mirror of https://github.com/bol-van/zapret/
allkatran
4 months ago
committed by
GitHub
GitHub
44 changed files with 825 additions and 568 deletions
@ -0,0 +1,55 @@ |
|||||
|
standard_mode_tpws_socks() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
local opt |
||||
|
[ "$TPWS_SOCKS_ENABLE" = 1 ] && { |
||||
|
opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT" |
||||
|
filter_apply_hostlist_target opt |
||||
|
do_tpws_socks $1 2 "$opt" |
||||
|
} |
||||
|
} |
||||
|
standard_mode_tpws() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
local opt |
||||
|
[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && { |
||||
|
opt="--port=$TPPORT $TPWS_OPT" |
||||
|
filter_apply_hostlist_target opt |
||||
|
do_tpws $1 1 "$opt" |
||||
|
} |
||||
|
} |
||||
|
standard_mode_nfqws() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
local opt |
||||
|
[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$NFQWS_OPT" && { |
||||
|
opt="--qnum=$QNUM $NFQWS_OPT" |
||||
|
filter_apply_hostlist_target opt |
||||
|
do_nfqws $1 3 "$opt" |
||||
|
} |
||||
|
} |
||||
|
standard_mode_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
standard_mode_tpws_socks $1 |
||||
|
standard_mode_tpws $1 |
||||
|
standard_mode_nfqws $1 |
||||
|
} |
||||
|
zapret_do_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
standard_mode_daemons $1 |
||||
|
custom_runner zapret_custom_daemons $1 |
||||
|
|
||||
|
return 0 |
||||
|
} |
||||
|
zapret_run_daemons() |
||||
|
{ |
||||
|
zapret_do_daemons 1 "$@" |
||||
|
} |
||||
|
zapret_stop_daemons() |
||||
|
{ |
||||
|
zapret_do_daemons 0 "$@" |
||||
|
} |
||||
@ -0,0 +1,66 @@ |
|||||
|
# this custom script runs standard mode with extra firewall rules |
||||
|
|
||||
|
# config: use TPWS_ENABLE_OVERRIDE, NFQWS_ENABLE_OVERRIDE to enable standard mode daemons |
||||
|
# standard and override switches cannot be enabled simultaneously ! |
||||
|
|
||||
|
TPWS_ENABLE_OVERRIDE=${TPWS_ENABLE_OVERRIDE:-0} |
||||
|
NFQWS_ENABLE_OVERRIDE=${NFQWS_ENABLE_OVERRIDE:-0} |
||||
|
|
||||
|
# config: some if these values must be set in config. not setting any of these makes this script meaningless. |
||||
|
# pre vars put ipt/nft code to the rule beginning |
||||
|
#FW_EXTRA_PRE_TPWS_IPT= |
||||
|
#FW_EXTRA_PRE_TPWS_NFT= |
||||
|
#FW_EXTRA_PRE_NFQWS_IPT="-m mark --mark 0x10000000/0x10000000" |
||||
|
#FW_EXTRA_PRE_NFQWS_NFT="mark and 0x10000000 != 0" |
||||
|
# post vars put ipt/nft code to the rule end |
||||
|
#FW_EXTRA_POST_TPWS_IPT= |
||||
|
#FW_EXTRA_POST_TPWS_NFT= |
||||
|
#FW_EXTRA_POST_NFQWS_IPT= |
||||
|
#FW_EXTRA_POST_NFQWS_NFT= |
||||
|
|
||||
|
check_std_intersect() |
||||
|
{ |
||||
|
[ "$TPWS_ENABLE_OVERRIDE" = 1 -a "$TPWS_ENABLE" = 1 ] && { |
