gsd
/
zapret
mirror of https://github.com/bol-van/zapret/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

init: deduplicate shell code

pull/98/head
bol-van 3 years ago
parent
717b337291
commit
5a1ca8d481
5 changed files with 396 additions and 576 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 161
      common/ipt.sh
  2. 60
      common/linux_iphelper.sh
  3. 99
      common/nft.sh
  4. 332
      init.d/openwrt/functions
  5. 320
      init.d/sysv/functions

161
common/ipt.sh
View File

@ -83,6 +83,167 @@ filter_apply_ipset_target()
}
prepare_tpws_fw4()
{
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
# NOTE : kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8
[ "$DISABLE_IPV4" = "1" ] || {
iptables -N input_rule_zapret 2>/dev/null
ipt input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
ipta input_rule_zapret -d 127.0.0.0/8 -j DROP
ipt INPUT ! -i lo -j input_rule_zapret
prepare_route_localnet
}
}
unprepare_tpws_fw4()
{
[ "$DISABLE_IPV4" = "1" ] || {
unprepare_route_localnet
ipt_del INPUT ! -i lo -j input_rule_zapret
iptables -F input_rule_zapret 2>/dev/null
iptables -X input_rule_zapret 2>/dev/null
}
}
unprepare_tpws_fw()
{
unprepare_tpws_fw4
}
ipt_print_op()
{
if [ "$1" = "1" ]; then
echo "Adding ip$4tables rule for $3 : $2"
else
echo "Deleting ip$4tables rule for $3 : $2"
fi
}
_fw_tpws4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - tpws port
# $4 - lan interface names space separated
# $5 - wan interface names space separated
[ "$DISABLE_IPV4" = "1" ] || {
local i rule
[ "$1" = 1 ] && prepare_tpws_fw4
ipt_print_op $1 "$2" "tpws (port $3)"
rule="-p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3"
for i in $4 ; do
ipt_add_del $1 PREROUTING -t nat -i $i $rule
done
rule="-m owner ! --uid-owner $WS_USER $rule"
if [ -n "$5" ]; then
for i in $5; do
ipt_add_del $1 OUTPUT -t nat -o $i $rule
done
else
ipt_add_del $1 OUTPUT -t nat $rule
fi
}
}
_fw_tpws6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - tpws port
# $4 - lan interface names space separated
# $5 - wan interface names space separated
[ "$DISABLE_IPV6" = "1" ] || {
local i rule DNAT6
ipt_print_op $1 "$2" "tpws (port $3)" 6
rule="-p tcp $2 $IPSET_EXCLUDE6 dst"
for i in $4 ; do
_dnat6_target $i DNAT6
[ -n "$DNAT6" -a "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $i $rule -j DNAT --to [$DNAT6]:$3
done
rule="-m owner ! --uid-owner $WS_USER $rule -j DNAT --to [::1]:$3"
if [ -n "$5" ]; then
for i in $5; do
ipt6_add_del $1 OUTPUT -t nat -o $i $rule
done
else
ipt6_add_del $1 OUTPUT -t nat $rule
fi
}
}
fw_tpws()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6
# $4 - tpws port
fw_tpws4 $1 "$2" $4
fw_tpws6 $1 "$3" $4
}
_fw_nfqws_post4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - queue number
# $4 - wan interface names space separated
[ "$DISABLE_IPV4" = "1" ] || {
local i
ipt_print_op $1 "$2" "nfqws postrouting (qnum $3)"
rule="-p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass"
if [ -n "$4" ] ; then
for i in $4; do
ipt_add_del $1 POSTROUTING -t mangle -o $i $rule
done
else
ipt_add_del $1 POSTROUTING -t mangle $rule
fi
}
}
_fw_nfqws_post6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - queue number
# $4 - wan interface names space separated
[ "$DISABLE_IPV6" = "1" ] || {
local i
ipt_print_op $1 "$2" "nfqws postrouting (qnum $3)" 6
rule="-p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass"
if [ -n "$4" ] ; then
for i in $4; do
ipt6_add_del $1 POSTROUTING -t mangle -o $i $rule
done
else
ipt6_add_del $1 POSTROUTING -t mangle $rule
fi
}
}
fw_nfqws_post()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6
# $4 - queue number
fw_nfqws_post4 $1 "$2" $4
fw_nfqws_post6 $1 "$3" $4
}
zapret_do_firewall_ipt()
{
# $1 - 1 - add, 0 - del

