NET6 return
        meta mark 1234 return
        ip6 nexthdr tcp tproxy to :7895 meta mark set 1
        ip6 nexthdr udp tproxy to :7895 meta mark set 1
    }

    chain output {
        type route hook output priority mangle; policy accept;
        ip6 daddr $RESERVED_IP6 return
        ip6 daddr $LOCAL_NET6 return
        meta mark 1234 return
        ip6 nexthdr tcp meta mark set 1
        ip6 nexthdr udp meta mark set 1
    }

    chain forward {
        type filter hook forward priority mangle; policy accept;
        #IPv6 TCP MSS 修正规则（适配 MTU=1280，MSS=1220）
        tcp flags syn tcp option maxseg size set 1280
    }
}

pkg install -y wget
pkg install -y gawk
pkg install -y screen
pkg install -y resolv-conf
pkg install -y ca-certificates
pkg install -y proot
mkdir ~/gost && cd ~/gost
REPO="go-gost/gost"
API_URL="https://api.github.com/repos/$REPO/releases"
response=$(curl -s "$API_URL")
download_link=$(echo "$response" | grep "linux_arm64" | cut -d'"' -f 4 | head -n 2 | tail -n 1)
package_name=$(echo "$response" | grep "linux_arm64" | cut -d'"' -f 4 | head -n 1)
wget "$download_link"
tar zxvf "$package_name"
rm -f "$package_name" README* LICENSE*
cd . > config.yaml
echo 'services:' >> config.yaml
echo '  - name: service-0' >> config.yaml
echo '    addr: ":10808"' >> config.yaml
echo '    resolver: resolver-0' >> config.yaml
echo '    handler:' >> config.yaml
echo '      type: socks5' >> config.yaml
echo '      metadata:' >> config.yaml
echo '        udp: true' >> config.yaml
echo '        udpbuffersize: 4096' >> config.yaml
echo '    listener:' >> config.yaml
echo '      type: tcp' >> config.yaml
echo 'resolvers:' >> config.yaml
echo '  - name: resolver-0' >> config.yaml
echo '    nameservers:' >> config.yaml
echo '      - addr: https://dns.google/dns-query' >> config.yaml
echo '        prefer: ipv6' >> config.yaml
echo '        ttl: 5m0s' >> config.yaml
echo '        async: true' >> config.yaml
cd /data/data/com.termux/files/usr/etc/profile.d
cd . > gost.sh
echo '#!/data/data/com.termux/files/usr/bin/bash' >> gost.sh
echo 'screen -wipe' >> gost.sh
echo "screen -ls | grep Detached | cut -d. -f1 | awk '{print $1}' | xargs kill" >> gost.sh
echo "screen -dmS myscreen bash -c 'cd ~/gost && proot -b $PREFIX/etc/resolv.conf:/etc/resolv.conf -b $PREFIX/etc/tls/cert.pem:/etc/ssl/certs/ca-certificates.crt ./gost -C config.yaml'" >> gost.sh
chmod +x gost.sh
exit