||||
|
echo "ERROR ! both TPWS_ENABLE_OVERRIDE and TPWS_ENABLE are enabled" |
||||
|
return 1 |
||||
|
} |
||||
|
[ "$NFQWS_ENABLE_OVERRIDE" = 1 -a "$NFQWS_ENABLE" = 1 ] && { |
||||
|
echo "ERROR ! both NFQWS_ENABLE_OVERRIDE and NFQWS_ENABLE are enabled" |
||||
|
return 1 |
||||
|
} |
||||
|
return 0 |
||||
|
} |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - add, 0 - stop |
||||
|
|
||||
|
check_std_intersect || return |
||||
|
|
||||
|
local TPWS_SOCKS_ENABLE=0 TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE |
||||
|
standard_mode_daemons "$1" |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
check_std_intersect || return |
||||
|
|
||||
|
local FW_EXTRA_PRE FW_EXTRA_POST TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE |
||||
|
FW_EXTRA_PRE="$FW_EXTRA_PRE_TPWS_IPT" FW_EXTRA_POST="$FW_EXTRA_POST_TPWS_IPT" |
||||
|
zapret_do_firewall_standard_tpws_rules_ipt $1 |
||||
|
FW_EXTRA_PRE="$FW_EXTRA_PRE_NFQWS_IPT" FW_EXTRA_POST="$FW_EXTRA_POST_NFQWS_IPT" |
||||
|
zapret_do_firewall_standard_nfqws_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
check_std_intersect || return |
||||
|
|
||||
|
local FW_EXTRA_PRE FW_EXTRA_POST TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE |
||||
|
FW_EXTRA_PRE="$FW_EXTRA_PRE_TPWS_NFT" FW_EXTRA_POST="$FW_EXTRA_POST_TPWS_NFT" |
||||
|
zapret_apply_firewall_standard_tpws_rules_nft |
||||
|
FW_EXTRA_PRE="$FW_EXTRA_PRE_NFQWS_NFT" FW_EXTRA_POST="$FW_EXTRA_POST_NFQWS_NFT" |
||||
|
zapret_apply_firewall_standard_nfqws_rules_nft |
||||
|
} |
||||
@ -0,0 +1,89 @@ |
|||||
|
# this custom script demonstrates how to launch extra tpws instance limited by ipset |
||||
|
|
||||
|
# can override in config : |
||||
|
TPWS_MY1_OPT="${TPWS_MY1_OPT:---oob --split-pos=midsld}" |
||||
|
TPWS_MY1_PORTS=${TPWS_MY1_PORTS:-$TPWS_PORTS} |
||||
|
TPWS_MY1_SUBNETS4="${TPWS_MY1_SUBNETS4:-142.250.0.0/15 64.233.160.0/19 172.217.0.0/16 173.194.0.0/16 108.177.0.0/17 74.125.0.0/16 209.85.128.0/17 216.58.192.0/19}" |
||||
|
TPWS_MY1_SUBNETS6="${TPWS_MY1_SUBNETS6:-2607:F8B0::/32 2a00:1450:4000::/37}" |
||||
|
|
||||
|
TPWS_MY1_IPSET_SIZE=${TPWS_MY1_IPSET_SIZE:-4096} |
||||
|
TPWS_MY1_IPSET_OPT="${TPWS_MY1_IPSET_OPT:-hash:net hashsize 8192 maxelem $TPWS_MY1_IPSET_SIZE}" |
||||
|
|
||||
|
alloc_dnum DNUM_TPWS_MY1 |
||||
|
alloc_tpws_port PORT_TPWS_MY1 |
||||
|
TPWS_MY1_NAME4=my1tpws4 |
||||
|
TPWS_MY1_NAME6=my1tpws6 |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
local opt="--port=$PORT_TPWS_MY1 $TPWS_MY1_OPT" |
||||
|
do_tpws $1 $DNUM_TPWS_MY1 "$opt" |
||||
|
} |
||||
|
|
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
local f4 f6 subnet |
||||
|
local PORTS_IPT=$(replace_char - : $TPWS_MY1_PORTS) |
||||
|
