gsd
/
zapret
mirror of https://github.com/bol-van/zapret/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

`shellcheck` linting and formatting shell scripts

pull/400/head
conc3rned 2 years ago
parent
c1db09b19e
commit
a13e4e064f
58 changed files with 2789 additions and 3326 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 786
      blockcheck.sh
  2. 158
      common/base.sh
  3. 26
      common/dialog.sh
  4. 3
      common/elevate.sh
  5. 17
      common/fwtype.sh
  6. 231
      common/installer.sh
  7. 239
      common/ipt.sh
  8. 19
      common/linux_fw.sh
  9. 64
      common/linux_iphelper.sh
  10. 19
      common/list.sh
  11. 374
      common/nft.sh
  12. 56
      common/pf.sh
  13. 45
      common/queue.sh
  14. 6
      common/virt.sh
  15. 11
      init.d/macos/custom-tpws
  16. 9
      init.d/macos/custom.default
  17. 84
      init.d/macos/functions
  18. 5
      init.d/macos/zapret
  19. 38
      init.d/openrc/zapret
  20. 15
      init.d/openwrt/90-zapret
  21. 15
      init.d/openwrt/custom-nfqws-dht4all
  22. 15
      init.d/openwrt/custom-nfqws-quic4all
  23. 13
      init.d/openwrt/custom-reuse-builtin-mode
  24. 21
      init.d/openwrt/custom-tpws4http-nfqws4https
  25. 9
      init.d/openwrt/custom.default
  26. 199
      init.d/openwrt/functions
  27. 78
      init.d/openwrt/zapret
  28. 3
      init.d/pfsense/zapret.sh
  29. 18
      init.d/sysv/custom-nfqws-dht4all
  30. 17
      init.d/sysv/custom-nfqws-quic4all
  31. 17
      init.d/sysv/custom-reuse-builtin-mode
  32. 25
      init.d/sysv/custom-tpws4http-nfqws4https
  33. 11
      init.d/sysv/custom.default
  34. 172
      init.d/sysv/functions
  35. 6
      init.d/sysv/zapret
  36. 36
      install_bin.sh
  37. 210
      install_easy.sh
  38. 9
      install_prereq.sh
  39. 5
      ipset/clear_lists.sh
  40. 142
      ipset/create_ipset.sh
  41. 91
      ipset/def.sh
  42. 5
      ipset/get_antifilter_allyouneed.sh
  43. 5
      ipset/get_antifilter_ip.sh
  44. 5
      ipset/get_antifilter_ipresolve.sh
  45. 5
      ipset/get_antifilter_ipsmart.sh
  46. 5
      ipset/get_antifilter_ipsum.sh
  47. 8
      ipset/get_antizapret_domains.sh
  48. 5
      ipset/get_config.sh
  49. 5
      ipset/get_exclude.sh
  50. 5
      ipset/get_ipban.sh
  51. 29
      ipset/get_reestr_hostlist.sh
  52. 16
      ipset/get_reestr_preresolved.sh
  53. 16
      ipset/get_reestr_preresolved_smart.sh
  54. 16
      ipset/get_reestr_resolvable_domains.sh
  55. 24
      ipset/get_reestr_resolve.sh
  56. 5
      ipset/get_user.sh
  57. 22
      uninstall_easy.sh

786
blockcheck.sh
View File

File diff suppressed because it is too large

158
common/base.sh
View File

@ -1,5 +1,4 @@
which() which() {
{
# on some systems 'which' command is considered deprecated and not installed by default # on some systems 'which' command is considered deprecated and not installed by default
# 'command -v' replacement does not work exactly the same way. it outputs shell aliases if present # 'command -v' replacement does not work exactly the same way. it outputs shell aliases if present
# $1 - executable name # $1 - executable name
@ -12,28 +11,23 @@ which()
done done
return 1 return 1
} }
exists() exists() {
{
which "$1" >/dev/null 2>/dev/null which "$1" >/dev/null 2>/dev/null
} }
existf() existf() {
{
type "$1" >/dev/null 2>/dev/null type "$1" >/dev/null 2>/dev/null
} }
whichq() whichq() {
{ which "$1" 2>/dev/null
which $1 2>/dev/null
} }
exist_all() exist_all() {
{
while [ -n "$1" ]; do while [ -n "$1" ]; do
exists "$1" || return 1 exists "$1" || return 1
shift shift
done done
return 0 return 0
} }
on_off_function() on_off_function() {
{
# $1: function name on # $1: function name on
# $2: function name off # $2: function name off
# $3: 0 - off, 1 - on # $3: 0 - off, 1 - on
@ -44,13 +38,11 @@ on_off_function()
shift shift
"$F" "$@" "$F" "$@"
} }
contains() contains() {
{
# check if substring $2 contains in $1 # check if substring $2 contains in $1
[ "${1#*$2}" != "$1" ] [ "${1#*$2}" != "$1" ]
} }
starts_with() starts_with() {
{
# $1: what # $1: what
# $2: starts with # $2: starts with
case "$1" in case "$1" in
@ -60,8 +52,7 @@ starts_with()
esac esac
return 1 return 1
} }
find_str_in_list() find_str_in_list() {
{
[ -n "$1" ] && { [ -n "$1" ] && {
for v in $2; do for v in $2; do
[ "$v" = "$1" ] && return 0 [ "$v" = "$1" ] && return 0
@ -69,14 +60,12 @@ find_str_in_list()
} }
return 1 return 1
} }
end_with_newline() end_with_newline() {
{
local c="$(tail -c 1)" local c="$(tail -c 1)"
[ "$c" = "" ] [ "$c" = "" ]
} }
append_separator_list() append_separator_list() {
{
# $1 - var name to receive result # $1 - var name to receive result
# $2 - separator # $2 - separator
# $3 - quoter # $3 - quoter
@ -84,7 +73,9 @@ append_separator_list()
local _var="$1" sep="$2" quo="$3" i local _var="$1" sep="$2" quo="$3" i
eval i="\$$_var" eval i="\$$_var"
shift; shift; shift shift
shift
shift
while [ -n "$1" ]; do while [ -n "$1" ]; do
if [ -n "$i" ]; then if [ -n "$i" ]; then
i="$i$sep$quo$1$quo" i="$i$sep$quo$1$quo"
@ -93,64 +84,56 @@ append_separator_list()
fi fi
shift shift
done done
eval $_var="\$i" eval "$_var"="\$i"
} }
make_separator_list() make_separator_list() {
{ eval "$1"=''
eval $1=''
append_separator_list "$@" append_separator_list "$@"
} }
make_comma_list() make_comma_list() {
{
# $1 - var name to receive result # $1 - var name to receive result
# $2,$3,... - elements # $2,$3,... - elements
local var="$1" local var="$1"
shift shift
make_separator_list $var , '' "$@" make_separator_list "$var" , '' "$@"
} }
make_quoted_comma_list() make_quoted_comma_list() {
{
# $1 - var name to receive result # $1 - var name to receive result
# $2,$3,... - elements # $2,$3,... - elements
local var="$1" local var="$1"
shift shift
make_separator_list $var , '"' "$@" make_separator_list "$var" , '"' "$@"
} }
unique() unique() {
{
local i local i
for i in "$@"; do echo $i; done | sort -u | xargs for i in "$@"; do echo "$i"; done | sort -u | xargs
} }
is_linked_to_busybox() is_linked_to_busybox() {
{
local IFS F P local IFS F P
IFS=: IFS=:
for path in $PATH; do for path in $PATH; do
F=$path/$1 F=$path/$1
P="$(readlink $F)" P="$(readlink "$F")"
if [ -z "$P" ] && [ -x $F ] && [ ! -L $F ]; then return 1; fi if [ -z "$P" ] && [ -x "$F" ] && [ ! -L "$F" ]; then return 1; fi
[ "${P%busybox*}" != "$P" ] && return [ "${P%busybox*}" != "$P" ] && return
done done
} }
get_dir_inode() get_dir_inode() {
{
local dir="$1" local dir="$1"
[ -L "$dir" ] && dir=$(readlink "$dir") [ -L "$dir" ] && dir=$(readlink "$dir")
ls -id "$dir" | awk '{print $1}' ls -id "$dir" | awk '{print $1}'
} }
linux_min_version() linux_min_version() {
{
# $1 - major ver # $1 - major ver
# $2 - minor ver # $2 - minor ver
local V1=$(sed -nre 's/^Linux version ([0-9]+)\.[0-9]+.*$/\1/p' /proc/version) local V1=$(sed -nre 's/^Linux version ([0-9]+)\.[0-9]+.*$/\1/p' /proc/version)
local V2=$(sed -nre 's/^Linux version [0-9]+\.([0-9]+).*$/\1/p' /proc/version) local V2=$(sed -nre 's/^Linux version [0-9]+\.([0-9]+).*$/\1/p' /proc/version)
[ -n "$V1" -a -n "$V2" ] && [ "$V1" -gt "$1" -o "$V1" -eq "$1" -a "$V2" -ge "$2" ] [ -n "$V1" -a -n "$V2" ] && [ "$V1" -gt "$1" -o "$V1" -eq "$1" -a "$V2" -ge "$2" ]
} }
linux_get_subsys() linux_get_subsys() {
{
local INIT="$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)" local INIT="$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)"
[ -L "$INIT" ] && INIT=$(readlink "$INIT") [ -L "$INIT" ] && INIT=$(readlink "$INIT")
@ -164,33 +147,28 @@ linux_get_subsys()
SUBSYS= SUBSYS=
fi fi
} }
openwrt_fw3() openwrt_fw3() {
{
[ ! -x /sbin/fw4 -a -x /sbin/fw3 ] [ ! -x /sbin/fw4 -a -x /sbin/fw3 ]
} }
openwrt_fw4() openwrt_fw4() {
{
[ -x /sbin/fw4 ] [ -x /sbin/fw4 ]
} }
openwrt_fw3_integration() openwrt_fw3_integration() {
{
[ "$FWTYPE" = iptables ] && openwrt_fw3 [ "$FWTYPE" = iptables ] && openwrt_fw3
} }
create_dev_stdin() create_dev_stdin() {
{
[ -e /dev/stdin ] || ln -s /proc/self/fd/0 /dev/stdin [ -e /dev/stdin ] || ln -s /proc/self/fd/0 /dev/stdin
} }
call_for_multiple_items() call_for_multiple_items() {
{
# $1 - function to get an item # $1 - function to get an item
# $2 - variable name to put result into # $2 - variable name to put result into
# $3 - space separated parameters to function $1 # $3 - space separated parameters to function $1
local i item items local i item items
for i in $3; do for i in $3; do
$1 item $i $1 item "$i"
[ -n "$item" ] && { [ -n "$item" ] && {
if [ -n "$items" ]; then if [ -n "$items" ]; then
items="$items $item" items="$items $item"
@ -199,25 +177,22 @@ call_for_multiple_items()
fi fi
} }
done done
eval $2=\"$items\" eval "$2"=\""$items"\"
} }
fix_sbin_path() fix_sbin_path() {
{
local IFS=':' local IFS=':'
printf "%s\n" $PATH | grep -Fxq '/usr/sbin' || PATH="/usr/sbin:$PATH" printf "%s\n" "$PATH" | grep -Fxq '/usr/sbin' || PATH="/usr/sbin:$PATH"
printf "%s\n" $PATH | grep -Fxq '/sbin' || PATH="/sbin:$PATH" printf "%s\n" "$PATH" | grep -Fxq '/sbin' || PATH="/sbin:$PATH"
export PATH export PATH
} }
# it can calculate floating point expr # it can calculate floating point expr
calc() calc() {
{ awk "BEGIN { print $*}"
awk "BEGIN { print $*}";
} }
fsleep_setup() fsleep_setup() {
{
[ -n "$FSLEEP" ] || { [ -n "$FSLEEP" ] || {
if sleep 0.001 2>/dev/null; then if sleep 0.001 2>/dev/null; then
FSLEEP=1 FSLEEP=1
@ -227,10 +202,10 @@ fsleep_setup()
local errtext="$(read -t 0.001 2>&1)" local errtext="$(read -t 0.001 2>&1)"
if [ -z "$errtext" ]; then if [ -z "$errtext" ]; then
FSLEEP=3 FSLEEP=3
# newer openwrt has ucode with system function that supports timeout in ms # newer OpenWrt has ucode with system function that supports timeout in ms
elif ucode -e "system(['sleep','1'], 1)" 2>/dev/null; then elif ucode -e "system(['sleep','1'], 1)" 2>/dev/null; then
FSLEEP=4 FSLEEP=4
# older openwrt may have lua and nixio lua module # older OpenWrt may have lua and nixio lua module
elif lua -e 'require "nixio".nanosleep(0,1)' 2>/dev/null; then elif lua -e 'require "nixio".nanosleep(0,1)' 2>/dev/null; then
FSLEEP=5 FSLEEP=5
else else
@ -239,51 +214,48 @@ fsleep_setup()
fi fi
} }
} }
msleep() msleep() {
{
# $1 - milliseconds # $1 - milliseconds
case "$FSLEEP" in case "$FSLEEP" in
1) 1)
sleep $(calc $1/1000) sleep $(calc "$1"/1000)
;; ;;
2) 2)
busybox usleep $(calc $1*1000) busybox usleep $(calc "$1"*1000)
;; ;;
3) 3)
read -t $(calc $1/1000) read -t $(calc "$1"/1000)
;; ;;
4) 4)
ucode -e "system(['sleep','2147483647'], $1)" ucode -e "system(['sleep','2147483647'], $1)"
;; ;;
5) 5)
lua -e "require 'nixio'.nanosleep($(($1/1000)),$(calc $1%1000*1000000))" lua -e "require 'nixio'.nanosleep($(($1 / 1000)),$(calc "$1"%1000*1000000))"
;; ;;
*) *)
sleep $((($1 + 999) / 1000)) sleep $((($1 + 999) / 1000))
;;
esac esac
} }
minsleep() minsleep() {
{
msleep 100 msleep 100
} }
replace_char() replace_char() {
{
local a=$1 local a=$1
local b=$2 local b=$2
shift; shift shift
echo "$@" | tr $a $b shift
echo "$@" | tr "$a" "$b"
} }
setup_md5() setup_md5() {
{
[ -n "$MD5" ] && return [ -n "$MD5" ] && return
MD5=md5sum MD5=md5sum
exists $MD5 || MD5=md5 exists $MD5 || MD5=md5
} }
random() random() {
{
# $1 - min, $2 - max # $1 - min, $2 - max
local r rs local r rs
setup_md5 setup_md5
@ -293,12 +265,11 @@ random()
rs="$RANDOM$RANDOM$(date)" rs="$RANDOM$RANDOM$(date)"
fi fi
# shells use signed int64 # shells use signed int64
r=1$(echo $rs | $MD5 | sed 's/[^0-9]//g' | cut -c 1-17) r=1$(echo "$rs" | $MD5 | sed 's/[^0-9]//g' | cut -c 1-17)
echo $((($r % ($2 - $1 + 1)) + $1)) echo $((($r % ($2 - $1 + 1)) + $1))
} }
shell_name() shell_name() {
{
[ -n "$SHELL_NAME" ] || { [ -n "$SHELL_NAME" ] || {
[ -n "$UNAME" ] || UNAME="$(uname)" [ -n "$UNAME" ] || UNAME="$(uname)"
@ -313,12 +284,11 @@ shell_name()
} }
} }
std_ports() std_ports() {
{
HTTP_PORTS=${HTTP_PORTS:-80} HTTP_PORTS=${HTTP_PORTS:-80}
HTTPS_PORTS=${HTTPS_PORTS:-443} HTTPS_PORTS=${HTTPS_PORTS:-443}
QUIC_PORTS=${QUIC_PORTS:-443} QUIC_PORTS=${QUIC_PORTS:-443}
HTTP_PORTS_IPT=$(replace_char - : $HTTP_PORTS) HTTP_PORTS_IPT=$(replace_char - : "$HTTP_PORTS")
HTTPS_PORTS_IPT=$(replace_char - : $HTTPS_PORTS) HTTPS_PORTS_IPT=$(replace_char - : "$HTTPS_PORTS")
QUIC_PORTS_IPT=$(replace_char - : $QUIC_PORTS) QUIC_PORTS_IPT=$(replace_char - : "$QUIC_PORTS")
} }