60
common/linux_iphelper.sh
View File

@ -49,3 +49,63 @@ wait_ifup()
do :; done
false
}
_dnat6_target()
{
# $1 - interface name
# $2 - var to store target ip6
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g')
eval DNAT6_TARGET="\$$DVAR"
[ -n "$2" ] && eval $2=''
[ -n "$DNAT6_TARGET" ] || {
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $1)
[ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo $1: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
sleep 1
do :; done
[ -n "$DNAT6_TARGET" ] || {
echo $1: no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $1)
[ -n "$DNAT6_TARGET" ] || {
echo $1: could not get any address
DNAT6_TARGET=-
}
}
eval $DVAR="$DNAT6_TARGET"
}
[ -n "$2" ] && eval $2="$DNAT6_TARGET"
}
_set_route_localnet()
{
# $1 - 1 = enable, 0 = disable
# $2,$3,... - interface names
[ "$DISABLE_IPV4" = "1" ] || {
local enable="$1"
shift
while [ -n "$1" ]; do
sysctl -q -w net.ipv4.conf.$1.route_localnet="$enable"
shift
done
}
}
prepare_route_localnet()
{
set_route_localnet 1 "$@"
}
unprepare_route_localnet()
{
set_route_localnet 0 "$@"
}

99
common/nft.sh
View File

@ -164,7 +164,8 @@ nft_add_nfqws_flow_exempt_rule()
{
# $1 - rule (must be all filters in one var)
nft_add_rule flow_offload $(nft_clean_nfqws_rule $1) return comment \"direct flow offloading exemption\"
nft_add_rule flow_offload $(nft_reverse_nfqws_rule $1) return comment \"reverse flow offloading exemption\"
# do not need this because of oifname @wanif/@wanif6 filter in forward chain
#nft_add_rule flow_offload $(nft_reverse_nfqws_rule $1) return comment \"reverse flow offloading exemption\"
}
nft_hw_offload_supported()
@ -181,7 +182,11 @@ nft_hw_offload_supported()
nft_apply_flow_offloading()
{
# ft can be absent
nft_add_rule flow_offload meta l4proto "{ tcp, udp }" flow add @ft 2>/dev/null && nft_add_rule forward jump flow_offload
nft_add_rule flow_offload meta l4proto "{ tcp, udp }" flow add @ft 2>/dev/null && {
# allow only outgoing packets to initiate flow offload
nft_add_rule forward oifname @wanif jump flow_offload
nft_add_rule forward oifname @wanif6 jump flow_offload
}
}
@ -260,7 +265,8 @@ flush set inet $ZAPRET_NFT_TABLE lanif"
case "$FLOWOFFLOAD" in
software)
ALLDEVS=$(unique $1 $2 $3)
nft_create_or_update_flowtable '' $ALLDEVS
# unbound flowtable may cause error in older nft version
nft_create_or_update_flowtable '' $ALLDEVS 2>/dev/null
;;
hardware)
ALLDEVS=$(unique $1 $2 $3)
