mirror of https://github.com/bol-van/zapret/
NewUse
10 months ago
committed by
GitHub
GitHub
71 changed files with 1679 additions and 672 deletions
@ -1,3 +1,13 @@ |
|||
googlevideo.com |
|||
youtubei.googleapis.com |
|||
i.ytimg.com |
|||
ytimg.com |
|||
yt3.ggpht.com |
|||
yt4.ggpht.com |
|||
youtube.com |
|||
youtubeembeddedplayer.googleapis.com |
|||
ytimg.l.google.com |
|||
jnn-pa.googleapis.com |
|||
youtube-nocookie.com |
|||
youtube-ui.l.google.com |
|||
yt-video-upload.l.google.com |
|||
wide-youtube.l.google.com |
|||
|
|||
@ -0,0 +1,43 @@ |
|||
custom_runner() |
|||
{ |
|||
# $1 - function name |
|||
# $2+ - params |
|||
|
|||
local n script FUNC=$1 |
|||
|
|||
shift |
|||
|
|||
[ -f "$CUSTOM_DIR/custom" ] && { |
|||
unset -f $FUNC |
|||
. "$CUSTOM_DIR/custom" |
|||
existf $FUNC && $FUNC "$@" |
|||
} |
|||
[ -d "$CUSTOM_DIR/custom.d" ] && { |
|||
n=$(ls "$CUSTOM_DIR/custom.d" | wc -c | xargs) |
|||
[ "$n" = 0 ] || { |
|||
for script in "$CUSTOM_DIR/custom.d/"*; do |
|||
[ -f "$script" ] || continue |
|||
unset -f $FUNC |
|||
. "$script" |
|||
existf $FUNC && $FUNC "$@" |
|||
done |
|||
} |
|||
} |
|||
} |
|||
|
|||
alloc_tpws_port() |
|||
{ |
|||
# $1 - target var name |
|||
alloc_num NUMPOOL_TPWS_PORT $1 910 979 |
|||
} |
|||
alloc_qnum() |
|||
{ |
|||
# $1 - target var name |
|||
alloc_num NUMPOOL_QNUM $1 65400 65499 |
|||
} |
|||
alloc_dnum() |
|||
{ |
|||
# alloc daemon number |
|||
# $1 - target var name |
|||
alloc_num NUMPOOL_DNUM $1 1000 1999 |
|||
} |
|||
@ -1,26 +0,0 @@ |
|||
# this script is an example describing how to run tpws on a custom port |
|||
|
|||
TPPORT_MY=987 |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
local opt="--user=root --port=$TPPORT_MY" |
|||
tpws_apply_binds opt |
|||
opt="$opt $TPWS_OPT" |
|||
filter_apply_hostlist_target opt |
|||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX" |
|||
do_daemon $1 1 "$TPWS" "$opt" |
|||
} |
|||
|
|||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
|||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
|||
|
|||
zapret_custom_firewall_v4() |
|||
{ |
|||
pf_anchor_zapret_v4_tpws $TPPORT_MY |
|||
} |
|||
zapret_custom_firewall_v6() |
|||
{ |
|||
pf_anchor_zapret_v6_tpws $TPPORT_MY |
|||
} |
|||
@ -0,0 +1,31 @@ |
|||
# this script is an example describing how to run tpws on a custom port |
|||
|
|||
TPWS_OPT_EXTRA=${TPWS_OPT_EXTRA:---split-pos=2} |
|||
TPWS_OPT_SUFFIX_EXTRA="${TPWS_OPT_SUFFIX_EXTRA:-}" |
|||
DPORTS_EXTRA=${DPORTS_EXTRA:-20443,20444,30000-30009} |
|||
|
|||
alloc_dnum DNUM_EXTRA_TPWS |
|||
alloc_tpws_port TPPORT_EXTRA_TPWS |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
local opt="--user=root --port=$TPPORT_EXTRA_TPWS" |
|||
tpws_apply_binds opt |
|||
opt="$opt $TPWS_OPT_EXTRA" |
|||
filter_apply_hostlist_target opt |
|||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX_EXTRA" |
|||
do_daemon $1 $DNUM_EXTRA_TPWS "$TPWS" "$opt" |
|||
} |
|||
|
|||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
|||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
|||
|
|||
zapret_custom_firewall_v4() |
|||
{ |
|||
pf_anchor_zapret_v4_tpws $TPPORT_EXTRA_TPWS $(replace_char - : $DPORTS_EXTRA) |
|||
} |
|||
zapret_custom_firewall_v6() |
|||
{ |
|||
pf_anchor_zapret_v6_tpws $TPPORT_EXTRA_TPWS $(replace_char - : $DPORTS_EXTRA) |
|||
} |
|||
@ -0,0 +1,18 @@ |
|||
# this custom script applies tpws mode as it would be with MODE=tpws |
|||
|
|||
OVERRIDE=tpws |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
|||
} |
|||