26
common/dialog.sh
View File

@ -1,13 +1,11 @@
read_yes_no() read_yes_no() {
{
# $1 - default (Y/N) # $1 - default (Y/N)
local A local A
read A read A
[ -z "$A" ] || ([ "$A" != "Y" ] && [ "$A" != "y" ] && [ "$A" != "N" ] && [ "$A" != "n" ]) && A=$1 [ -z "$A" ] || ([ "$A" != "Y" ] && [ "$A" != "y" ] && [ "$A" != "N" ] && [ "$A" != "n" ]) && A=$1
[ "$A" = "Y" ] || [ "$A" = "y" ] || [ "$A" = "1" ] [ "$A" = "Y" ] || [ "$A" = "y" ] || [ "$A" = "1" ]
} }
ask_yes_no() ask_yes_no() {
{
# $1 - default (Y/N or 0/1) # $1 - default (Y/N or 0/1)
# $2 - text # $2 - text
local DEFAULT=$1 local DEFAULT=$1
@ -15,22 +13,20 @@ ask_yes_no()
[ "$1" = "0" ] && DEFAULT=N [ "$1" = "0" ] && DEFAULT=N
[ -z "$DEFAULT" ] && DEFAULT=N [ -z "$DEFAULT" ] && DEFAULT=N
printf "$2 (default: $DEFAULT) (Y/N)?" printf "$2 (default: $DEFAULT) (Y/N)?"
read_yes_no $DEFAULT read_yes_no "$DEFAULT"
} }
ask_yes_no_var() ask_yes_no_var() {
{
# $1 - variable name for answer: 0/1 # $1 - variable name for answer: 0/1
# $2 - text # $2 - text
local DEFAULT local DEFAULT
eval DEFAULT="\$$1" eval DEFAULT="\$$1"
if ask_yes_no "$DEFAULT" "$2"; then if ask_yes_no "$DEFAULT" "$2"; then
eval $1=1 eval "$1"=1
else else
eval $1=0 eval "$1"=0
fi fi
} }
ask_list() ask_list() {
{
# $1 - mode var # $1 - mode var
# $2 - space separated value list # $2 - space separated value list
# $3 - (optional) default value # $3 - (optional) default value
@ -44,15 +40,15 @@ ask_list()
n=1 n=1
for m in $2; do for m in $2; do
echo $n : $m echo $n: "$m"
n=$(($n + 1)) n=$(($n + 1))
done done
printf "your choice (default : $M_DEFAULT) : " printf "your choice (default : $M_DEFAULT) : "
read m read m
[ -n "$m" ] && M=$(echo $2 | cut -d ' ' -f$m 2>/dev/null) [ -n "$m" ] && M=$(echo "$2" | cut -d ' ' -f"$m" 2>/dev/null)
[ -z "$M" ] && M="$M_DEFAULT" [ -z "$M" ] && M="$M_DEFAULT"
echo selected : $M echo selected: "$M"
eval $1="\"$M\"" eval "$1"="\"$M\""
[ "$M" != "$M_OLD" ] [ "$M" != "$M_OLD" ]
} }

3
common/elevate.sh
View File

@ -1,5 +1,4 @@
require_root() require_root() {
{
local exe local exe
echo \* checking privileges echo \* checking privileges
[ $(id -u) -ne "0" ] && { [ $(id -u) -ne "0" ] && {

