gsd
/
zapret
mirror of https://github.com/bol-van/zapret/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

sysv init calls : start-fw,stop-fw

pull/33/head
bolvan 6 years ago
parent
3b61dbc20f
commit
087c374959
5 changed files with 66 additions and 42 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 4
      docs/readme.txt
  2. 24
      init.d/openwrt/functions
  3. 8
      init.d/openwrt/zapret
  4. 47
      init.d/sysv/functions
  5. 25
      init.d/sysv/zapret

4
docs/readme.txt
View File

@ -338,6 +338,10 @@ zapret_stop_daemons
Посмотрите init скрипт /opt/zapret/init.d/sysv/zapret и все поймете сами.
Есть вариант вызывать готовый скрипт по каким-то событиям :
/opt/zapret/init.d/sysv/zapret start-fw
/opt/zapret/init.d/sysv/zapret stop-fw
Пример установки на debian-подобную систему
-------------------------------------------

24
init.d/openwrt/functions
View File

@ -78,7 +78,9 @@ dnat6_target()
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
[ -n "$DNAT6_TARGET" ] || {
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ "$DNAT6_TARGET" = '-' ] || {
# no reason to query if its down
network_is_up lan || return
@ -95,9 +97,13 @@ dnat6_target()
sleep 1
do :; done
[ -z "$DNAT6_TARGET" ] && {
echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
[ -n "$DNAT6_TARGET" ] || {
echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
[ -n "$DNAT6_TARGET" ] || {
echo could not get any address
DNAT6_TARGET=-
}
}
}
}
@ -161,8 +167,10 @@ __fw_tpws6()
done
network_get_device DEVICE lan
dnat6_target
ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
[ "$DNAT6_TARGET" != '-' ] && {
ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
}
}
fw_tpws6()
{
@ -177,6 +185,6 @@ fw_tpws_https6()
create_ipset()
{
echo "Creating ipset"
"$IPSET_CR" $1
echo "Creating ipset"
"$IPSET_CR" $1
}

8
init.d/openwrt/zapret
View File

@ -48,8 +48,8 @@ run_daemon()
run_tpws()
{
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" = "1" ] || {
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
network_get_device DEVICE lan
[ -n "$DEVICE" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$DEVICE $2"
@ -57,8 +57,8 @@ run_tpws()
}
stop_tpws()
{
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" = "1" ] || {
stop_daemon $((60+$1)) $TPWS
stop_daemon $((660+$1)) $TPWS
}

47
init.d/sysv/functions
View File

@ -103,8 +103,9 @@ dnat6_target()
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
[ -n "$DNAT6_TARGET" ] || {
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ "$DNAT6_TARGET" = '-' ] || {
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN)
@ -115,9 +116,13 @@ dnat6_target()
sleep 1
do :; done
[ -z "$DNAT6_TARGET" ] && {
[ -n "$DNAT6_TARGET" ] || {
echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN)
[ -n "$DNAT6_TARGET" ] || {
echo could not get any address
DNAT6_TARGET=-
}
}
}
}
@ -127,18 +132,18 @@ fw_tpws_add()
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
# $3 - tpws port
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for tpws : $1"
[ -n "$IFACE_LAN" ] && {
ipt PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
ipt OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for tpws : $2"
[ -n "$IFACE_LAN" ] && {
dnat6_target
ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
[ "$DNAT6_TARGET" != '-' ] && ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
}
ipt6 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
}
@ -148,18 +153,18 @@ fw_tpws_del()
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
# $3 - tpws port
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for tpws : $1"
[ -n "$IFACE_LAN" ] && {
ipt_del PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
ipt_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for tpws : $2"
[ -n "$IFACE_LAN" ] && {
dnat6_target
ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
[ "$DNAT6_TARGET" != '-' ] && ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
}
ipt6_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
}
@ -169,11 +174,11 @@ fw_nfqws_add_pre()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for nfqws prerouting : $1"
ipt PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for nfqws prerouting : $2"
ipt6 PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@ -182,11 +187,11 @@ fw_nfqws_del_pre()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for nfqws prerouting : $1"
ipt_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for nfqws prerouting : $2"
ipt6_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@ -195,11 +200,11 @@ fw_nfqws_add_post()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for nfqws postrouting : $1"
ipt POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for nfqws postrouting : $2"
ipt6 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@ -208,11 +213,11 @@ fw_nfqws_del_post()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for nfqws postrouting : $1"
ipt_del POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for nfqws postrouting : $2"
ipt6_del POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@ -280,16 +285,16 @@ prepare_tpws()
run_tpws()
{
prepare_tpws
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" = "1" ] || {
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
[ -n "$IFACE_LAN" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$IFACE_LAN $2"
}
}
stop_tpws()
{
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" = "1" ] || {
stop_daemon $((60+$1)) $TPWS
[ -n "$IFACE_LAN" ] && stop_daemon $((660+$1)) $TPWS
}

25
init.d/sysv/zapret
View File

@ -14,19 +14,26 @@ NAME=zapret
DESC=anti-zapret
case "$1" in
start)
zapret_run_daemons
[ "$INIT_APPLY_FW" = "1" ] && zapret_apply_firewall
;;
start)
zapret_run_daemons
[ "$INIT_APPLY_FW" != "1" ] || zapret_apply_firewall
;;
stop)
zapret_stop_daemons
[ "$INIT_APPLY_FW" = "1" ] && zapret_unapply_firewall
;;
stop)
zapret_stop_daemons
[ "$INIT_APPLY_FW" != "1" ] || zapret_unapply_firewall
;;
start-fw)
zapret_apply_firewall
;;
stop-fw)
zapret_unapply_firewall
;;
*)
N=/etc/init.d/$NAME
echo "Usage: $N {start|stop}" >&2
echo "Usage: $N {start|stop|start-fw|stop-fw}" >&2
exit 1
;;
esac

Write Preview
Loading…
Cancel
Save