|
|
|
@ -31,11 +31,6 @@ TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30" |
|
|
|
# first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case |
|
|
|
TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3" |
|
|
|
|
|
|
|
|
|
|
|
[ -n "$IFACE_WAN" ] && IPT_OWAN="-o $IFACE_WAN" |
|
|
|
[ -n "$IFACE_WAN" ] && IPT_IWAN="-i $IFACE_WAN" |
|
|
|
[ -n "$IFACE_LAN" ] && IPT_ILAN="-i $IFACE_LAN" |
|
|
|
|
|
|
|
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000 |
|
|
|
|
|
|
|
# max wait time for the link local ipv6 on the LAN interface |
|
|
|
@ -72,11 +67,11 @@ on_off_function() |
|
|
|
|
|
|
|
ipt() |
|
|
|
{ |
|
|
|
iptables -C "$@" 2>/dev/null || iptables -I "$@" |
|
|
|
iptables -C "$@" >/dev/null 2>/dev/null || iptables -I "$@" |
|
|
|
} |
|
|
|
ipt_del() |
|
|
|
{ |
|
|
|
iptables -C "$@" 2>/dev/null && iptables -D "$@" |
|
|
|
iptables -C "$@" >/dev/null 2>/dev/null && iptables -D "$@" |
|
|
|
} |
|
|
|
ipt_add_del() |
|
|
|
{ |
|
|
|
@ -84,11 +79,11 @@ ipt_add_del() |
|
|
|
} |
|
|
|
ipt6() |
|
|
|
{ |
|
|
|
ip6tables -C "$@" 2>/dev/null || ip6tables -I "$@" |
|
|
|
ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -I "$@" |
|
|
|
} |
|
|
|
ipt6_del() |
|
|
|
{ |
|
|
|
ip6tables -C "$@" 2>/dev/null && ip6tables -D "$@" |
|
|
|
ip6tables -C "$@" >/dev/null 2>/dev/null && ip6tables -D "$@" |
|
|
|
} |
|
|
|
ipt6_add_del() |
|
|
|
{ |
|
|
|
@ -141,31 +136,39 @@ wait_ifup() |
|
|
|
|
|
|
|
dnat6_target() |
|
|
|
{ |
|
|
|
# $1 - lan network name |
|
|
|
# $2 - var to store target ip6 |
|
|
|
# get target ip address for DNAT. prefer link locals |
|
|
|
# tpws should be as inaccessible from outside as possible |
|
|
|
# link local address can appear not immediately after ifup |
|
|
|
|
|
|
|
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts) |
|
|
|
|
|
|
|
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1 |
|
|
|
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g') |
|
|
|
eval DNAT6_TARGET="\$$DVAR" |
|
|
|
[ -n "$2" ] && eval $2='' |
|
|
|
[ -n "$DNAT6_TARGET" ] || { |
|
|
|
local ct=0 |
|
|
|
while |
|
|
|
DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN) |
|
|
|
DNAT6_TARGET=$(get_ipv6_linklocal $1) |
|
|
|
[ -n "$DNAT6_TARGET" ] && break |
|
|
|
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break |
|
|
|
echo waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ... |
|
|
|
echo $1: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ... |
|
|
|
ct=$(($ct+1)) |
|
|
|
sleep 1 |
|
|
|
do :; done |
|
|
|
|
|
|
|
[ -n "$DNAT6_TARGET" ] || { |
|
|
|
echo no link local. getting global |
|
|
|
DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN) |
|
|
|
echo $1: no link local. getting global |
|
|
|
DNAT6_TARGET=$(get_ipv6_global $1) |
|
|
|
[ -n "$DNAT6_TARGET" ] || { |
|
|
|
echo could not get any address |
|
|
|
echo $1: could not get any address |
|
|
|
DNAT6_TARGET=- |
|
|
|
} |
|
|
|
} |
|
|
|
eval $DVAR="$DNAT6_TARGET" |
|
|
|
} |
|
|
|
[ -n "$2" ] && eval $2="$DNAT6_TARGET" |
|
|
|
} |
|
|
|
|
|
|
|
prepare_tpws_fw4() |
|
|
|
@ -173,26 +176,25 @@ prepare_tpws_fw4() |
|
|
|
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it |
|
|
|
# NOTE : kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8 |
|
|
|
[ -n "$IFACE_LAN" ] && { |
|
|
|
iptables -C INPUT -i $IFACE_LAN -j input_lan_rule_zapret 2>/dev/null || { |
|
|
|
# allow localnet route only to special tpws IP |
|
|
|
iptables -N input_lan_rule_zapret 2>/dev/null |
|
|
|
iptables -F input_lan_rule_zapret |
|
|
|
iptables -A input_lan_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN |
|
|
|
iptables -A input_lan_rule_zapret -d 127.0.0.0/8 -j DROP |
|