@ -285,6 +291,93 @@ nft_only()
esac
}
nft_print_op()
{
echo "Adding nftables ipv$3 rule for $2 : $1"
}
_nft_fw_tpws4()
{
# $1 - filter ipv4
# $2 - tpws port
# $4 - not-empty if wan interface filtering required
[ "$DISABLE_IPV4" = "1" ] || {
local filter="$1" port="$2"
nft_print_op "$filter" "tpws (port $2)" 4
nft_add_rule dnat_output skuid != $WS_USER ${3:+oifname @wanif }meta l4proto tcp $filter ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$port
nft_add_rule dnat_pre iifname @lanif meta l4proto tcp $filter ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$port
prepare_route_localnet
}
}
_nft_fw_tpws6()
{
# $1 - filter ipv6
# $2 - tpws port
# $3 - lan interface names space separated
# $4 - not-empty if wan interface filtering required
[ "$DISABLE_IPV6" = "1" ] || {
local filter="$1" port="$2" DNAT6 i
nft_print_op "$filter" "tpws (port $port)" 6
nft_add_rule dnat_output skuid != $WS_USER ${4:+oifname @wanif6 }meta l4proto tcp $filter ip6 daddr != @nozapret6 dnat ip6 to [::1]:$port
_set_route_localnet 1 $3
for i in $3; do
_dnat6_target $i DNAT6
[ -n "$DNAT6" -a "$DNAT6" != '-' ] && nft_add_rule dnat_pre iifname $i meta l4proto tcp $filter ip6 daddr != @nozapret6 dnat ip6 to [$DNAT6]:$port
shift
done
}
}
nft_fw_tpws()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - tpws port
nft_fw_tpws4 "$1" $3
nft_fw_tpws6 "$2" $3
}
_nft_fw_nfqws_post4()
{
# $1 - filter ipv4
# $2 - queue number
# $3 - not-empty if wan interface filtering required
[ "$DISABLE_IPV4" = "1" ] || {
local filter="$1" port="$2" rule
nft_print_op "$filter" "nfqws postrouting (qnum $port)" 4
rule="${3:+oifname @wanif }meta l4proto tcp $filter ip daddr != @nozapret"
nft_add_rule postrouting $rule queue num $port bypass
nft_add_nfqws_flow_exempt_rule "$rule"
}
}
_nft_fw_nfqws_post6()
{
# $1 - filter ipv6
# $2 - queue number
# $3 - not-empty if wan interface filtering required
[ "$DISABLE_IPV6" = "1" ] || {
local filter="$1" port="$2" rule
nft_print_op "$filter" "nfqws postrouting (qnum $port)" 6
rule="${3:+oifname @wanif6 }meta l4proto tcp $filter ip6 daddr != @nozapret6"
nft_add_rule postrouting $rule queue num $port bypass
nft_add_nfqws_flow_exempt_rule "$rule"
}
}
nft_fw_nfqws_post()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - queue number
nft_fw_nfqws_post4 "$1" $3
nft_fw_nfqws_post6 "$2" $3
}
zapret_reload_ifsets()
{
nft_only nft_create_table ; nft_fill_ifsets_overload