zapret_custom_firewall_v4() |
|||
{ |
|||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4 |
|||
} |
|||
zapret_custom_firewall_v6() |
|||
{ |
|||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6 |
|||
} |
|||
@ -0,0 +1,18 @@ |
|||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
|||
|
|||
OVERRIDE=tpws-socks |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
|||
} |
|||
zapret_custom_firewall_v4() |
|||
{ |
|||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4 |
|||
} |
|||
zapret_custom_firewall_v6() |
|||
{ |
|||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6 |
|||
} |
|||
@ -1,21 +0,0 @@ |
|||
# this script contain your special code to launch daemons and configure firewall |
|||
# use helpers from "functions" file |
|||
# in case of upgrade keep this file only, do not modify others |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
: |
|||
} |
|||
|
|||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
|||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
|||
|
|||
zapret_custom_firewall_v4() |
|||
{ |
|||
: |
|||
} |
|||
zapret_custom_firewall_v6() |
|||
{ |
|||
: |
|||
} |
|||
@ -1,47 +0,0 @@ |
|||
# this custom script demonstrates how to reuse built-in modes and add something from yourself |
|||
|
|||
MY_TPPORT=$(($TPPORT + 1)) |
|||
MY_TPWS_OPT="--methodeol --hostcase" |
|||
MY_DPORT=81 |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
local MODE_OVERRIDE=tpws |
|||
local opt |
|||
|
|||
start_daemons_procd |
|||
|
|||
opt="--port=$MY_TPPORT $MY_TPWS_OPT" |
|||
filter_apply_hostlist_target opt |
|||
run_tpws 100 "$opt" |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=tpws |
|||
local f4 f6 |
|||
|
|||
zapret_do_firewall_rules_ipt $1 |
|||
|
|||
f4="-p tcp --dport $MY_DPORT" |
|||
f6=$f4 |
|||
filter_apply_ipset_target f4 f6 |
|||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local MODE_OVERRIDE=tpws |
|||
local f4 f6 |
|||
|
|||
zapret_apply_firewall_rules_nft |
|||
|
|||
f4="tcp dport $MY_DPORT" |
|||
f6=$f4 |
|||
nft_filter_apply_ipset_target f4 f6 |
|||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT |
|||
} |
|||
@ -1,69 +0,0 @@ |
|||
# this custom script demonstrates how to apply tpws to http and nfqws to https |
|||
# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
local opt |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
opt="--port=$TPPORT $TPWS_OPT" |
|||
filter_apply_hostlist_target opt |
|||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX" |
|||
run_tpws 1 "$opt" |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" ] && { |
|||
opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS" |
|||
filter_apply_hostlist_target opt |
|||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX" |
|||
run_daemon 2 $NFQWS "$opt" |
|||
} |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local f4 f6 |
|||
local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)" |
|||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" |
|||
f6=$f4 |
|||
filter_apply_ipset_target f4 f6 |
|||
fw_tpws $1 "$f4" "$f6" $TPPORT |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" ] && { |
|||
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" |
|||
f6=$f4 |
|||
filter_apply_ipset_target f4 f6 |
|||
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM |
|||
} |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local f4 f6 |
|||
local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)" |
|||
local desync="mark and $DESYNC_MARK == 0" |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