|
|
iptables -I INPUT -i $IFACE_LAN -j input_lan_rule_zapret |
|
|
|
} |
|
|
|
sysctl -qw net.ipv4.conf.$IFACE_LAN.route_localnet=1 |
|
|
|
iptables -N input_rule_zapret 2>/dev/null |
|
|
|
iptables -F input_rule_zapret |
|
|
|
iptables -A input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN |
|
|
|
iptables -A input_rule_zapret -d 127.0.0.0/8 -j DROP |
|
|
|
for lan in $IFACE_LAN ; do |
|
|
|
ipt INPUT -i $lan -j input_rule_zapret |
|
|
|
sysctl -qw net.ipv4.conf.$lan.route_localnet=1 |
|
|
|
done |
|
|
|
} |
|
|
|
} |
|
|
|
unprepare_tpws_fw4() |
|
|
|
{ |
|
|
|
[ -n "$IFACE_LAN" ] && { |
|
|
|
iptables -C INPUT -i $IFACE_LAN -j input_lan_rule_zapret 2>/dev/null && { |
|
|
|
sysctl -qw net.ipv4.conf.$IFACE_LAN.route_localnet=0 |
|
|
|
iptables -D INPUT -i $IFACE_LAN -j input_lan_rule_zapret |
|
|
|
iptables -F input_lan_rule_zapret |
|
|
|
iptables -X input_lan_rule_zapret |
|
|
|
} |
|
|
|
for lan in $IFACE_LAN ; do |
|
|
|
ipt_del INPUT -i $lan -j input_rule_zapret |
|
|
|
sysctl -qw net.ipv4.conf.$lan.route_localnet=0 |
|
|
|
done |
|
|
|
iptables -F input_rule_zapret 2>/dev/null |
|
|
|
iptables -X input_rule_zapret 2>/dev/null |
|
|
|
} |
|
|
|
} |
|
|
|
unprepare_tpws_fw() |
|
|
|
@ -218,10 +220,16 @@ fw_tpws4() |
|
|
|
[ "$DISABLE_IPV4" = "1" ] || { |
|
|
|
[ "$1" = 1 ] && prepare_tpws_fw4 |
|
|
|
print_op $1 "$2" "tpws (port $3)" |
|
|
|
[ -n "$IFACE_LAN" ] && { |
|
|
|
ipt_add_del $1 PREROUTING -t nat $IPT_ILAN -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3 |
|
|
|
} |
|
|
|
ipt_add_del $1 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3 |
|
|
|
for lan in $IFACE_LAN ; do |
|
|
|
ipt_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3 |
|
|
|
done |
|
|
|
if [ -n "$IFACE_WAN" ]; then |
|
|
|
for wan in $IFACE_WAN; do |
|
|
|
ipt_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3 |
|
|
|
done |
|
|
|
else |
|
|
|
ipt_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3 |
|
|
|
fi |
|
|
|
} |
|
|
|
} |
|
|
|
fw_tpws6() |
|
|
|
@ -231,11 +239,18 @@ fw_tpws6() |
|
|
|
# $3 - tpws port |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || { |
|
|
|
print_op $1 "$2" "tpws (port $3)" 6 |
|
|
|
[ -n "$IFACE_LAN" ] && { |
|
|
|
dnat6_target |
|
|
|
[ "$DNAT6_TARGET" != "-" ] && ipt6_add_del $1 PREROUTING -t nat $IPT_ILAN -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6_TARGET]:$3 |
|
|
|
} |
|
|
|
ipt6_add_del $1 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3 |
|
|
|
local DNAT6 |
|
|
|
for lan in $IFACE_LAN ; do |
|
|
|
dnat6_target $lan DNAT6 |
|
|
|
[ "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6]:$3 |
|
|
|
done |
|
|
|
if [ -n "$IFACE_WAN" ]; then |
|
|
|
for wan in $IFACE_WAN; do |
|
|
|
ipt6_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3 |
|
|
|
done |
|
|
|
else |
|
|
|
ipt6_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3 |
|
|
|
fi |
|
|
|
} |
|
|
|
} |
|
|
|
fw_tpws() |
|
|
|
@ -256,7 +271,13 @@ fw_nfqws_pre4() |
|
|
|
# $3 - queue number |
|
|
|
[ "$DISABLE_IPV4" = "1" ] || { |
|
|
|
print_op $1 "$2" "nfqws prerouting (qnum $3)" |
|
|
|
ipt_add_del $1 PREROUTING -t mangle $IPT_IWAN -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
if [ -n "$IFACE_WAN" ]; then |
|
|
|
for wan in $IFACE_WAN; do |
|
|
|
ipt_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
done |
|
|
|
else |
|
|
|
ipt_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
fi |
|
|
|
} |
|
|
|
} |
|
|
|
fw_nfqws_pre6() |
|
|
|
@ -266,7 +287,13 @@ fw_nfqws_pre6() |
|
|
|
# $3 - queue number |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || { |
|
|
|
print_op $1 "$2" "nfqws prerouting (qnum $3)" 6 |
|
|
|