332
init.d/openwrt/functions
View File

@ -44,261 +44,109 @@ NFQWS_OPT_DESYNC_HTTPS6="${NFQWS_OPT_DESYNC_HTTPS6:-$NFQWS_OPT_DESYNC_HTTPS}"
# we use low level function from network.sh to avoid this limitation
# it can change theoretically and stop working
network_find_wan_all()
network_find_wan4_all()
{
__network_ifstatus "$1" "" "[@.route[@.target='0.0.0.0' && !@.table]].interface" "" 10 2>/dev/null && return
network_find_wan $1
}
network_find_wan_all()
{
network_find_wan4_all "$@"
}
network_find_wan6_all()
{
__network_ifstatus "$1" "" "[@.route[@.target='::' && !@.table]].interface" "" 10 2>/dev/null && return
network_find_wan6 $1
}
route_localnet()
{
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
sysctl -qw net.ipv4.conf.$DEVICE.route_localnet=1
done
}
dnat6_target()
{
# $1 - lan network name
# $2 - var to store target ip6
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g')
eval DNAT6_TARGET="\$$DVAR"
[ -n "$2" ] && eval $2=''
[ -n "$DNAT6_TARGET" ] || {
# no reason to query if its down
network_is_up $1 || return
local DEVICE
network_get_device DEVICE $1
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $DEVICE)
[ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo $DEVICE: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
sleep 1
do :; done
[ -n "$DNAT6_TARGET" ] || {
echo $DEVICE: no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
[ -n "$DNAT6_TARGET" ] || {
echo $DEVICE: could not get any address
DNAT6_TARGET=-
}
}
eval $DVAR="$DNAT6_TARGET"
}
[ -n "$2" ] && eval $2="$DNAT6_TARGET"
}
set_route_localnet()
{
# $1 - 1 = enable, 0 = disable
[ "$DISABLE_IPV4" = "1" ] || {
local lan DEVICE
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
sysctl -q -w net.ipv4.conf.$DEVICE.route_localnet=$1
done
network_is_up $1 || {
[ -n "$2" ] && eval $2=''
return
}
}
prepare_route_localnet()
{
set_route_localnet 1
}
unprepare_route_localnet()
{
set_route_localnet 0
}
prepare_tpws_fw4()
{
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
# NOTE : kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8
[ "$DISABLE_IPV4" = "1" ] || {
iptables -N input_rule_zapret 2>/dev/null
ipt input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
ipta input_rule_zapret -d 127.0.0.0/8 -j DROP
ipt INPUT ! -i lo -j input_rule_zapret
local DEVICE
network_get_device DEVICE $1
prepare_route_localnet
}
_dnat6_target $DEVICE $2
}
unprepare_tpws_fw4()
{
[ "$DISABLE_IPV4" = "1" ] || {
unprepare_route_localnet
ipt_del INPUT ! -i lo -j input_rule_zapret
iptables -F input_rule_zapret 2>/dev/null
iptables -X input_rule_zapret 2>/dev/null
}
}
unprepare_tpws_fw()
set_route_localnet()
{
unprepare_tpws_fw4
}
# $1 - 1 = enable, 0 = disable
fw_nfqws_pre4()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv4
# $3 - queue number
local DLAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
_set_route_localnet $1 $DLAN
}
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt_add_del $1 PREROUTING -t mangle -i $DEVICE -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
done
}
}
fw_nfqws_pre6()
fw_nfqws_post_x()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv6
# $2 - filter
# $3 - queue number
# $4 - ip version : 4 or 6
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6_add_del $1 PREROUTING -t mangle -i $DEVICE -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
done
}
}
fw_nfqws_pre()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv4
# $3 - filter ipv6
# $4 - queue number
network_find_wan${4}_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces"
fw_nfqws_pre4 $1 "$2" $4
fw_nfqws_pre6 $1 "$3" $4
_fw_nfqws_post${4} $1 "$2" $3 "$(unique $DWAN)"
}
fw_nfqws_post4()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv4
# $3 - queue number
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt_add_del $1 POSTROUTING -t mangle -o $DEVICE -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
done
}
fw_nfqws_post_x $1 "$2" $3 4
}
fw_nfqws_post6()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv6
# $3 - queue number
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6_add_del $1 POSTROUTING -t mangle -o $DEVICE -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