f4="tcp dport {$HTTP_PORTS}" |
|||
f6=$f4 |
|||
nft_filter_apply_ipset_target f4 f6 |
|||
nft_fw_tpws "$f4" "$f6" $TPPORT |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" ] && { |
|||
f4="tcp dport {$HTTPS_PORTS} $first_packet_only" |
|||
f6=$f4 |
|||
nft_filter_apply_ipset_target f4 f6 |
|||
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM |
|||
# for modes that require incoming traffic |
|||
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM |
|||
} |
|||
} |
|||
@ -0,0 +1,22 @@ |
|||
# this custom script applies nfqws mode as it would be with MODE=nfqws |
|||
|
|||
OVERRIDE=nfqws |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -0,0 +1,22 @@ |
|||
# this custom script applies tpws mode as it would be with MODE=tpws |
|||
|
|||
OVERRIDE=tpws |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -0,0 +1,22 @@ |
|||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
|||
|
|||
OVERRIDE=tpws-socks |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -0,0 +1,35 @@ |
|||
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic |
|||
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts |
|||
|
|||
nfqws_tpws_inheritor() |
|||
{ |
|||
# $1 - inherited function |
|||
# $2 - 1 - run, 0 - stop |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2 |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && { |
|||
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2 |
|||
} |
|||
} |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
nfqws_tpws_inheritor start_daemons_procd |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -1,47 +1,38 @@ |
|||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
|||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
|||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
|||
|
|||
QNUM2=$(($QNUM+20)) |
|||
alloc_dnum DNUM_DHT4ALL |
|||
alloc_qnum QNUM_DHT4ALL |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local opt |
|||
|
|||
start_daemons_procd |
|||
|
|||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|||
run_daemon 100 $NFQWS "$opt" |
|||
local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|||
run_daemon $DNUM_DHT4ALL $NFQWS "$opt" |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f uf4 uf6 |
|||
local first_packet_only="$ipt_connbytes 1:1" |
|||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|||
|
|||
zapret_do_firewall_rules_ipt $1 |
|||
|
|||
f='-p udp -m length --length 109:407 -m u32 --u32' |
|||
uf4='0>>22&0x3C@8>>16=0x6431' |
|||
uf6='48>>16=0x6431' |
|||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 |
|||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL |
|||
|
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f |
|||
local first_packet_only="$nft_connbytes 1" |
|||
local desync="mark and $DESYNC_MARK == 0" |
|||
|
|||
zapret_apply_firewall_rules_nft |
|||
|
|||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
|||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 |
|||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL |
|||
} |
|||
File diff suppressed because one or more lines are too long
@ -1,47 +1,37 @@ |
|||
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering |
|||
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering |
|||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" |
|||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received |
|||
|
|||
QNUM2=$(($QNUM+10)) |
|||
alloc_dnum DNUM_QUIC4ALL |
|||
alloc_qnum QNUM_QUIC4ALL |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local opt |