17
common/fwtype.sh
View File

@ -1,24 +1,20 @@
linux_ipt_avail() linux_ipt_avail() {
{
exists iptables && exists ip6tables exists iptables && exists ip6tables
} }
linux_maybe_iptables_fwtype() linux_maybe_iptables_fwtype() {
{
linux_ipt_avail && FWTYPE=iptables linux_ipt_avail && FWTYPE=iptables
} }
linux_nft_avail() linux_nft_avail() {
{
exists nft exists nft
} }
linux_fwtype() linux_fwtype() {
{
[ -n "$FWTYPE" ] && return [ -n "$FWTYPE" ] && return
FWTYPE=unsupported FWTYPE=unsupported
linux_get_subsys linux_get_subsys
if [ "$SUBSYS" = openwrt ]; then if [ "$SUBSYS" = openwrt ]; then
# linux kernel is new enough if fw4 is there # Linux kernel is new enough if fw4 is there
if [ -x /sbin/fw4 ] && linux_nft_avail; then if [ -x /sbin/fw4 ] && linux_nft_avail; then
FWTYPE=nftables FWTYPE=nftables
else else
@ -38,8 +34,7 @@ linux_fwtype()
export FWTYPE export FWTYPE
} }
get_fwtype() get_fwtype() {
{
[ -n "$FWTYPE" ] && return [ -n "$FWTYPE" ] && return
local UNAME="$(uname)" local UNAME="$(uname)"