done
}
fw_nfqws_post_x $1 "$2" $3 6
}
fw_nfqws_post()
fw_tpws_x()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv4
# $3 - filter ipv6
# $4 - queue number
# $2 - filter
# $3 - tpws port
# $4 - ip version : 4 or 6
fw_nfqws_post4 $1 "$2" $4
fw_nfqws_post6 $1 "$3" $4
}
local script ifaces DLAN DWAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
network_find_wan${4}_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces"
IPT_OWNER="-m owner ! --uid-owner $WS_USER"
_fw_tpws${4} $1 "$2" $3 "$DLAN" "$(unique $DWAN)"
}
fw_tpws4()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv4
# $3 - tpws port
local lan DEVICE ext_iface wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt_add_del $1 OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
done
[ "$1" = 1 ] && prepare_tpws_fw4
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
ipt_add_del $1 PREROUTING -t nat -i $DEVICE -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
done
}
fw_tpws_x $1 "$2" $3 4
}
fw_tpws6()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv6
# $3 - tpws port
fw_tpws_x $1 "$2" $3 6
}
local lan DEVICE ext_iface wan_iface DNAT6
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6_add_del $1 OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
done
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
dnat6_target $lan DNAT6
[ "$DNAT6" != '-' ] && ipt6_add_del $1 PREROUTING -t nat -i $DEVICE -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6]:$3
done
}
nft_fw_tpws4()
{
_nft_fw_tpws4 "$1" $2 always_apply_wan_filter
}
fw_tpws()
nft_fw_tpws6()
{
# $1 - 1 - add, 0 - del
# $2 - filter ipv4
# $3 - filter ipv6
# $4 - tpws port
fw_tpws4 $1 "$2" $4
fw_tpws6 $1 "$3" $4
local script ifaces DLAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
_nft_fw_tpws6 "$1" $2 "$DLAN" always_apply_wan_filter
}
nft_fw_nfqws_post4()
{
_nft_fw_nfqws_post4 "$1" $2 always_apply_wan_filter
}
nft_fw_nfqws_post6()
{
_nft_fw_nfqws_post6 "$1" $2 always_apply_wan_filter
}
@ -384,13 +232,14 @@ flow_offloading_unexempt()
}
nft_fill_ifsets_overload()
{
local script ifaces DLAN DWAN DWAN6
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
network_find_wan_all ifaces
network_find_wan4_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces"
network_find_wan6_all ifaces
@ -399,75 +248,12 @@ nft_fill_ifsets_overload()
nft_fill_ifsets "$DLAN" "$DWAN" "$DWAN6"
}
nft_fw_tpws4()
{
# $1 - filter ipv4
# $2 - tpws port
[ "$DISABLE_IPV4" = "1" ] || {
nft_add_rule dnat_output skuid != $WS_USER oifname @wanif meta l4proto tcp $1 ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$2
nft_add_rule dnat_pre iifname @lanif meta l4proto tcp $1 ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$2
prepare_route_localnet
}
}
nft_fw_tpws6()
{
# $1 - filter ipv6
# $2 - tpws port
local lan DEVICE DNAT6
[ "$DISABLE_IPV6" = "1" ] || {
nft_add_rule dnat_output skuid != $WS_USER oifname @wanif6 meta l4proto tcp $1 ip6 daddr != @nozapret6 dnat ip6 to [::1]:$2
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
dnat6_target $lan DNAT6
[ "$DNAT6" != '-' ] && nft_add_rule dnat_pre iifname $DEVICE meta l4proto tcp $1 ip6 daddr != @nozapret6 dnat ip6 to [$DNAT6]:$2
done
}
}
nft_fw_tpws()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - tpws port
nft_fw_tpws4 "$1" $3
nft_fw_tpws6 "$2" $3
}
nft_fw_nfqws_post4()
{
# $1 - filter ipv4
# $2 - queue number
local rule
[ "$DISABLE_IPV4" = "1" ] || {
rule="oifname @wanif meta l4proto tcp $1 ip daddr != @nozapret"
nft_add_rule postrouting $rule queue num $2 bypass
nft_add_nfqws_flow_exempt_rule "$rule"
}
}
nft_fw_nfqws_post6()
{
# $1 - filter ipv6
# $2 - queue number
local rule
[ "$DISABLE_IPV6" = "1" ] || {
rule="oifname @wanif6 meta l4proto tcp $1 ip6 daddr != @nozapret6"
nft_add_rule postrouting $rule queue num $2 bypass
nft_add_nfqws_flow_exempt_rule "$rule"
}
}
nft_fw_nfqws_post()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - queue number
nft_fw_nfqws_post4 "$1" $3
nft_fw_nfqws_post6 "$2" $3
local DLAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
_nft_fw_tpws6 "$1" $2 "$DLAN"
}