|||
|
|||
zapret_do_daemons $1 |
|||
|
|||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
|||
do_nfqws $1 100 "$opt" |
|||
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
|||
run_daemon $DNUM_QUIC4ALL $NFQWS "$opt" |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f |
|||
local first_packets_only="$ipt_connbytes 1:3" |
|||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|||
|
|||
zapret_do_firewall_rules_ipt $1 |
|||
|
|||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" |
|||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
|||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
|||
|
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f |
|||
local first_packets_only="$nft_connbytes 1-3" |
|||
local desync="mark and $DESYNC_MARK == 0" |
|||
|
|||
zapret_apply_firewall_rules_nft |
|||
|
|||
f="udp dport {$QUIC_PORTS}" |
|||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
|||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
|||
} |
|||
@ -1,33 +0,0 @@ |
|||
# this script contain your special code to launch daemons and configure firewall |
|||
# use helpers from "functions" file and "zapret" init script |
|||
# in case of upgrade keep this file only, do not modify others |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
# PLACEHOLDER |
|||
echo !!! NEED ATTENTION !!! |
|||
echo Start daemon\(s\) |
|||
echo Study how other sections work |
|||
|
|||
run_daemon 1 /bin/sleep 20 |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
# PLACEHOLDER |
|||
echo !!! NEED ATTENTION !!! |
|||
echo Configure iptables for required actions |
|||
echo Study how other sections work |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
# PLACEHOLDER |
|||
echo !!! NEED ATTENTION !!! |
|||
echo Configure nftables for required actions |
|||
echo Study how other sections work |
|||
} |
|||
@ -1,47 +0,0 @@ |
|||
# this custom script demonstrates how to reuse built-in modes and add something from yourself |
|||
|
|||
MY_TPPORT=$(($TPPORT + 1)) |
|||
MY_TPWS_OPT="--methodeol --hostcase" |
|||
MY_DPORT=81 |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=tpws |
|||
local opt |
|||
|
|||
zapret_do_daemons $1 |
|||
|
|||
opt="--port=$MY_TPPORT $MY_TPWS_OPT" |
|||
filter_apply_hostlist_target opt |
|||
do_tpws $1 100 "$opt" |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=tpws |
|||
local f4 f6 |
|||
|
|||
zapret_do_firewall_rules_ipt $1 |
|||
|
|||
f4="-p tcp --dport $MY_DPORT" |
|||
f6=$f4 |
|||
filter_apply_ipset_target f4 f6 |
|||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local MODE_OVERRIDE=tpws |
|||
local f4 f6 |
|||
|
|||
zapret_apply_firewall_rules_nft |
|||
|
|||
f4="tcp dport $MY_DPORT" |
|||
f6=$f4 |
|||
nft_filter_apply_ipset_target f4 f6 |
|||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT |
|||
} |
|||
@ -1,71 +0,0 @@ |
|||
# this custom script demonstrates how to apply tpws to http and nfqws to https |
|||
# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local opt |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
opt="--port=$TPPORT $TPWS_OPT" |
|||
filter_apply_hostlist_target opt |
|||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX" |
|||
do_tpws $1 1 "$opt" |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" ] && { |
|||
opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTPS" |
|||
filter_apply_hostlist_target opt |
|||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX" |
|||
do_nfqws $1 2 "$opt" |
|||
} |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local f4 f6 |