231
common/installer.sh
View File

@ -6,36 +6,31 @@ SYSTEMD_DIR=/lib/systemd
INIT_SCRIPT=/etc/init.d/zapret INIT_SCRIPT=/etc/init.d/zapret
exitp() {
exitp()
{
echo echo
echo press enter to continue echo press enter to continue
read A read A
exit $1 exit "$1"
} }
parse_var_checked() parse_var_checked() {
{
# $1 - file name # $1 - file name
# $2 - var name # $2 - var name
local sed="sed -nre s/^[[:space:]]*$2=[\\\"|\']?([^\\\"|\']*)[\\\"|\']?/\1/p" local sed="sed -nre s/^[[:space:]]*$2=[\\\"|\']?([^\\\"|\']*)[\\\"|\']?/\1/p"
local v="$($sed <"$1" | tail -n 1)" local v="$($sed <"$1" | tail -n 1)"
eval $2=\"$v\" eval "$2"=\""$v"\"
} }
parse_vars_checked() parse_vars_checked() {
{
# $1 - file name # $1 - file name
# $2,$3,... - var names # $2,$3,... - var names
local f="$1" local f="$1"
shift shift
while [ -n "$1" ]; do while [ -n "$1" ]; do
parse_var_checked "$f" $1 parse_var_checked "$f" "$1"
shift shift
done done
} }
edit_file() edit_file() {
{
# $1 - file name # $1 - file name
local ed="$EDITOR" local ed="$EDITOR"
[ -n "$ed" ] || { [ -n "$ed" ] || {
@ -48,8 +43,7 @@ edit_file()
} }
[ -n "$ed" ] && "$ed" "$1" [ -n "$ed" ] && "$ed" "$1"
} }
edit_vars() edit_vars() {
{
# $1,$2,... - var names # $1,$2,... - var names
local n=1 var v tmp="/tmp/zvars" local n=1 var v tmp="/tmp/zvars"
rm -f "$tmp" rm -f "$tmp"
@ -57,21 +51,19 @@ edit_vars()
eval var="\$$n" eval var="\$$n"
[ -n "$var" ] || break [ -n "$var" ] || break
eval v="\$$var" eval v="\$$var"
echo $var=\"$v\" >>"$tmp" echo "$var"=\""$v"\" >>"$tmp"
n=$(($n + 1)) n=$(($n + 1))
done done
edit_file "$tmp" && parse_vars_checked "$tmp" "$@" edit_file "$tmp" && parse_vars_checked "$tmp" "$@"
rm -f "$tmp" rm -f "$tmp"
} }
openrc_test() openrc_test() {
{
exists rc-update || return 1 exists rc-update || return 1
# some systems do not usse openrc-init but launch openrc from inittab # some systems do not usse openrc-init but launch openrc from inittab
[ "$INIT" = "openrc-init" ] || grep -qE "sysinit.*openrc" /etc/inittab 2>/dev/null [ "$INIT" = "openrc-init" ] || grep -qE "sysinit.*openrc" /etc/inittab 2>/dev/null
} }
check_system() check_system() {
{
# $1 - nonempty = do not fail on unknown rc system # $1 - nonempty = do not fail on unknown rc system
echo \* checking system echo \* checking system
@ -128,25 +120,21 @@ check_system()
exitp 5 exitp 5
fi fi
echo system is based on $SYSTEM echo system is based on $SYSTEM
[ -n "$info" ] && echo $info [ -n "$info" ] && echo "$info"
} }
get_free_space_mb() get_free_space_mb() {
{ df -m "$PWD" | awk '/[0-9]%/{print $(NF-2)}'
df -m $PWD | awk '/[0-9]%/{print $(NF-2)}'
} }
get_ram_kb() get_ram_kb() {
{
grep MemTotal /proc/meminfo | awk '{print $2}' grep MemTotal /proc/meminfo | awk '{print $2}'
} }
get_ram_mb() get_ram_mb() {
{
local R=$(get_ram_kb) local R=$(get_ram_kb)
echo $(($R / 1024)) echo $(($R / 1024))
} }
crontab_del() crontab_del() {
{
exists crontab || return exists crontab || return
echo \* removing crontab entry echo \* removing crontab entry
@ -162,8 +150,7 @@ crontab_del()
fi fi
rm -f $CRONTMP rm -f $CRONTMP
} }
crontab_del_quiet() crontab_del_quiet() {
{
exists crontab || return exists crontab || return
CRONTMP=/tmp/cron.tmp CRONTMP=/tmp/cron.tmp
@ -175,8 +162,7 @@ crontab_del_quiet()
fi fi
rm -f $CRONTMP rm -f $CRONTMP
} }
crontab_add() crontab_add() {
{
# $1 - hour min # $1 - hour min
# $2 - hour max # $2 - hour max
[ -x "$GET_LIST" ] && { [ -x "$GET_LIST" ] && {
@ -190,7 +176,7 @@ crontab_add()
grep "$GET_LIST_PREFIX" $CRONTMP grep "$GET_LIST_PREFIX" $CRONTMP
else else
end_with_newline <"$CRONTMP" || echo >>"$CRONTMP" end_with_newline <"$CRONTMP" || echo >>"$CRONTMP"
echo "$(random 0 59) $(random $1 $2) */2 * * $GET_LIST" >>$CRONTMP echo "$(random 0 59) $(random "$1" "$2") */2 * * $GET_LIST" >>$CRONTMP
crontab $CRONTMP crontab $CRONTMP
fi fi
rm -f $CRONTMP rm -f $CRONTMP
@ -199,18 +185,15 @@ crontab_add()
fi fi
} }
} }
cron_ensure_running() cron_ensure_running() {
{ # if no crontabs present in /etc/cron OpenWrt init script does not launch crond. this is default
# if no crontabs present in /etc/cron openwrt init script does not launch crond. this is default
[ "$SYSTEM" = "openwrt" ] && { [ "$SYSTEM" = "openwrt" ] && {
/etc/init.d/cron enable /etc/init.d/cron enable
/etc/init.d/cron start /etc/init.d/cron start
} }
} }
service_start_systemd() {
service_start_systemd()
{
echo \* starting zapret service echo \* starting zapret service
"$SYSTEMCTL" start zapret || { "$SYSTEMCTL" start zapret || {
@ -218,23 +201,20 @@ service_start_systemd()
exitp 30 exitp 30
} }
} }
service_stop_systemd() service_stop_systemd() {
{
echo \* stopping zapret service echo \* stopping zapret service
"$SYSTEMCTL" daemon-reload "$SYSTEMCTL" daemon-reload
"$SYSTEMCTL" disable zapret "$SYSTEMCTL" disable zapret
"$SYSTEMCTL" stop zapret "$SYSTEMCTL" stop zapret
} }
service_remove_systemd() service_remove_systemd() {
{
echo \* removing zapret service echo \* removing zapret service
rm -f "$SYSTEMD_SYSTEM_DIR/zapret.service" rm -f "$SYSTEMD_SYSTEM_DIR/zapret.service"
"$SYSTEMCTL" daemon-reload "$SYSTEMCTL" daemon-reload
} }
timer_remove_systemd() timer_remove_systemd() {
{
echo \* removing zapret-list-update timer echo \* removing zapret-list-update timer
"$SYSTEMCTL" daemon-reload "$SYSTEMCTL" daemon-reload
@ -244,8 +224,7 @@ timer_remove_systemd()
"$SYSTEMCTL" daemon-reload "$SYSTEMCTL" daemon-reload
} }
install_sysv_init() install_sysv_init() {
{
# $1 - "0"=disable # $1 - "0"=disable
echo \* installing init script echo \* installing init script
@ -256,8 +235,7 @@ install_sysv_init()
ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT" ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT"
[ "$1" != "0" ] && "$INIT_SCRIPT" enable [ "$1" != "0" ] && "$INIT_SCRIPT" enable
} }
install_openrc_init() install_openrc_init() {
{
# $1 - "0"=disable # $1 - "0"=disable
echo \* installing init script echo \* installing init script
@ -268,8 +246,7 @@ install_openrc_init()
ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT" ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT"
[ "$1" != "0" ] && rc-update add zapret [ "$1" != "0" ] && rc-update add zapret
} }
service_remove_openrc() service_remove_openrc() {
{
echo \* removing zapret service echo \* removing zapret service
[ -x "$INIT_SCRIPT" ] && { [ -x "$INIT_SCRIPT" ] && {
@ -278,8 +255,7 @@ service_remove_openrc()
} }
rm -f "$INIT_SCRIPT" rm -f "$INIT_SCRIPT"
} }
service_start_sysv() service_start_sysv() {
{
[ -x "$INIT_SCRIPT" ] && { [ -x "$INIT_SCRIPT" ] && {
echo \* starting zapret service echo \* starting zapret service
"$INIT_SCRIPT" start || { "$INIT_SCRIPT" start || {
@ -288,15 +264,13 @@ service_start_sysv()
} }
} }
} }
service_stop_sysv() service_stop_sysv() {
{
[ -x "$INIT_SCRIPT" ] && { [ -x "$INIT_SCRIPT" ] && {
echo \* stopping zapret service echo \* stopping zapret service
"$INIT_SCRIPT" stop "$INIT_SCRIPT" stop
} }
} }
service_remove_sysv() service_remove_sysv() {
{
echo \* removing zapret service echo \* removing zapret service
[ -x "$INIT_SCRIPT" ] && { [ -x "$INIT_SCRIPT" ] && {
@ -306,48 +280,40 @@ service_remove_sysv()
rm -f "$INIT_SCRIPT" rm -f "$INIT_SCRIPT"
} }
check_kmod() check_kmod() {
{
[ -f "/lib/modules/$(uname -r)/$1.ko" ] [ -f "/lib/modules/$(uname -r)/$1.ko" ]
} }
check_package_exists_openwrt() check_package_exists_openwrt() {
{ [ -n "$(opkg list "$1")" ]
[ -n "$(opkg list $1)" ]
} }
check_package_openwrt() check_package_openwrt() {
{ [ -n "$(opkg list-installed "$1")" ] && return 0
[ -n "$(opkg list-installed $1)" ] && return 0 local what="$(opkg whatprovides "$1" | tail -n +2 | head -n 1)"
local what="$(opkg whatprovides $1 | tail -n +2 | head -n 1)"
[ -n "$what" ] || return 1 [ -n "$what" ] || return 1
[ -n "$(opkg list-installed $what)" ] [ -n "$(opkg list-installed "$what")" ]
} }
check_packages_openwrt() check_packages_openwrt() {
{
for pkg in $@; do for pkg in $@; do
check_package_openwrt $pkg || return check_package_openwrt "$pkg" || return
done done
} }
install_openwrt_iface_hook() install_openwrt_iface_hook() {
{
echo \* installing ifup hook echo \* installing ifup hook
ln -fs "$OPENWRT_IFACE_HOOK" /etc/hotplug.d/iface ln -fs "$OPENWRT_IFACE_HOOK" /etc/hotplug.d/iface
} }
remove_openwrt_iface_hook() remove_openwrt_iface_hook() {
{
echo \* removing ifup hook echo \* removing ifup hook
rm -f /etc/hotplug.d/iface/??-zapret rm -f /etc/hotplug.d/iface/??-zapret
} }
openwrt_fw_section_find() openwrt_fw_section_find() {
{
# $1 - fw include postfix # $1 - fw include postfix
# echoes section number # echoes section number
i=0 i=0
while true while true; do
do
path=$(uci -q get firewall.@include[$i].path) path=$(uci -q get firewall.@include[$i].path)
[ -n "$path" ] || break [ -n "$path" ] || break