local dest_set="-m set --match-set $TPWS_MY1_NAME4 dst" |
||||
|
|
||||
|
[ "$1" = 1 -a "$DISABLE_IPV4" != 1 ] && { |
||||
|
ipset create $TPWS_MY1_NAME4 $TPWS_MY1_IPSET_OPT family inet 2>/dev/null |
||||
|
ipset flush $TPWS_MY1_NAME4 |
||||
|
for subnet in $TPWS_MY1_SUBNETS4; do |
||||
|
echo add $TPWS_MY1_NAME4 $subnet |
||||
|
done | ipset -! restore |
||||
|
} |
||||
|
[ "$1" = 1 -a "$DISABLE_IPV6" != 1 ] && { |
||||
|
ipset create $TPWS_MY1_NAME6 $TPWS_MY1_IPSET_OPT family inet6 2>/dev/null |
||||
|
ipset flush $TPWS_MY1_NAME6 |
||||
|
for subnet in $TPWS_MY1_SUBNETS6; do |
||||
|
echo add $TPWS_MY1_NAME6 $subnet |
||||
|
done | ipset -! restore |
||||
|
} |
||||
|
|
||||
|
f4="-p tcp -m multiport --dports $PORTS_IPT -m set --match-set" |
||||
|
f6="$f4 $TPWS_MY1_NAME6 dst" |
||||
|
f4="$f4 $TPWS_MY1_NAME4 dst" |
||||
|
fw_tpws $1 "$f4" "$f6" $PORT_TPWS_MY1 |
||||
|
|
||||
|
[ "$1" = 1 ] || { |
||||
|
ipset destroy $TPWS_MY1_NAME4 2>/dev/null |
||||
|
ipset destroy $TPWS_MY1_NAME6 2>/dev/null |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
local f4 f6 subnet |
||||
|
|
||||
|
[ "$DISABLE_IPV4" != 1 ] && { |
||||
|
make_comma_list subnets $TPWS_MY1_SUBNETS4 |
||||
|
nft_create_set $TPWS_MY1_NAME4 "type ipv4_addr; size $TPWS_MY1_IPSET_SIZE; auto-merge; flags interval;" |
||||
|
nft_flush_set $TPWS_MY1_NAME4 |
||||
|
nft_add_set_element $TPWS_MY1_NAME4 "$subnets" |
||||
|
} |
||||
|
[ "$DISABLE_IPV6" != 1 ] && { |
||||
|
make_comma_list subnets $TPWS_MY1_SUBNETS6 |
||||
|
nft_create_set $TPWS_MY1_NAME6 "type ipv6_addr; size $TPWS_MY1_IPSET_SIZE; auto-merge; flags interval;" |
||||
|
nft_flush_set $TPWS_MY1_NAME6 |
||||
|
nft_add_set_element $TPWS_MY1_NAME6 "$subnets" |
||||
|
} |
||||
|
|
||||
|
f4="tcp dport {$TPWS_MY1_PORTS}" |
||||
|
f6="$f4 ip6 daddr @$TPWS_MY1_NAME6" |
||||
|
f4="$f4 ip daddr @$TPWS_MY1_NAME4" |
||||
|
nft_fw_tpws "$f4" "$f6" $PORT_TPWS_MY1 |
||||
|
} |
||||
|
|
||||
|
zapret_custom_firewall_nft_flush() |
||||
|
{ |
||||
|
# this function is called after all nft fw rules are deleted |
||||
|
# however sets are not deleted. it's desired to clear sets here. |
||||
|
|
||||
|
nft_del_set $TPWS_MY1_NAME4 2>/dev/null |
||||
|
nft_del_set $TPWS_MY1_NAME6 2>/dev/null |
||||
|
} |
||||
@ -0,0 +1,30 @@ |
|||||
|
# this custom script runs desync to all wireguard handshake initiation packets |
||||
|
|
||||
|
# can override in config : |
||||
|
NFQWS_OPT_DESYNC_WG="${NFQWS_OPT_DESYNC_WG:---dpi-desync=fake}" |
||||
|
|
||||
|
alloc_dnum DNUM_WG4ALL |
||||
|
alloc_qnum QNUM_WG4ALL |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - add, 0 - stop |
||||
|
|
||||
|
local opt="--qnum=$QNUM_WG4ALL $NFQWS_OPT_DESYNC_WG" |
||||
|
do_nfqws $1 $DNUM_WG4ALL "$opt" |