|||
local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)" |
|||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" |
|||
f6=$f4 |
|||
filter_apply_ipset_target f4 f6 |
|||
fw_tpws $1 "$f4" "$f6" $TPPORT |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" ] && { |
|||
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" |
|||
f6=$f4 |
|||
filter_apply_ipset_target f4 f6 |
|||
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM |
|||
# for modes that require incoming traffic |
|||
fw_reverse_nfqws_rule $1 "$f4" "$f6" $QNUM |
|||
} |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local f4 f6 |
|||
local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)" |
|||
local desync="mark and $DESYNC_MARK == 0" |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
f4="tcp dport {$HTTP_PORTS}" |
|||
f6=$f4 |
|||
nft_filter_apply_ipset_target f4 f6 |
|||
nft_fw_tpws "$f4" "$f6" $TPPORT |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" ] && { |
|||
f4="tcp dport {$HTTPS_PORTS} $first_packet_only" |
|||
f6=$f4 |
|||
nft_filter_apply_ipset_target f4 f6 |
|||
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM |
|||
# for modes that require incoming traffic |
|||
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM |
|||
} |
|||
} |
|||
@ -0,0 +1,22 @@ |
|||
# this custom script applies nfqws mode as it would be with MODE=nfqws |
|||
|
|||
OVERRIDE=nfqws |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -0,0 +1,22 @@ |
|||
# this custom script applies tpws mode as it would be with MODE=tpws |
|||
|
|||
OVERRIDE=tpws |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -0,0 +1,22 @@ |
|||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
|||
|
|||
OVERRIDE=tpws-socks |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -0,0 +1,35 @@ |
|||
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic |
|||
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts |
|||
|
|||
nfqws_tpws_inheritor() |
|||
{ |
|||
# $1 - inherited function |
|||
# $2 - 1 - run, 0 - stop |
|||
|
|||
[ "$MODE_HTTP" = "1" ] && { |
|||
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2 |
|||
} |
|||
|
|||
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && { |
|||
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2 |
|||
} |
|||
} |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
nfqws_tpws_inheritor zapret_do_daemons $1 |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1 |
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft |
|||
} |
|||
@ -1,49 +1,39 @@ |
|||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
|||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
|||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
|||
|
|||
QNUM2=$(($QNUM+20)) |
|||
alloc_dnum DNUM_DHT4ALL |
|||
alloc_qnum QNUM_DHT4ALL |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local opt |
|||
|
|||
zapret_do_daemons $1 |
|||
|
|||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|||
do_nfqws $1 100 "$opt" |
|||
local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|||
do_nfqws $1 $DNUM_DHT4ALL "$opt" |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f uf4 uf6 |
|||
local first_packet_only="$ipt_connbytes 1:1" |
|||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|||
|
|||
zapret_do_firewall_rules_ipt $1 |
|||
|
|||
f='-p udp -m length --length 109:407 -m u32 --u32' |
|||
uf4='0>>22&0x3C@8>>16=0x6431' |
|||
uf6='48>>16=0x6431' |
|||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 |