[ "$path" = "$OPENWRT_FW_INCLUDE$1" ] && { [ "$path" = "$OPENWRT_FW_INCLUDE$1" ] && {
@ -358,52 +324,47 @@ openwrt_fw_section_find()
done done
return 1 return 1
} }
openwrt_fw_section_del() openwrt_fw_section_del() {
{
# $1 - fw include postfix # $1 - fw include postfix
local id="$(openwrt_fw_section_find $1)" local id="$(openwrt_fw_section_find "$1")"
[ -n "$id" ] && { [ -n "$id" ] && {
uci delete firewall.@include[$id] && uci commit firewall uci delete firewall.@include["$id"] && uci commit firewall
rm -f "$OPENWRT_FW_INCLUDE$1" rm -f "$OPENWRT_FW_INCLUDE$1"
} }
} }
openwrt_fw_section_add() openwrt_fw_section_add() {
{
openwrt_fw_section_find || openwrt_fw_section_find ||
{ {
uci add firewall include >/dev/null || return uci add firewall include >/dev/null || return
echo -1 echo -1
} }
} }
openwrt_fw_section_configure() openwrt_fw_section_configure() {
{ local id="$(openwrt_fw_section_add "$1")"
local id="$(openwrt_fw_section_add $1)"
[ -z "$id" ] || [ -z "$id" ] ||
! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE" || ! uci set firewall.@include["$id"].path="$OPENWRT_FW_INCLUDE" ||
! uci set firewall.@include[$id].reload="1" || ! uci set firewall.@include["$id"].reload="1" ||
! uci commit firewall && ! uci commit firewall &&
{ {
echo could not add firewall include echo could not add firewall include
exitp 50 exitp 50
} }
} }
install_openwrt_firewall() install_openwrt_firewall() {
{ echo \* installing firewall script "$1"
echo \* installing firewall script $1
[ -n "MODE" ] || { [ -n "MODE" ] || {
echo should specify MODE in $ZAPRET_CONFIG echo should specify MODE in "$ZAPRET_CONFIG"
exitp 7 exitp 7
} }
echo "linking: $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE" echo "linking: $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE"
ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE" ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE"
openwrt_fw_section_configure $1 openwrt_fw_section_configure "$1"
} }
restart_openwrt_firewall() restart_openwrt_firewall() {
{
echo \* restarting firewall echo \* restarting firewall
local FW=fw4 local FW=fw4
@ -413,8 +374,7 @@ restart_openwrt_firewall()
exitp 30 exitp 30
} }
} }
remove_openwrt_firewall() remove_openwrt_firewall() {
{
echo \* removing firewall script echo \* removing firewall script
openwrt_fw_section_del openwrt_fw_section_del
@ -422,43 +382,36 @@ remove_openwrt_firewall()
openwrt_fw_section_del 6 openwrt_fw_section_del 6
} }
clear_ipset() clear_ipset() {
{
echo "* clearing ipset(s)" echo "* clearing ipset(s)"
# free some RAM # free some RAM
"$IPSET_DIR/create_ipset.sh" clear "$IPSET_DIR/create_ipset.sh" clear
} }
service_install_macos() {
service_install_macos()
{
echo \* installing zapret service echo \* installing zapret service
ln -fs "$ZAPRET_BASE/init.d/macos/zapret.plist" /Library/LaunchDaemons ln -fs "$ZAPRET_BASE/init.d/macos/zapret.plist" /Library/LaunchDaemons
} }
service_start_macos() service_start_macos() {
{
echo \* starting zapret service echo \* starting zapret service
"$INIT_SCRIPT_SRC" start "$INIT_SCRIPT_SRC" start
} }
service_stop_macos() service_stop_macos() {
{
echo \* stopping zapret service echo \* stopping zapret service
"$INIT_SCRIPT_SRC" stop "$INIT_SCRIPT_SRC" stop
} }
service_remove_macos() service_remove_macos() {
{
echo \* removing zapret service echo \* removing zapret service
rm -f /Library/LaunchDaemons/zapret.plist rm -f /Library/LaunchDaemons/zapret.plist
zapret_stop_daemons zapret_stop_daemons
} }
remove_macos_firewall() remove_macos_firewall() {
{
echo \* removing zapret PF hooks echo \* removing zapret PF hooks
pf_anchors_clear pf_anchors_clear
@ -467,9 +420,8 @@ remove_macos_firewall()
pf_anchor_root_reload pf_anchor_root_reload
} }
sedi() sedi() {
{ # macOS doesnt support -i without parameter. busybox doesnt support -i with parameter.
# MacOS doesnt support -i without parameter. busybox doesnt support -i with parameter.
# its not possible to put "sed -i ''" to a variable and then use it # its not possible to put "sed -i ''" to a variable and then use it
if [ "$SYSTEM" = "macos" ]; then if [ "$SYSTEM" = "macos" ]; then
sed -i '' "$@" sed -i '' "$@"
@ -478,8 +430,7 @@ sedi()
fi fi
} }
write_config_var() write_config_var() {
{
# $1 - mode var # $1 - mode var
local M local M
eval M="\$$1" eval M="\$$1"
@ -487,7 +438,7 @@ write_config_var()
if grep -q "^$1=\|^#$1=" "$ZAPRET_CONFIG"; then if grep -q "^$1=\|^#$1=" "$ZAPRET_CONFIG"; then
# replace / => \/ # replace / => \/
#M=${M//\//\\\/} #M=${M//\//\\\/}
M=$(echo $M | sed 's/\//\\\//g') M=$(echo "$M" | sed 's/\//\\\//g')
if [ -n "$M" ]; then if [ -n "$M" ]; then
if contains "$M" " "; then if contains "$M" " "; then
sedi -Ee "s/^#?$1=.*$/$1=\"$M\"/" "$ZAPRET_CONFIG" sedi -Ee "s/^#?$1=.*$/$1=\"$M\"/" "$ZAPRET_CONFIG"
@ -508,8 +459,7 @@ write_config_var()
fi fi
} }
check_prerequisites_linux() check_prerequisites_linux() {
{
echo \* checking prerequisites echo \* checking prerequisites
local s cmd PKGS UTILS req="curl curl" local s cmd PKGS UTILS req="curl curl"
@ -522,23 +472,23 @@ check_prerequisites_linux()
;; ;;
esac esac
PKGS=$(for s in $req; do echo $s; done | PKGS=$(for s in $req; do echo "$s"; done |
while read cmd; do while read cmd; do
read pkg read pkg
exists $cmd || echo $pkg exists "$cmd" || echo "$pkg"
done | sort -u | xargs) done | sort -u | xargs)
UTILS=$(for s in $req; do echo $s; done | UTILS=$(for s in $req; do echo "$s"; done |
while read cmd; do while read cmd; do
read pkg read pkg
echo $cmd echo "$cmd"
done | sort -u | xargs) done | sort -u | xargs)
if [ -z "$PKGS" ]; then if [ -z "$PKGS" ]; then
echo required utilities exist : $UTILS echo required utilities exist: "$UTILS"
else else
echo \* installing prerequisites echo \* installing prerequisites
echo packages required : $PKGS echo packages required: "$PKGS"
APTGET=$(whichq apt-get) APTGET=$(whichq apt-get)
YUM=$(whichq yum) YUM=$(whichq yum)
@ -548,28 +498,28 @@ check_prerequisites_linux()
APK=$(whichq apk) APK=$(whichq apk)
if [ -x "$APTGET" ]; then if [ -x "$APTGET" ]; then
"$APTGET" update "$APTGET" update
"$APTGET" install -y --no-install-recommends $PKGS dnsutils || { "$APTGET" install -y --no-install-recommends "$PKGS" dnsutils || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
elif [ -x "$YUM" ]; then elif [ -x "$YUM" ]; then
"$YUM" -y install $PKGS || { "$YUM" -y install "$PKGS" || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
elif [ -x "$PACMAN" ]; then elif [ -x "$PACMAN" ]; then
"$PACMAN" -Syy "$PACMAN" -Syy
"$PACMAN" --noconfirm -S $PKGS || { "$PACMAN" --noconfirm -S "$PKGS" || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
elif [ -x "$ZYPPER" ]; then elif [ -x "$ZYPPER" ]; then
"$ZYPPER" --non-interactive install $PKGS || { "$ZYPPER" --non-interactive install "$PKGS" || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
elif [ -x "$EOPKG" ]; then elif [ -x "$EOPKG" ]; then
"$EOPKG" -y install $PKGS || { "$EOPKG" -y install "$PKGS" || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
@ -577,20 +527,19 @@ check_prerequisites_linux()
"$APK" update "$APK" update
# for alpine # for alpine
[ "$FWTYPE" = iptables ] && [ -n "$($APK list ip6tables)" ] && PKGS="$PKGS ip6tables" [ "$FWTYPE" = iptables ] && [ -n "$($APK list ip6tables)" ] && PKGS="$PKGS ip6tables"
"$APK" add $PKGS || { "$APK" add "$PKGS" || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
else else
echo supported package manager not found echo supported package manager not found
echo you must manually install : $UTILS echo you must manually install: "$UTILS"
exitp 5 exitp 5
fi fi
fi fi
} }
check_prerequisites_openwrt() check_prerequisites_openwrt() {
{
echo \* checking prerequisites echo \* checking prerequisites
local PKGS="curl" UPD=0 local PKGS="curl" UPD=0
@ -605,14 +554,14 @@ check_prerequisites_openwrt()
;; ;;
esac esac
if check_packages_openwrt $PKGS ; then if check_packages_openwrt "$PKGS"; then
echo everything is present echo everything is present
else else
echo \* installing prerequisites echo \* installing prerequisites
opkg update opkg update
UPD=1 UPD=1
opkg install $PKGS || { opkg install "$PKGS" || {
echo could not install prerequisites echo could not install prerequisites
exitp 6 exitp 6
} }
@ -659,10 +608,7 @@ check_prerequisites_openwrt()
} }
} }
select_ipv6() {
select_ipv6()
{
local T=N local T=N
[ "$DISABLE_IPV6" != '1' ] && T=Y [ "$DISABLE_IPV6" != '1' ] && T=Y
@ -675,8 +621,7 @@ select_ipv6()
fi fi
[ "$old6" != "$DISABLE_IPV6" ] && write_config_var DISABLE_IPV6 [ "$old6" != "$DISABLE_IPV6" ] && write_config_var DISABLE_IPV6
} }
select_fwtype() select_fwtype() {
{
echo echo
[ $(get_ram_mb) -le 400 ] && { [ $(get_ram_mb) -le 400 ] && {
echo WARNING ! you are running a low RAM system echo WARNING ! you are running a low RAM system