||||
|
} |
||||
|
# size = 156 (8 udp header + 148 payload) && payload starts with 0x01000000 |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
local f='-p udp -m u32 --u32' |
||||
|
fw_nfqws_post $1 "$f 0>>22&0x3C@4>>16=0x9c&&0>>22&0x3C@8=0x01000000" "$f 44>>16=0x9c&&48=0x01000000" $QNUM_WG4ALL |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
local f="udp length 156 @th,64,32 0x01000000" |
||||
|
nft_fw_nfqws_post "$f" "$f" $QNUM_WG4ALL |
||||
|
} |
||||
@ -1,38 +0,0 @@ |
|||||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
|
||||
|
|
||||
# can override in config : |
|
||||
NFQWS_OPT_DESYNC_DHT="${NFQWS_OPT_DESYNC_DHT:---dpi-desync=tamper}" |
|
||||
|
|
||||
alloc_dnum DNUM_DHT4ALL |
|
||||
alloc_qnum QNUM_DHT4ALL |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# stop logic is managed by procd |
|
||||
|
|
||||
local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|
||||
run_daemon $DNUM_DHT4ALL $NFQWS "$opt" |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local f uf4 uf6 |
|
||||
local first_packet_only="$ipt_connbytes 1:1" |
|
||||
|
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32' |
|
||||
uf4='0>>22&0x3C@8>>16=0x6431' |
|
||||
uf6='48>>16=0x6431' |
|
||||
fw_nfqws_post $1 "$f $uf4 $first_packet_only" "$f $uf6 $first_packet_only" $QNUM_DHT4ALL |
|
||||
|
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local f |
|
||||
local first_packet_only="$nft_connbytes 1" |
|
||||
|
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
|
||||
nft_fw_nfqws_post "$f $first_packet_only" "$f $first_packet_only" $QNUM_DHT4ALL |
|
||||
} |
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
@ -0,0 +1,111 @@ |
|||||
|
#ifdef __linux__ |
||||
|
|
||||
|
#include <linux/types.h> |
||||
|
|
||||
|
#ifndef TCP_USER_TIMEOUT |
||||
|
#define TCP_USER_TIMEOUT 18 |
||||
|
#endif |
||||
|
|
||||
|
#ifndef IP6T_SO_ORIGINAL_DST |
||||
|
#define IP6T_SO_ORIGINAL_DST 80 |
||||
|
#endif |
||||
|
|
||||
|
#ifndef PR_SET_NO_NEW_PRIVS |
||||
|
#define PR_SET_NO_NEW_PRIVS 38 |
||||
|
#endif |
||||
|
|
||||
|
// workaround for old headers
|
||||
|
|
||||
|
struct tcp_info_new { |
||||
|
__u8 tcpi_state; |
||||
|
__u8 tcpi_ca_state; |
||||
|
__u8 tcpi_retransmits; |
||||
|
__u8 tcpi_probes; |
||||
|
__u8 tcpi_backoff; |
||||
|
__u8 tcpi_options; |
||||
|
__u8 tcpi_snd_wscale : 4, tcpi_rcv_wscale : 4; |
||||
|
__u8 tcpi_delivery_rate_app_limited : 1, tcpi_fastopen_client_fail : 2; |
||||
|
|
||||
|
__u32 tcpi_rto; |
||||
|
__u32 tcpi_ato; |
||||
|
__u32 tcpi_snd_mss; |
||||
|
__u32 tcpi_rcv_mss; |
||||
|
|
||||
|
__u32 tcpi_unacked; |
||||
|
__u32 tcpi_sacked; |
||||
|
__u32 tcpi_lost; |
||||
|
__u32 tcpi_retrans; |
||||
|
__u32 tcpi_fackets; |
||||