|||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL |
|||
|
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f |
|||
local first_packet_only="$nft_connbytes 1" |
|||
local desync="mark and $DESYNC_MARK == 0" |
|||
|
|||
zapret_apply_firewall_rules_nft |
|||
|
|||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
|||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 |
|||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL |
|||
} |
|||
|
|||
File diff suppressed because one or more lines are too long
@ -1,47 +1,37 @@ |
|||
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering |
|||
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering |
|||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" |
|||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received |
|||
|
|||
QNUM2=$(($QNUM+10)) |
|||
alloc_dnum DNUM_QUIC4ALL |
|||
alloc_qnum QNUM_QUIC4ALL |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# stop logic is managed by procd |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local opt |
|||
|
|||
start_daemons_procd |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
|||
run_daemon 100 $NFQWS "$opt" |
|||
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
|||
do_nfqws $1 $DNUM_QUIC4ALL "$opt" |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f |
|||
local first_packets_only="$ipt_connbytes 1:3" |
|||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|||
|
|||
zapret_do_firewall_rules_ipt $1 |
|||
|
|||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" |
|||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
|||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
|||
|
|||
} |
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
local MODE_OVERRIDE=nfqws |
|||
local f |
|||
local first_packets_only="$nft_connbytes 1-3" |
|||
local desync="mark and $DESYNC_MARK == 0" |
|||
|
|||
zapret_apply_firewall_rules_nft |
|||
|
|||
f="udp dport {$QUIC_PORTS}" |
|||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
|||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
|||
} |
|||
@ -1,34 +0,0 @@ |
|||
# this script contain your special code to launch daemons and configure firewall |
|||
# use helpers from "functions" file |
|||
# in case of upgrade keep this file only, do not modify others |
|||
|
|||
zapret_custom_daemons() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
# PLACEHOLDER |
|||
echo !!! NEED ATTENTION !!! |
|||
echo Start daemon\(s\) |
|||
echo Study how other sections work |
|||
|
|||
do_daemon $1 1 /bin/sleep 20 |
|||
} |
|||
zapret_custom_firewall() |
|||
{ |
|||
# $1 - 1 - run, 0 - stop |
|||
|
|||
# PLACEHOLDER |
|||
echo !!! NEED ATTENTION !!! |
|||
echo Configure iptables for required actions |
|||
echo Study how other sections work |
|||
} |
|||
|
|||
zapret_custom_firewall_nft() |
|||
{ |
|||
# stop logic is not required |
|||
|
|||
# PLACEHOLDER |
|||
echo !!! NEED ATTENTION !!! |
|||
echo Configure nftables for required actions |
|||
echo Study how other sections work |
|||
} |
|||
@ -0,0 +1,42 @@ |
|||
#!/bin/sh |
|||
|
|||
IPSET_DIR="$(dirname "$0")" |
|||
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" |
|||
|
|||
. "$IPSET_DIR/def.sh" |
|||
|
|||
TMPLIST="$TMPDIR/list.txt" |
|||
|
|||
URL="https://github.com/1andrevich/Re-filter-lists/releases/latest/download/domains_all.lst" |
|||
|
|||
dl() |
|||
{ |
|||
# $1 - url |
|||
# $2 - file |
|||
# $3 - minsize |
|||
# $4 - maxsize |
|||
curl -L -H "Accept-Encoding: gzip" -k --fail --max-time 60 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || |
|||
{ |
|||
echo list download failed : $1 |
|||
exit 2 |
|||
} |
|||
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') |
|||
if test $dlsize -lt $3; then |
|||
echo list is too small : $dlsize bytes. can be bad. |
|||
exit 2 |
|||
fi |
|||
zzcat "$TMPLIST" | tr -d '\015' | zz "$2" |
|||
rm -f "$TMPLIST" |
|||
} |
|||
|
|||
# useful in case ipban set is used in custom scripts |
|||
FAIL= |
|||
getipban || FAIL=1 |
|||
"$IPSET_DIR/create_ipset.sh" |
|||
[ -n "$FAIL" ] && exit |
|||
|
|||
dl "$URL" "$ZHOSTLIST" 32768 4194304 |
|||
|
|||
hup_zapret_daemons |
|||
|
|||
exit 0 |
|||
@ -0,0 +1,39 @@ |
|||
#!/bin/sh |
|||
|
|||
IPSET_DIR="$(dirname "$0")" |
|||
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" |
|||
|
|||
. "$IPSET_DIR/def.sh" |
|||
|
|||
TMPLIST="$TMPDIR/list.txt" |
|||
|
|||
URL="https://github.com/1andrevich/Re-filter-lists/releases/latest/download/ipsum.lst" |
|||
|
|||
dl() |
|||
{ |
|||
# $1 - url |
|||
# $2 - file |
|||
# $3 - minsize |
|||
# $4 - maxsize |
|||
curl -L -H "Accept-Encoding: gzip" -k --fail --max-time 60 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || |
|||
{ |
|||
echo list download failed : $1 |
|||
exit 2 |
|||
} |
|||
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') |
|||
if test $dlsize -lt $3; then |
|||
echo list is too small : $dlsize bytes. can be bad. |
|||
exit 2 |
|||
fi |
|||
# remove DOS EOL \r |
|||
zzcat "$TMPLIST" | tr -d '\015' | zz "$2" |
|||
rm -f "$TMPLIST" |
|||
} |
|||
|
|||
getuser && { |
|||
[ "$DISABLE_IPV4" != "1" ] && { |
|||
dl "$URL" "$ZIPLIST" 32768 4194304 |
|||
} |
|||
} |
|||
|
|||
"$IPSET_DIR/create_ipset.sh" |
|||
@ -0,0 +1,195 @@ |
|||
#include <stdio.h> |
|||
#include "ipset.h" |
|||
#include "gzip.h" |
|||
#include "helpers.h" |
|||
|
|||
// inplace tolower() and add to pool
|
|||
static bool addpool(ipset *ips, char **s, const char *end, int *ct) |
|||
{ |
|||
char *p, cidr[128]; |
|||
size_t l; |
|||
struct cidr4 c4; |
|||
struct cidr6 c6; |
|||
|
|||
// advance until eol
|
|||
for (p=*s; p<end && *p && *p!='\r' && *p != '\n'; p++); |
|||
|
|||
// comment line
|
|||
if (!(**s == '#' || **s == ';' || **s == '/' || **s == '\r' || **s == '\n' )) |
|||
{ |
|||
l = p-*s; |
|||
if (l>=sizeof(cidr)) l=sizeof(cidr)-1; |
|||
memcpy(cidr,*s,l); |
|||
cidr[l]=0; |
|||
rtrim(cidr); |
|||
|
|||
if (parse_cidr4(cidr,&c4)) |
|||
{ |
|||
if (!ipset4AddCidr(&ips->ips4, &c4)) |
|||
{ |
|||
ipsetDestroy(ips); |
|||
return false; |
|||
} |
|||
(*ct)++; |
|||
} |
|||
else if (parse_cidr6(cidr,&c6)) |
|||
{ |
|||
if (!ipset6AddCidr(&ips->ips6, &c6)) |
|||
{ |
|||
ipsetDestroy(ips); |
|||
return false; |
|||
} |
|||
(*ct)++; |
|||
} |
|||
else |
|||
DLOG_ERR("bad ip or subnet : %s\n",cidr); |
|||
} |
|||
|
|||
// advance to the next line
|
|||
for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++); |
|||
*s = p; |
|||
return true; |
|||
|
|||
} |
|||
|
|||
static bool AppendIpset(ipset *ips, const char *filename) |
|||
{ |
|||
char *p, *e, s[256], *zbuf; |
|||
size_t zsize; |
|||
int ct = 0; |
|||
FILE *F; |
|||
int r; |
|||
|
|||
DLOG_CONDUP("Loading ipset %s\n",filename); |
|||
|
|||
if (!(F = fopen(filename, "rb"))) |
|||
{ |
|||
DLOG_ERR("Could not open %s\n", filename); |
|||
return false; |
|||
} |
|||
|
|||
if (is_gzip(F)) |
|||
{ |
|||
r = z_readfile(F,&zbuf,&zsize); |
|||
fclose(F); |
|||
if (r==Z_OK) |
|||
{ |
|||
DLOG_CONDUP("zlib compression detected. uncompressed size : %zu\n", zsize); |
|||
|
|||
p = zbuf; |