239
common/ipt.sh
View File

@ -1,55 +1,43 @@
std_ports std_ports
readonly ipt_connbytes="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes" readonly ipt_connbytes="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes"
ipt() ipt() {
{
iptables -C "$@" >/dev/null 2>/dev/null || iptables -I "$@" iptables -C "$@" >/dev/null 2>/dev/null || iptables -I "$@"
} }
ipta() ipta() {
{
iptables -C "$@" >/dev/null 2>/dev/null || iptables -A "$@" iptables -C "$@" >/dev/null 2>/dev/null || iptables -A "$@"
} }
ipt_del() ipt_del() {
{
iptables -C "$@" >/dev/null 2>/dev/null && iptables -D "$@" iptables -C "$@" >/dev/null 2>/dev/null && iptables -D "$@"
} }
ipt_add_del() ipt_add_del() {
{
on_off_function ipt ipt_del "$@" on_off_function ipt ipt_del "$@"
} }
ipta_add_del() ipta_add_del() {
{
on_off_function ipta ipt_del "$@" on_off_function ipta ipt_del "$@"
} }
ipt6() ipt6() {
{
ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -I "$@" ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -I "$@"
} }
ipt6a() ipt6a() {
{
ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -A "$@" ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -A "$@"
} }
ipt6_del() ipt6_del() {
{
ip6tables -C "$@" >/dev/null 2>/dev/null && ip6tables -D "$@" ip6tables -C "$@" >/dev/null 2>/dev/null && ip6tables -D "$@"
} }
ipt6_add_del() ipt6_add_del() {
{
on_off_function ipt6 ipt6_del "$@" on_off_function ipt6 ipt6_del "$@"
} }
ipt6a_add_del() ipt6a_add_del() {
{
on_off_function ipt6 ipt6a_del "$@" on_off_function ipt6 ipt6a_del "$@"
} }
is_ipt_flow_offload_avail() is_ipt_flow_offload_avail() {
{ # $1 = '' for IPv4, '6' for IPv6
# $1 = '' for ipv4, '6' for ipv6 grep -q FLOWOFFLOAD /proc/net/ip"$1"_tables_targets 2>/dev/null
grep -q FLOWOFFLOAD 2>/dev/null /proc/net/ip$1_tables_targets
} }
filter_apply_port_target() filter_apply_port_target() {
{
# $1 - var name of iptables filter # $1 - var name of iptables filter
local f local f
if [ "$MODE_HTTP" = "1" ] && [ "$MODE_HTTPS" = "1" ]; then if [ "$MODE_HTTP" = "1" ] && [ "$MODE_HTTPS" = "1" ]; then
@ -61,62 +49,54 @@ filter_apply_port_target()
else else
echo WARNING !!! HTTP and HTTPS are both disabled echo WARNING !!! HTTP and HTTPS are both disabled
fi fi
eval $1="\"\$$1 $f\"" eval "$1"="\"\$$1 $f\""
} }
filter_apply_port_target_quic() filter_apply_port_target_quic() {
{
# $1 - var name of nftables filter # $1 - var name of nftables filter
local f local f
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
eval $1="\"\$$1 $f\"" eval "$1"="\"\$$1 $f\""
} }
filter_apply_ipset_target4() filter_apply_ipset_target4() {
{
# $1 - var name of ipv4 iptables filter # $1 - var name of ipv4 iptables filter
if [ "$MODE_FILTER" = "ipset" ]; then if [ "$MODE_FILTER" = "ipset" ]; then
eval $1="\"\$$1 -m set --match-set zapret dst\"" eval "$1"="\"\$$1 -m set --match-set zapret dst\""
fi fi
} }
filter_apply_ipset_target6() filter_apply_ipset_target6() {
{
# $1 - var name of ipv6 iptables filter # $1 - var name of ipv6 iptables filter
if [ "$MODE_FILTER" = "ipset" ]; then if [ "$MODE_FILTER" = "ipset" ]; then
eval $1="\"\$$1 -m set --match-set zapret6 dst\"" eval "$1"="\"\$$1 -m set --match-set zapret6 dst\""
fi fi
} }
filter_apply_ipset_target() filter_apply_ipset_target() {
{
# $1 - var name of ipv4 iptables filter # $1 - var name of ipv4 iptables filter
# $2 - var name of ipv6 iptables filter # $2 - var name of ipv6 iptables filter
filter_apply_ipset_target4 $1 filter_apply_ipset_target4 "$1"
filter_apply_ipset_target6 $2 filter_apply_ipset_target6 "$2"
} }
reverse_nfqws_rule_stream() reverse_nfqws_rule_stream() {
{
sed -e 's/-o /-i /g' -e 's/--dport /--sport /g' -e 's/--dports /--sports /g' -e 's/ dst$/ src/' -e 's/ dst / src /g' -e 's/--connbytes-dir=original/--connbytes-dir=reply/g' -e "s/-m mark ! --mark $DESYNC_MARK\/$DESYNC_MARK//g" sed -e 's/-o /-i /g' -e 's/--dport /--sport /g' -e 's/--dports /--sports /g' -e 's/ dst$/ src/' -e 's/ dst / src /g' -e 's/--connbytes-dir=original/--connbytes-dir=reply/g' -e "s/-m mark ! --mark $DESYNC_MARK\/$DESYNC_MARK//g"
} }
reverse_nfqws_rule() reverse_nfqws_rule() {
{
echo "$@" | reverse_nfqws_rule_stream echo "$@" | reverse_nfqws_rule_stream
} }
prepare_tpws_fw4() prepare_tpws_fw4() {
{ # otherwise Linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
# NOTE: kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8 # NOTE: kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
iptables -N input_rule_zapret 2>/dev/null iptables -N input_rule_zapret 2>/dev/null
ipt input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN ipt input_rule_zapret -d "$TPWS_LOCALHOST4" -j RETURN
ipta input_rule_zapret -d 127.0.0.0/8 -j DROP ipta input_rule_zapret -d 127.0.0.0/8 -j DROP
ipt INPUT ! -i lo -j input_rule_zapret ipt INPUT ! -i lo -j input_rule_zapret
prepare_route_localnet prepare_route_localnet
} }
} }
unprepare_tpws_fw4() unprepare_tpws_fw4() {
{
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
unprepare_route_localnet unprepare_route_localnet
@ -125,14 +105,11 @@ unprepare_tpws_fw4()
iptables -X input_rule_zapret 2>/dev/null iptables -X input_rule_zapret 2>/dev/null
} }
} }
unprepare_tpws_fw() unprepare_tpws_fw() {
{
unprepare_tpws_fw4 unprepare_tpws_fw4
} }
ipt_print_op() {
ipt_print_op()
{
if [ "$1" = "1" ]; then if [ "$1" = "1" ]; then
echo "Adding ip$4tables rule for $3 : $2" echo "Adding ip$4tables rule for $3 : $2"
else else
@ -140,8 +117,7 @@ ipt_print_op()
fi fi
} }
_fw_tpws4() _fw_tpws4() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4 # $2 - iptable filter for ipv4
# $3 - tpws port # $3 - tpws port
@ -152,25 +128,24 @@ _fw_tpws4()
[ "$1" = 1 ] && prepare_tpws_fw4 [ "$1" = 1 ] && prepare_tpws_fw4
ipt_print_op $1 "$2" "tpws (port $3)" ipt_print_op "$1" "$2" "tpws (port $3)"
rule="$2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3" rule="$2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3"
for i in $4; do for i in $4; do
ipt_add_del $1 PREROUTING -t nat -i $i $rule ipt_add_del "$1" PREROUTING -t nat -i "$i" "$rule"
done done
rule="-m owner ! --uid-owner $WS_USER $rule" rule="-m owner ! --uid-owner $WS_USER $rule"
if [ -n "$5" ]; then if [ -n "$5" ]; then
for i in $5; do for i in $5; do
ipt_add_del $1 OUTPUT -t nat -o $i $rule ipt_add_del "$1" OUTPUT -t nat -o "$i" "$rule"
done done
else else
ipt_add_del $1 OUTPUT -t nat $rule ipt_add_del "$1" OUTPUT -t nat "$rule"
fi fi
} }
} }
_fw_tpws6() _fw_tpws6() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
# $3 - tpws port # $3 - tpws port
@ -180,37 +155,34 @@ _fw_tpws6()
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || { [ "$DISABLE_IPV6" = "1" -o -z "$2" ] || {
local i rule DNAT6 local i rule DNAT6
ipt_print_op $1 "$2" "tpws (port $3)" 6 ipt_print_op "$1" "$2" "tpws (port $3)" 6
rule="$2 $IPSET_EXCLUDE6 dst" rule="$2 $IPSET_EXCLUDE6 dst"
for i in $4; do for i in $4; do
_dnat6_target $i DNAT6 _dnat6_target "$i" DNAT6
[ -n "$DNAT6" -a "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $i $rule -j DNAT --to [$DNAT6]:$3 [ -n "$DNAT6" -a "$DNAT6" != "-" ] && ipt6_add_del "$1" PREROUTING -t nat -i "$i" "$rule" -j DNAT --to ["$DNAT6"]:"$3"
done done
rule="-m owner ! --uid-owner $WS_USER $rule -j DNAT --to [::1]:$3" rule="-m owner ! --uid-owner $WS_USER $rule -j DNAT --to [::1]:$3"
if [ -n "$5" ]; then if [ -n "$5" ]; then
for i in $5; do for i in $5; do
ipt6_add_del $1 OUTPUT -t nat -o $i $rule ipt6_add_del "$1" OUTPUT -t nat -o "$i" "$rule"
done done
else else
ipt6_add_del $1 OUTPUT -t nat $rule ipt6_add_del "$1" OUTPUT -t nat "$rule"
fi fi
} }
} }
fw_tpws() fw_tpws() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4 # $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6 # $3 - iptable filter for ipv6
# $4 - tpws port # $4 - tpws port
fw_tpws4 $1 "$2" $4 fw_tpws4 "$1" "$2" "$4"
fw_tpws6 $1 "$3" $4 fw_tpws6 "$1" "$3" "$4"
} }
_fw_nfqws_post4() {
_fw_nfqws_post4()
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4 # $2 - iptable filter for ipv4
# $3 - queue number # $3 - queue number
@ -218,20 +190,19 @@ _fw_nfqws_post4()
[ "$DISABLE_IPV4" = "1" -o -z "$2" ] || { [ "$DISABLE_IPV4" = "1" -o -z "$2" ] || {
local i local i
ipt_print_op $1 "$2" "nfqws postrouting (qnum $3)" ipt_print_op "$1" "$2" "nfqws postrouting (qnum $3)"
rule="$2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass" rule="$2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass"
if [ -n "$4" ]; then if [ -n "$4" ]; then
for i in $4; do for i in $4; do
ipt_add_del $1 POSTROUTING -t mangle -o $i $rule ipt_add_del "$1" POSTROUTING -t mangle -o "$i" "$rule"
done done
else else
ipt_add_del $1 POSTROUTING -t mangle $rule ipt_add_del "$1" POSTROUTING -t mangle "$rule"
fi fi
} }
} }
_fw_nfqws_post6() _fw_nfqws_post6() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
# $3 - queue number # $3 - queue number
@ -239,30 +210,28 @@ _fw_nfqws_post6()
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || { [ "$DISABLE_IPV6" = "1" -o -z "$2" ] || {
local i local i
ipt_print_op $1 "$2" "nfqws postrouting (qnum $3)" 6 ipt_print_op "$1" "$2" "nfqws postrouting (qnum $3)" 6
rule="$2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass" rule="$2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass"
if [ -n "$4" ]; then if [ -n "$4" ]; then
for i in $4; do for i in $4; do
ipt6_add_del $1 POSTROUTING -t mangle -o $i $rule ipt6_add_del "$1" POSTROUTING -t mangle -o "$i" "$rule"
done done
else else
ipt6_add_del $1 POSTROUTING -t mangle $rule ipt6_add_del "$1" POSTROUTING -t mangle "$rule"
fi fi
} }
} }
fw_nfqws_post() fw_nfqws_post() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4 # $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6 # $3 - iptable filter for ipv6
# $4 - queue number # $4 - queue number
fw_nfqws_post4 $1 "$2" $4 fw_nfqws_post4 "$1" "$2" "$4"
fw_nfqws_post6 $1 "$3" $4 fw_nfqws_post6 "$1" "$3" "$4"
} }
_fw_nfqws_pre4() _fw_nfqws_pre4() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4 # $2 - iptable filter for ipv4
# $3 - queue number # $3 - queue number
@ -270,23 +239,22 @@ _fw_nfqws_pre4()
[ "$DISABLE_IPV4" = "1" -o -z "$2" ] || { [ "$DISABLE_IPV4" = "1" -o -z "$2" ] || {
local i local i
ipt_print_op $1 "$2" "nfqws input+forward (qnum $3)" ipt_print_op "$1" "$2" "nfqws input+forward (qnum $3)"
rule="$2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass" rule="$2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass"
if [ -n "$4" ]; then if [ -n "$4" ]; then
for i in $4; do for i in $4; do
# iptables PREROUTING chain is before NAT. not possible to have DNATed ip's there # iptables PREROUTING chain is before NAT. not possible to have DNATed ip's there
ipt_add_del $1 INPUT -t mangle -i $i $rule ipt_add_del "$1" INPUT -t mangle -i "$i" "$rule"
ipt_add_del $1 FORWARD -t mangle -i $i $rule ipt_add_del "$1" FORWARD -t mangle -i "$i" "$rule"
done done
else else
ipt_add_del $1 INPUT -t mangle $rule ipt_add_del "$1" INPUT -t mangle "$rule"
ipt_add_del $1 FORWARD -t mangle $rule ipt_add_del "$1" FORWARD -t mangle "$rule"
fi fi
} }
} }
_fw_nfqws_pre6() _fw_nfqws_pre6() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
# $3 - queue number # $3 - queue number
@ -294,34 +262,31 @@ _fw_nfqws_pre6()
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || { [ "$DISABLE_IPV6" = "1" -o -z "$2" ] || {
local i local i
ipt_print_op $1 "$2" "nfqws input+forward (qnum $3)" 6 ipt_print_op "$1" "$2" "nfqws input+forward (qnum $3)" 6
rule="$2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass" rule="$2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass"
if [ -n "$4" ]; then if [ -n "$4" ]; then
for i in $4; do for i in $4; do
# iptables PREROUTING chain is before NAT. not possible to have DNATed ip's there # iptables PREROUTING chain is before NAT. not possible to have DNATed ip's there
ipt6_add_del $1 INPUT -t mangle -i $i $rule ipt6_add_del "$1" INPUT -t mangle -i "$i" "$rule"
ipt6_add_del $1 FORWARD -t mangle -i $i $rule ipt6_add_del "$1" FORWARD -t mangle -i "$i" "$rule"
done done
else else
ipt6_add_del $1 INPUT -t mangle $rule ipt6_add_del "$1" INPUT -t mangle "$rule"
ipt6_add_del $1 FORWARD -t mangle $rule ipt6_add_del "$1" FORWARD -t mangle "$rule"
fi fi
} }
} }
fw_nfqws_pre() fw_nfqws_pre() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4 # $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6 # $3 - iptable filter for ipv6
# $4 - queue number # $4 - queue number
fw_nfqws_pre4 $1 "$2" $4 fw_nfqws_pre4 "$1" "$2" "$4"
fw_nfqws_pre6 $1 "$3" $4 fw_nfqws_pre6 "$1" "$3" "$4"
} }
produce_reverse_nfqws_rule() {
produce_reverse_nfqws_rule()
{
local rule="$1" local rule="$1"
if contains "$rule" "$ipt_connbytes"; then if contains "$rule" "$ipt_connbytes"; then
# autohostlist - need several incoming packets # autohostlist - need several incoming packets
@ -334,28 +299,23 @@ produce_reverse_nfqws_rule()
fi fi
echo "$rule" | reverse_nfqws_rule_stream echo "$rule" | reverse_nfqws_rule_stream
} }
fw_reverse_nfqws_rule4() fw_reverse_nfqws_rule4() {
{ fw_nfqws_pre4 "$1" "$(produce_reverse_nfqws_rule "$2")" "$3"
fw_nfqws_pre4 $1 "$(produce_reverse_nfqws_rule "$2")" $3
} }
fw_reverse_nfqws_rule6() fw_reverse_nfqws_rule6() {
{ fw_nfqws_pre6 "$1" "$(produce_reverse_nfqws_rule "$2")" "$3"
fw_nfqws_pre6 $1 "$(produce_reverse_nfqws_rule "$2")" $3
} }
fw_reverse_nfqws_rule() fw_reverse_nfqws_rule() {
{
# ensure that modes relying on incoming traffic work # ensure that modes relying on incoming traffic work
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - rule4 # $2 - rule4
# $3 - rule6 # $3 - rule6
# $4 - queue number # $4 - queue number
fw_reverse_nfqws_rule4 $1 "$2" $4 fw_reverse_nfqws_rule4 "$1" "$2" "$4"
fw_reverse_nfqws_rule6 $1 "$3" $4 fw_reverse_nfqws_rule6 "$1" "$3" "$4"
} }
zapret_do_firewall_rules_ipt() {
zapret_do_firewall_rules_ipt()
{
local mode="${MODE_OVERRIDE:-$MODE}" local mode="${MODE_OVERRIDE:-$MODE}"
local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)" local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)"
@ -365,12 +325,12 @@ zapret_do_firewall_rules_ipt()
case "$mode" in case "$mode" in
tpws) tpws)
if [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ]; then if [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ]; then
echo both http and https are disabled. not applying redirection. echo both HTTP and HTTPS are disabled. not applying redirection.
else else
filter_apply_port_target f4 filter_apply_port_target f4
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_tpws $1 "$f4" "$f6" $TPPORT fw_tpws "$1" "$f4" "$f6" "$TPPORT"
fi fi
;; ;;
@ -381,42 +341,42 @@ zapret_do_firewall_rules_ipt()
filter_apply_port_target f4 filter_apply_port_target f4
f4="$f4 $first_packet_only" f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qn fw_nfqws_post4 "$1" "$f4 $desync" "$qn"
fw_reverse_nfqws_rule4 $1 "$f4" $qn fw_reverse_nfqws_rule4 "$1" "$f4" "$qn"
else else
if [ -n "$qn" ]; then if [ -n "$qn" ]; then
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packet_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qn fw_nfqws_post4 "$1" "$f4 $desync" "$qn"
fw_reverse_nfqws_rule4 $1 "$f4" $qn fw_reverse_nfqws_rule4 "$1" "$f4" "$qn"
fi fi
if [ -n "$qns" ]; then if [ -n "$qns" ]; then
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qns fw_nfqws_post4 "$1" "$f4 $desync" "$qns"
fw_reverse_nfqws_rule4 $1 "$f4" $qns fw_reverse_nfqws_rule4 "$1" "$f4" "$qns"
fi fi
fi fi
if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn6" ] && [ "$qn6" = "$qns6" ]; then if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn6" ] && [ "$qn6" = "$qns6" ]; then
filter_apply_port_target f6 filter_apply_port_target f6
f6="$f6 $first_packet_only" f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qn6 fw_nfqws_post6 "$1" "$f6 $desync" "$qn6"
fw_reverse_nfqws_rule6 $1 "$f6" $qn6 fw_reverse_nfqws_rule6 "$1" "$f6" "$qn6"
else else
if [ -n "$qn6" ]; then if [ -n "$qn6" ]; then
f6="-p tcp -m multiport --dports $HTTP_PORTS_IPT" f6="-p tcp -m multiport --dports $HTTP_PORTS_IPT"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packet_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qn6 fw_nfqws_post6 "$1" "$f6 $desync" "$qn6"
fw_reverse_nfqws_rule6 $1 "$f6" $qn6 fw_reverse_nfqws_rule6 "$1" "$f6" "$qn6"
fi fi
if [ -n "$qns6" ]; then if [ -n "$qns6" ]; then
f6="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" f6="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qns6 fw_nfqws_post6 "$1" "$f6 $desync" "$qns6"
fw_reverse_nfqws_rule6 $1 "$f6" $qns6 fw_reverse_nfqws_rule6 "$1" "$f6" "$qns6"
fi fi
fi fi
@ -426,24 +386,23 @@ zapret_do_firewall_rules_ipt()
filter_apply_port_target_quic f4 filter_apply_port_target_quic f4
f4="$f4 $first_packet_only" f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qn fw_nfqws_post4 "$1" "$f4 $desync" "$qn"
fi fi
if [ -n "$qn6" ]; then if [ -n "$qn6" ]; then
f6= f6=
filter_apply_port_target_quic f6 filter_apply_port_target_quic f6
f6="$f6 $first_packet_only" f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qn6 fw_nfqws_post6 "$1" "$f6 $desync" "$qn6"
fi fi
;; ;;
custom) custom)
existf zapret_custom_firewall && zapret_custom_firewall $1 existf zapret_custom_firewall && zapret_custom_firewall "$1"
;; ;;
esac esac
} }
zapret_do_firewall_ipt() zapret_do_firewall_ipt() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
if [ "$1" = 1 ]; then if [ "$1" = 1 ]; then