320
init.d/sysv/functions
View File

@ -98,246 +98,53 @@ IPSET_EXCLUDE="-m set ! --match-set nozapret"
IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
# there's no route_localnet for ipv6
# the best we can is to route to link local of the incoming interface
# OUTPUT - can DNAT to ::1
# PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr
# not a good idea to expose tpws to the world (bind to ::)
dnat6_target()
{
# $1 - lan network name
# $2 - var to store target ip6
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g')
eval DNAT6_TARGET="\$$DVAR"
[ -n "$2" ] && eval $2=''
[ -n "$DNAT6_TARGET" ] || {
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $1)
[ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo $1: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
sleep 1
do :; done
[ -n "$DNAT6_TARGET" ] || {
echo $1: no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $1)
[ -n "$DNAT6_TARGET" ] || {
echo $1: could not get any address
DNAT6_TARGET=-
}
}
eval $DVAR="$DNAT6_TARGET"
}
[ -n "$2" ] && eval $2="$DNAT6_TARGET"
_dnat6_target "$@"
}
set_route_localnet()
{
# $1 - 1 = enable, 0 = disable
[ "$DISABLE_IPV4" = "1" ] || {
local lan
for lan in $IFACE_LAN ; do
sysctl -q -w net.ipv4.conf.$lan.route_localnet=$1
done
}
}
prepare_route_localnet()
{
set_route_localnet 1
}
unprepare_route_localnet()
{
set_route_localnet 0
}
prepare_tpws_fw4()
{
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
# NOTE : kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8
[ "$DISABLE_IPV4" = "1" ] || {
[ -n "$IFACE_LAN" ] && {
local lan
iptables -N input_rule_zapret 2>/dev/null
iptables -F input_rule_zapret
iptables -A input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
iptables -A input_rule_zapret -d 127.0.0.0/8 -j DROP
ipt INPUT ! -i lo -j input_rule_zapret
prepare_route_localnet
}
}
_set_route_localnet $1 "$IFACE_LAN"
}
unprepare_tpws_fw4()
{
[ "$DISABLE_IPV4" = "1" ] || {
[ -n "$IFACE_LAN" ] && {
local lan
unprepare_route_localnet
ipt_del INPUT ! -i lo -j input_rule_zapret
iptables -F input_rule_zapret 2>/dev/null
iptables -X input_rule_zapret 2>/dev/null
}
}
}
unprepare_tpws_fw()
fw_nfqws_post4()
{
unprepare_tpws_fw4
_fw_nfqws_post4 $1 "$2" $3 "$IFACE_WAN"
}
ipt_print_op()
fw_nfqws_post6()
{
if [ "$1" = "1" ]; then
echo "Adding ip$4tables rule for $3 : $2"
else
echo "Deleting ip$4tables rule for $3 : $2"
fi
_fw_nfqws_post6 $1 "$2" $3 "$IFACE_WAN"
}
fw_tpws4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - tpws port
[ "$DISABLE_IPV4" = "1" ] || {
[ "$1" = 1 ] && prepare_tpws_fw4
ipt_print_op $1 "$2" "tpws (port $3)"
for lan in $IFACE_LAN ; do
ipt_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
done
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
done
else
ipt_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
fi
}
_fw_tpws4 $1 "$2" $3 "$IFACE_LAN" "$IFACE_WAN"
}
fw_tpws6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - tpws port
[ "$DISABLE_IPV6" = "1" ] || {
ipt_print_op $1 "$2" "tpws (port $3)" 6
local DNAT6
for lan in $IFACE_LAN ; do
dnat6_target $lan DNAT6
[ "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6]:$3
done
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt6_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
done
else
ipt6_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
fi
}
}
fw_tpws()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6
# $4 - tpws port
fw_tpws4 $1 "$2" $4
fw_tpws6 $1 "$3" $4
_fw_tpws6 $1 "$2" $3 "$IFACE_LAN" "$IFACE_WAN"
}
fw_nfqws_pre4()
nft_fw_tpws4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - queue number
[ "$DISABLE_IPV4" = "1" ] || {
ipt_print_op $1 "$2" "nfqws prerouting (qnum $3)"
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
done
else
ipt_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