|
|
||||
|
/* Times. */ |
||||
|
__u32 tcpi_last_data_sent; |
||||
|
__u32 tcpi_last_ack_sent; /* Not remembered, sorry. */ |
||||
|
__u32 tcpi_last_data_recv; |
||||
|
__u32 tcpi_last_ack_recv; |
||||
|
|
||||
|
/* Metrics. */ |
||||
|
__u32 tcpi_pmtu; |
||||
|
__u32 tcpi_rcv_ssthresh; |
||||
|
__u32 tcpi_rtt; |
||||
|
__u32 tcpi_rttvar; |
||||
|
__u32 tcpi_snd_ssthresh; |
||||
|
__u32 tcpi_snd_cwnd; |
||||
|
__u32 tcpi_advmss; |
||||
|
__u32 tcpi_reordering; |
||||
|
|
||||
|
__u32 tcpi_rcv_rtt; |
||||
|
__u32 tcpi_rcv_space; |
||||
|
|
||||
|
__u32 tcpi_total_retrans; |
||||
|
|
||||
|
__u64 tcpi_pacing_rate; |
||||
|
__u64 tcpi_max_pacing_rate; |
||||
|
__u64 tcpi_bytes_acked; /* RFC4898 tcpEStatsAppHCThruOctetsAcked */ |
||||
|
__u64 tcpi_bytes_received; /* RFC4898 tcpEStatsAppHCThruOctetsReceived */ |
||||
|
__u32 tcpi_segs_out; /* RFC4898 tcpEStatsPerfSegsOut */ |
||||
|
__u32 tcpi_segs_in; /* RFC4898 tcpEStatsPerfSegsIn */ |
||||
|
|
||||
|
__u32 tcpi_notsent_bytes; |
||||
|
__u32 tcpi_min_rtt; |
||||
|
__u32 tcpi_data_segs_in; /* RFC4898 tcpEStatsDataSegsIn */ |
||||
|
__u32 tcpi_data_segs_out; /* RFC4898 tcpEStatsDataSegsOut */ |
||||
|
|
||||
|
__u64 tcpi_delivery_rate; |
||||
|
|
||||
|
__u64 tcpi_busy_time; /* Time (usec) busy sending data */ |
||||
|
__u64 tcpi_rwnd_limited; /* Time (usec) limited by receive window */ |
||||
|
__u64 tcpi_sndbuf_limited; /* Time (usec) limited by send buffer */ |
||||
|
|
||||
|
__u32 tcpi_delivered; |
||||
|
__u32 tcpi_delivered_ce; |
||||
|
|
||||
|
__u64 tcpi_bytes_sent; /* RFC4898 tcpEStatsPerfHCDataOctetsOut */ |
||||
|
__u64 tcpi_bytes_retrans; /* RFC4898 tcpEStatsPerfOctetsRetrans */ |
||||
|
__u32 tcpi_dsack_dups; /* RFC4898 tcpEStatsStackDSACKDups */ |
||||
|
__u32 tcpi_reord_seen; /* reordering events seen */ |
||||
|
|
||||
|
__u32 tcpi_rcv_ooopack; /* Out-of-order packets received */ |
||||
|
|
||||
|
__u32 tcpi_snd_wnd; /* peer's advertised receive window after
|
||||
|
* scaling (bytes) |
||||
|
*/ |
||||
|
__u32 tcpi_rcv_wnd; /* local advertised receive window after
|
||||
|
* scaling (bytes) |
||||
|
*/ |
||||
|
|
||||
|
__u32 tcpi_rehash; /* PLB or timeout triggered rehash attempts */ |
||||
|
|
||||
|
__u16 tcpi_total_rto; /* Total number of RTO timeouts, including
|
||||
|
* SYN/SYN-ACK and recurring timeouts. |
||||
|
*/ |
||||
|
__u16 tcpi_total_rto_recoveries; /* Total number of RTO
|
||||
|
* recoveries, including any |
||||
|
* unfinished recovery. |
||||
|
*/ |
||||
|
__u32 tcpi_total_rto_time; /* Total time spent in RTO recoveries
|
||||
|
* in milliseconds, including any |
||||
|
* unfinished recovery. |
||||
|
*/ |
||||
|
}; |
||||
|
|
||||
|
#endif |
||||
Loading…
Reference in new issue