19
common/linux_fw.sh
View File

@ -1,9 +1,7 @@
set_conntrack_liberal_mode() set_conntrack_liberal_mode() {
{ [ -n "$SKIP_CONNTRACK_LIBERAL_MODE" ] || sysctl -w net.netfilter.nf_conntrack_tcp_be_liberal="$1"
[ -n "$SKIP_CONNTRACK_LIBERAL_MODE" ] || sysctl -w net.netfilter.nf_conntrack_tcp_be_liberal=$1
} }
zapret_do_firewall() zapret_do_firewall() {
{
linux_fwtype linux_fwtype
[ "$1" = 1 -a -n "$INIT_FW_PRE_UP_HOOK" ] && $INIT_FW_PRE_UP_HOOK [ "$1" = 1 -a -n "$INIT_FW_PRE_UP_HOOK" ] && $INIT_FW_PRE_UP_HOOK
@ -23,24 +21,21 @@ zapret_do_firewall()
# switch on liberal mode on zapret firewall start and switch off on zapret firewall stop # switch on liberal mode on zapret firewall start and switch off on zapret firewall stop
# this is only required for processing incoming bad RSTs. incoming rules are only applied in autohostlist mode # this is only required for processing incoming bad RSTs. incoming rules are only applied in autohostlist mode
# calling this after firewall because conntrack module can be not loaded before applying conntrack firewall rules # calling this after firewall because conntrack module can be not loaded before applying conntrack firewall rules
[ "$MODE_FILTER" = "autohostlist" -a "$MODE" != tpws -a "$MODE" != tpws-socks ] && set_conntrack_liberal_mode $1 [ "$MODE_FILTER" = "autohostlist" -a "$MODE" != tpws -a "$MODE" != tpws-socks ] && set_conntrack_liberal_mode "$1"
[ "$1" = 1 -a -n "$INIT_FW_POST_UP_HOOK" ] && $INIT_FW_POST_UP_HOOK [ "$1" = 1 -a -n "$INIT_FW_POST_UP_HOOK" ] && $INIT_FW_POST_UP_HOOK
[ "$1" = 0 -a -n "$INIT_FW_POST_DOWN_HOOK" ] && $INIT_FW_POST_DOWN_HOOK [ "$1" = 0 -a -n "$INIT_FW_POST_DOWN_HOOK" ] && $INIT_FW_POST_DOWN_HOOK
return 0 return 0
} }
zapret_apply_firewall() zapret_apply_firewall() {
{
zapret_do_firewall 1 "$@" zapret_do_firewall 1 "$@"
} }
zapret_unapply_firewall() zapret_unapply_firewall() {
{
zapret_do_firewall 0 "$@" zapret_do_firewall 0 "$@"
} }
first_packets_for_mode() first_packets_for_mode() {
{
# autohostlist and autottl modes requires incoming traffic sample # autohostlist and autottl modes requires incoming traffic sample
# always use conntrack packet limiter or nfqws will deal with gigabytes # always use conntrack packet limiter or nfqws will deal with gigabytes
local n local n