|||
e = zbuf + zsize; |
|||
while(p<e) |
|||
{ |
|||
if (!addpool(ips,&p,e,&ct)) |
|||
{ |
|||
DLOG_ERR("Not enough memory to store ipset : %s\n", filename); |
|||
free(zbuf); |
|||
return false; |
|||
} |
|||
} |
|||
free(zbuf); |
|||
} |
|||
else |
|||
{ |
|||
DLOG_ERR("zlib decompression failed : result %d\n",r); |
|||
return false; |
|||
} |
|||
} |
|||
else |
|||
{ |
|||
DLOG_CONDUP("loading plain text list\n"); |
|||
|
|||
while (fgets(s, sizeof(s)-1, F)) |
|||
{ |
|||
p = s; |
|||
if (!addpool(ips,&p,p+strlen(p),&ct)) |
|||
{ |
|||
DLOG_ERR("Not enough memory to store ipset : %s\n", filename); |
|||
fclose(F); |
|||
return false; |
|||
} |
|||
} |
|||
fclose(F); |
|||
} |
|||
|
|||
DLOG_CONDUP("Loaded %d ip/subnets from %s\n", ct, filename); |
|||
return true; |
|||
} |
|||
|
|||
static bool LoadIpsets(ipset *ips, struct str_list_head *file_list) |
|||
{ |
|||
struct str_list *file; |
|||
|
|||
ipsetDestroy(ips); |
|||
|
|||
LIST_FOREACH(file, file_list, next) |
|||
{ |
|||
if (!AppendIpset(ips, file->str)) return false; |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
bool LoadIncludeIpsets() |
|||
{ |
|||
struct desync_profile_list *dpl; |
|||
LIST_FOREACH(dpl, ¶ms.desync_profiles, next) |
|||
if (!LoadIpsets(&dpl->dp.ips, &dpl->dp.ipset_files)) |
|||
return false; |
|||
return true; |
|||
} |
|||
bool LoadExcludeIpsets() |
|||
{ |
|||
struct desync_profile_list *dpl; |
|||
LIST_FOREACH(dpl, ¶ms.desync_profiles, next) |
|||
if (!LoadIpsets(&dpl->dp.ips_exclude, &dpl->dp.ipset_exclude_files)) |
|||
return false; |
|||
return true; |
|||
} |
|||
|
|||
bool SearchIpset(const ipset *ips, const struct in_addr *ipv4, const struct in6_addr *ipv6) |
|||
{ |
|||
char s_ip[40]; |
|||
bool bInSet=false; |
|||
|
|||
if (!!ipv4 != !!ipv6) |
|||
{ |
|||
*s_ip=0; |
|||
if (ipv4) |
|||
{ |
|||
if (params.debug) inet_ntop(AF_INET, ipv4, s_ip, sizeof(s_ip)); |
|||
if (ips->ips4) bInSet = ipset4Check(ips->ips4, ipv4, 32); |
|||
} |
|||
if (ipv6) |
|||
{ |
|||
if (params.debug) inet_ntop(AF_INET6, ipv6, s_ip, sizeof(s_ip)); |
|||
if (ips->ips6) bInSet = ipset6Check(ips->ips6, ipv6, 128); |
|||
} |
|||
VPRINT("ipset check for %s : %s\n", s_ip, bInSet ? "positive" : "negative"); |
|||
} |
|||
else |
|||
// ipv4 and ipv6 are both empty or non-empty
|
|||
VPRINT("ipset check error !!!!!!!! ipv4=%p ipv6=%p\n",ipv4,ipv6); |
|||
return bInSet; |
|||
} |
|||
|
|||
static bool IpsetCheck_(const ipset *ips, const ipset *ips_exclude, const struct in_addr *ipv4, const struct in6_addr *ipv6) |
|||
{ |
|||
if (!IPSET_EMPTY(ips_exclude)) |
|||
{ |
|||
VPRINT("exclude "); |
|||
if (SearchIpset(ips_exclude, ipv4, ipv6)) |
|||
return false; |
|||
} |
|||
if (!IPSET_EMPTY(ips)) |
|||
{ |
|||
VPRINT("include "); |
|||
return SearchIpset(ips, ipv4, ipv6); |
|||
} |
|||
return true; |
|||
} |
|||
|
|||
bool IpsetCheck(struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6) |
|||
{ |
|||
if (!PROFILE_IPSETS_EMPTY(dp)) VPRINT("* ipset check for profile %d\n",dp->n); |
|||
return IpsetCheck_(&dp->ips,&dp->ips_exclude,ipv4,ipv6); |
|||
} |
|||
@ -0,0 +1,11 @@ |
|||
#pragma once |
|||
|
|||
#include <stdbool.h> |
|||
#include <arpa/inet.h> |
|||
#include "params.h" |
|||
#include "pools.h" |
|||
|
|||
bool LoadIncludeIpsets(); |
|||
bool LoadExcludeIpsets(); |
|||
bool SearchIpset(const ipset *ips, const struct in_addr *ipv4, const struct in6_addr *ipv6); |
|||
bool IpsetCheck(struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6); |
|||
Loading…
Reference in new issue