ipt6_add_del $1 PREROUTING -t mangle $IPT_IWAN -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
if [ -n "$IFACE_WAN" ]; then |
|
|
|
for wan in $IFACE_WAN; do |
|
|
|
ipt6_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
done |
|
|
|
else |
|
|
|
ipt6_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
fi |
|
|
|
} |
|
|
|
} |
|
|
|
fw_nfqws_pre() |
|
|
|
@ -285,7 +312,13 @@ fw_nfqws_post4() |
|
|
|
# $3 - queue number |
|
|
|
[ "$DISABLE_IPV4" = "1" ] || { |
|
|
|
print_op $1 "$2" "nfqws postrouting (qnum $3)" |
|
|
|
ipt_add_del $1 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
if [ -n "$IFACE_WAN" ]; then |
|
|
|
for wan in $IFACE_WAN; do |
|
|
|
ipt_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
done |
|
|
|
else |
|
|
|
ipt_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
fi |
|
|
|
} |
|
|
|
} |
|
|
|
fw_nfqws_post6() |
|
|
|
@ -295,7 +328,13 @@ fw_nfqws_post6() |
|
|
|
# $3 - queue number |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || { |
|
|
|
print_op $1 "$2" "nfqws postrouting (qnum $3)" 6 |
|
|
|
ipt6_add_del $1 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
if [ -n "$IFACE_WAN" ]; then |
|
|
|
for wan in $IFACE_WAN; do |
|
|
|
ipt6_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
done |
|
|
|
else |
|
|
|
ipt6_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass |
|
|
|
fi |
|
|
|
} |
|
|
|
} |
|
|
|
fw_nfqws_post() |
|
|
|
@ -385,11 +424,30 @@ do_tpws() |
|
|
|
[ "$DISABLE_IPV4" = "1" ] || OPT="$OPT $TPWS_OPT_BASE4" |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || { |
|
|
|
OPT="$OPT $TPWS_OPT_BASE6" |
|
|
|
[ -n "$IFACE_LAN" ] && OPT="$OPT --bind-iface6=$IFACE_LAN $TPWS_OPT_BASE6_PRE" |
|
|
|
for lan in $IFACE_LAN; do |
|
|
|
OPT="$OPT --bind-iface6=$lan $TPWS_OPT_BASE6_PRE" |
|
|
|
done |
|
|
|
} |
|
|
|
|
|
|
|
do_daemon $1 $2 "$TPWS" "$OPT $3" |
|
|
|
} |
|
|
|
do_tpws_socks() |
|
|
|
{ |
|
|
|
# $1 : 1 - run, 0 - stop |
|
|
|
# $2 : daemon number |
|
|
|
# $3 : daemon args |
|
|
|
|
|
|
|
[ "$1" = "1" ] && prepare_user |
|
|
|
|
|
|
|
[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0 |
|
|
|
|
|
|
|
local opt="$TPWS_OPT_BASE --socks" |
|
|
|
|
|
|
|
tpws_apply_socks_binds opt |
|
|
|
|
|
|
|
do_daemon $1 $2 "$TPWS" "$opt $3" |
|
|
|
} |
|
|
|
|
|
|
|
do_nfqws() |
|
|
|
{ |
|
|
|
# $1 : 1 - run, 0 - stop |
|
|
|
@ -434,14 +492,13 @@ tpws_apply_socks_binds() |
|
|
|
{ |
|
|
|
local o |
|
|
|
|
|
|
|
[ "$DISABLE_IPV4" = "1" ] || { |
|
|
|
o="--bind-addr=127.0.0.1" |
|
|
|
[ -n "$IFACE_LAN" ] && o="$o --bind-iface4=$IFACE_LAN $TPWS_WAIT" |
|
|
|
} |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || { |
|
|
|
o="$o --bind-addr=::1" |
|
|
|
[ -n "$IFACE_LAN" ] && o="$o --bind-iface6=$IFACE_LAN --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6" |
|
|
|
} |
|
|
|
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1" |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-addr=::1" |
|
|
|
|
|
|
|
for lan in $IFACE_LAN; do |
|
|
|
[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT" |
|
|
|
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6" |
|
|
|
done |
|
|
|
eval $1="\"\$$1 $o\"" |
|
|
|
} |
|
|
|
|
|
|
|
@ -535,10 +592,9 @@ zapret_do_daemons() |
|
|
|
do_tpws $1 1 "$opt" |
|
|
|
;; |
|
|
|
tpws-socks) |
|
|
|
opt="--port=$TPPORT $TPWS_OPT_BASE --socks $TPWS_OPT" |
|
|
|
tpws_apply_socks_binds opt |
|
|
|
opt="--port=$TPPORT $TPWS_OPT" |
|
|
|
filter_apply_hostlist_target opt |
|
|
|
do_daemon $1 1 "$TPWS" "$opt" |
|
|
|
do_tpws_socks $1 1 "$opt" |
|
|
|
;; |
|
|
|
nfqws) |
|
|
|
opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTP" |
|
|
|
|
bol-van
4 years ago