fi
}
_nft_fw_tpws4 "$1" $2 "$IFACE_WAN"
}
fw_nfqws_pre6()
nft_fw_tpws6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - queue number
[ "$DISABLE_IPV6" = "1" ] || {
ipt_print_op $1 "$2" "nfqws prerouting (qnum $3)" 6
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt6_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
done
else
ipt6_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
fi
}
_nft_fw_tpws6 "$1" $2 "$IFACE_LAN" "$IFACE_WAN"
}
fw_nfqws_pre()
nft_fw_nfqws_post4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6
# $4 - queue number
fw_nfqws_pre4 $1 "$2" $4
fw_nfqws_pre6 $1 "$3" $4
_nft_fw_nfqws_post4 "$1" $2 "$IFACE_WAN"
}
fw_nfqws_post4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - queue number
[ "$DISABLE_IPV4" = "1" ] || {
ipt_print_op $1 "$2" "nfqws postrouting (qnum $3)"
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
done
else
ipt_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
fi
}
}
fw_nfqws_post6()
nft_fw_nfqws_post6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - queue number
[ "$DISABLE_IPV6" = "1" ] || {
ipt_print_op $1 "$2" "nfqws postrouting (qnum $3)" 6
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt6_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
done
else
ipt6_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
fi
}
_nft_fw_nfqws_post6 "$1" $2 "$IFACE_WAN"
}
fw_nfqws_post()
nft_fill_ifsets_overload()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6
# $4 - queue number
fw_nfqws_post4 $1 "$2" $4
fw_nfqws_post6 $1 "$3" $4
nft_fill_ifsets "$IFACE_LAN" "$IFACE_WAN" "$IFACE_WAN"
}
filter_apply_hostlist_target()
{
# $1 - var name of tpws or nfqws params
@ -520,90 +327,3 @@ zapret_stop_daemons()
zapret_do_daemons 0 "$@"
}
nft_fill_ifsets_overload()
{
nft_fill_ifsets "$IFACE_LAN" "$IFACE_WAN" "$IFACE_WAN"
}
nft_print_op()
{
echo "Adding nftables ipv$3 rule for $2 : $1"
}
nft_fw_tpws4()
{
# $1 - filter ipv4
# $2 - tpws port
[ "$DISABLE_IPV4" = "1" ] || {
nft_print_op "$1" "tpws (port $2)" 4
nft_add_rule dnat_output skuid != $WS_USER ${IFACE_WAN:+oifname @wanif }meta l4proto tcp $1 ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$2
[ -n "$IFACE_LAN" ] && {
prepare_route_localnet
nft_add_rule dnat_pre iifname @lanif meta l4proto tcp $1 ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$2
}
}
}
nft_fw_tpws6()
{
# $1 - filter ipv6
# $2 - tpws port
local lan DNAT6
[ "$DISABLE_IPV6" = "1" ] || {
nft_print_op "$1" "tpws (port $2)" 6
nft_add_rule dnat_output skuid != $WS_USER ${IFACE_WAN:+oifname @wanif6 }meta l4proto tcp $1 ip6 daddr != @nozapret6 dnat ip6 to [::1]:$2
for lan in $IFACE_LAN ; do
dnat6_target $lan DNAT6
[ "$DNAT6" != '-' ] && nft_add_rule dnat_pre iifname $lan meta l4proto tcp $1 ip6 daddr != @nozapret6 dnat ip6 to [$DNAT6]:$2
done
}
}
nft_fw_tpws()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - tpws port
nft_fw_tpws4 "$1" $3
nft_fw_tpws6 "$2" $3
}
nft_fw_nfqws_post4()
{
# $1 - filter ipv4
# $2 - queue number
local rule
[ "$DISABLE_IPV4" = "1" ] || {
nft_print_op "$1" "nfqws postrouting (qnum $2)" 4
rule="${IFACE_WAN:+oifname @wanif }meta l4proto tcp $1 ip daddr != @nozapret"
nft_add_rule postrouting $rule queue num $2 bypass
nft_add_nfqws_flow_exempt_rule "$rule"
}
}
nft_fw_nfqws_post6()
{
# $1 - filter ipv6
# $2 - queue number
local rule
[ "$DISABLE_IPV6" = "1" ] || {
nft_print_op "$1" "nfqws postrouting (qnum $2)" 6
rule="${IFACE_WAN:+oifname @wanif6 }meta l4proto tcp $1 ip6 daddr != @nozapret6"
nft_add_rule postrouting $rule queue num $2 bypass
nft_add_nfqws_flow_exempt_rule "$rule"
}
}
nft_fw_nfqws_post()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - queue number
nft_fw_nfqws_post4 "$1" $3
nft_fw_nfqws_post6 "$2" $3
}

Write Preview
Loading…
Cancel
Save