64
common/linux_iphelper.sh
View File

@ -4,54 +4,48 @@
# PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr # PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr
# not a good idea to expose tpws to the world (bind to ::) # not a good idea to expose tpws to the world (bind to ::)
get_ipv6_linklocal() {
get_ipv6_linklocal()
{
# $1 - interface name. if empty - any interface # $1 - interface name. if empty - any interface
if exists ip; then if exists ip; then
local dev local dev
[ -n "$1" ] && dev="dev $1" [ -n "$1" ] && dev="dev $1"
ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope link.*$/\1/;t;d' | head -n 1 ip addr show "$dev" | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope link.*$/\1/;t;d' | head -n 1
else else
ifconfig $1 | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Link.*$/\1/;t;d' | head -n 1 ifconfig "$1" | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Link.*$/\1/;t;d' | head -n 1
fi fi
} }
get_ipv6_global() get_ipv6_global() {
{
# $1 - interface name. if empty - any interface # $1 - interface name. if empty - any interface
if exists ip; then if exists ip; then
local dev local dev
[ -n "$1" ] && dev="dev $1" [ -n "$1" ] && dev="dev $1"
ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope global.*$/\1/;t;d' | head -n 1 ip addr show "$dev" | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope global.*$/\1/;t;d' | head -n 1
else else
ifconfig $1 | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Global.*$/\1/;t;d' | head -n 1 ifconfig "$1" | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Global.*$/\1/;t;d' | head -n 1
fi fi
} }
iface_is_up() iface_is_up() {
{
# $1 - interface name # $1 - interface name
[ -f /sys/class/net/$1/operstate ] || return [ -f /sys/class/net/"$1"/operstate ] || return
local state local state
read state </sys/class/net/$1/operstate read state </sys/class/net/"$1"/operstate
[ "$state" != "down" ] [ "$state" != "down" ]
} }
wait_ifup() wait_ifup() {
{
# $1 - interface name # $1 - interface name
local ct=0 local ct=0
while while
iface_is_up $1 && return iface_is_up "$1" && return
[ "$ct" -ge "$IFUP_WAIT_SEC" ] && break [ "$ct" -ge "$IFUP_WAIT_SEC" ] && break
echo waiting for ifup of $1 for another $(($IFUP_WAIT_SEC - $ct)) seconds ... echo waiting for ifup of "$1" for another $(($IFUP_WAIT_SEC - $ct)) seconds ...
ct=$(($ct + 1)) ct=$(($ct + 1))
sleep 1 sleep 1
do :; done do :; done
false false
} }
_dnat6_target() _dnat6_target() {
{
# $1 - interface name # $1 - interface name
# $2 - var to store target ip6 # $2 - var to store target ip6
# get target ip address for DNAT. prefer link locals # get target ip address for DNAT. prefer link locals
@ -60,57 +54,53 @@ _dnat6_target()
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts) # DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1 local DNAT6_TARGET DVAR=DNAT6_TARGET_$1
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g') DVAR=$(echo "$DVAR" | sed 's/[^a-zA-Z0-9_]/_/g')
eval DNAT6_TARGET="\$$DVAR" eval DNAT6_TARGET="\$$DVAR"
[ -n "$2" ] && eval $2='' [ -n "$2" ] && eval "$2"=''
[ -n "$DNAT6_TARGET" ] || { [ -n "$DNAT6_TARGET" ] || {
local ct=0 local ct=0
while while
DNAT6_TARGET=$(get_ipv6_linklocal $1) DNAT6_TARGET=$(get_ipv6_linklocal "$1")
[ -n "$DNAT6_TARGET" ] && break [ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break [ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo $1: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ... echo "$1": waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct + 1)) ct=$(($ct + 1))
sleep 1 sleep 1
do :; done do :; done
[ -n "$DNAT6_TARGET" ] || { [ -n "$DNAT6_TARGET" ] || {
echo $1: no link local. getting global echo "$1": no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $1) DNAT6_TARGET=$(get_ipv6_global "$1")
[ -n "$DNAT6_TARGET" ] || { [ -n "$DNAT6_TARGET" ] || {
echo $1: could not get any address echo "$1": could not get any address
DNAT6_TARGET=- DNAT6_TARGET=-
} }
} }
eval $DVAR="$DNAT6_TARGET" eval "$DVAR"="$DNAT6_TARGET"
} }
[ -n "$2" ] && eval $2="$DNAT6_TARGET" [ -n "$2" ] && eval "$2"="$DNAT6_TARGET"
} }
_set_route_localnet() _set_route_localnet() {
{
# $1 - 1 = enable, 0 = disable # $1 - 1 = enable, 0 = disable
# $2,$3,... - interface names # $2,$3,... - interface names
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
local enable="$1" local enable="$1"
shift shift
while [ -n "$1" ]; do while [ -n "$1" ]; do
sysctl -q -w net.ipv4.conf.$1.route_localnet="$enable" sysctl -q -w net.ipv4.conf."$1".route_localnet="$enable"
shift shift
done done
} }
} }
prepare_route_localnet() prepare_route_localnet() {
{
set_route_localnet 1 "$@" set_route_localnet 1 "$@"
} }
unprepare_route_localnet() unprepare_route_localnet() {
{
set_route_localnet 0 "$@" set_route_localnet 0 "$@"
} }
resolve_lower_devices() resolve_lower_devices() {
{
# $1 - bridge interface name # $1 - bridge interface name
[ -d "/sys/class/net/$1" ] && { [ -d "/sys/class/net/$1" ] && {
find "/sys/class/net/$1" -follow -maxdepth 1 -name "lower_*" | find "/sys/class/net/$1" -follow -maxdepth 1 -name "lower_*" |

19
common/list.sh
View File

@ -1,5 +1,4 @@
find_hostlists() find_hostlists() {
{
[ -n "$HOSTLIST_BASE" ] || HOSTLIST_BASE="$ZAPRET_BASE/ipset" [ -n "$HOSTLIST_BASE" ] || HOSTLIST_BASE="$ZAPRET_BASE/ipset"
HOSTLIST="$HOSTLIST_BASE/zapret-hosts.txt.gz" HOSTLIST="$HOSTLIST_BASE/zapret-hosts.txt.gz"
@ -18,8 +17,7 @@ find_hostlists()
HOSTLIST_AUTO_DEBUGLOG="$HOSTLIST_BASE/zapret-hosts-auto-debug.log" HOSTLIST_AUTO_DEBUGLOG="$HOSTLIST_BASE/zapret-hosts-auto-debug.log"
} }
filter_apply_autohostlist_target() filter_apply_autohostlist_target() {
{
# $1 - var name of tpws or nfqws params # $1 - var name of tpws or nfqws params
local parm1="${AUTOHOSTLIST_FAIL_THRESHOLD:+--hostlist-auto-fail-threshold=$AUTOHOSTLIST_FAIL_THRESHOLD}" local parm1="${AUTOHOSTLIST_FAIL_THRESHOLD:+--hostlist-auto-fail-threshold=$AUTOHOSTLIST_FAIL_THRESHOLD}"
@ -27,11 +25,10 @@ filter_apply_autohostlist_target()
local parm3 parm4 local parm3 parm4
[ "$MODE" = "tpws" -o "$MODE" = "tpws-socks" ] || parm3="${AUTOHOSTLIST_RETRANS_THRESHOLD:+--hostlist-auto-retrans-threshold=$AUTOHOSTLIST_RETRANS_THRESHOLD}" [ "$MODE" = "tpws" -o "$MODE" = "tpws-socks" ] || parm3="${AUTOHOSTLIST_RETRANS_THRESHOLD:+--hostlist-auto-retrans-threshold=$AUTOHOSTLIST_RETRANS_THRESHOLD}"
[ "$AUTOHOSTLIST_DEBUGLOG" = 1 ] && parm4="--hostlist-auto-debug=$HOSTLIST_AUTO_DEBUGLOG" [ "$AUTOHOSTLIST_DEBUGLOG" = 1 ] && parm4="--hostlist-auto-debug=$HOSTLIST_AUTO_DEBUGLOG"
eval $1="\"\$$1 --hostlist-auto=$HOSTLIST_AUTO $parm1 $parm2 $parm3 $parm4\"" eval "$1"="\"\$$1 --hostlist-auto=$HOSTLIST_AUTO $parm1 $parm2 $parm3 $parm4\""
} }
filter_apply_hostlist_target() filter_apply_hostlist_target() {
{
# $1 - var name of tpws or nfqws params # $1 - var name of tpws or nfqws params
[ "$MODE_FILTER" = "hostlist" -o "$MODE_FILTER" = "autohostlist" ] || return [ "$MODE_FILTER" = "hostlist" -o "$MODE_FILTER" = "autohostlist" ] || return
@ -40,8 +37,8 @@ filter_apply_hostlist_target()
find_hostlists find_hostlists
[ -n "$HOSTLIST" ] && eval $1="\"\$$1 --hostlist=$HOSTLIST\"" [ -n "$HOSTLIST" ] && eval "$1"="\"\$$1 --hostlist=$HOSTLIST\""
[ -n "$HOSTLIST_USER" ] && eval $1="\"\$$1 --hostlist=$HOSTLIST_USER\"" [ -n "$HOSTLIST_USER" ] && eval "$1"="\"\$$1 --hostlist=$HOSTLIST_USER\""
[ -n "$HOSTLIST_EXCLUDE" ] && eval $1="\"\$$1 --hostlist-exclude=$HOSTLIST_EXCLUDE\"" [ -n "$HOSTLIST_EXCLUDE" ] && eval "$1"="\"\$$1 --hostlist-exclude=$HOSTLIST_EXCLUDE\""
[ "$MODE_FILTER" = "autohostlist" ] && filter_apply_autohostlist_target $1 [ "$MODE_FILTER" = "autohostlist" ] && filter_apply_autohostlist_target "$1"
} }

374
common/nft.sh
View File

@ -5,48 +5,39 @@ readonly nft_connbytes="ct original packets"
create_dev_stdin create_dev_stdin
std_ports std_ports
nft_create_table() nft_create_table() {
{ nft add table inet "$ZAPRET_NFT_TABLE"
nft add table inet $ZAPRET_NFT_TABLE
} }
nft_del_table() nft_del_table() {
{ nft delete table inet "$ZAPRET_NFT_TABLE" 2>/dev/null
nft delete table inet $ZAPRET_NFT_TABLE 2>/dev/null
} }
nft_list_table() nft_list_table() {
{ nft -t list table inet "$ZAPRET_NFT_TABLE"
nft -t list table inet $ZAPRET_NFT_TABLE
} }
nft_create_set() nft_create_set() {
{
# $1 - set name # $1 - set name
# $2 - params # $2 - params
nft create set inet $ZAPRET_NFT_TABLE $1 "{ $2 }" 2>/dev/null nft create set inet "$ZAPRET_NFT_TABLE" "$1" "{ $2 }" 2>/dev/null
} }
nft_del_set() nft_del_set() {
{
# $1 - set name # $1 - set name
nft delete set inet $ZAPRET_NFT_TABLE $1 nft delete set inet "$ZAPRET_NFT_TABLE" "$1"
} }
nft_flush_set() nft_flush_set() {
{
# $1 - set name # $1 - set name
nft flush set inet $ZAPRET_NFT_TABLE $1 nft flush set inet "$ZAPRET_NFT_TABLE" "$1"
} }
nft_set_exists() nft_set_exists() {
{
# $1 - set name # $1 - set name
nft -t list set inet $ZAPRET_NFT_TABLE $1 2>/dev/null >/dev/null nft -t list set inet "$ZAPRET_NFT_TABLE" "$1" 2>/dev/null >/dev/null
} }
nft_flush_chain() nft_flush_chain() {
{
# $1 - chain name # $1 - chain name
nft flush chain inet $ZAPRET_NFT_TABLE $1 nft flush chain inet "$ZAPRET_NFT_TABLE" "$1"
} }
nft_del_all_chains_from_table() nft_del_all_chains_from_table() {
{
# $1 - table_name with or without family # $1 - table_name with or without family
# delete all chains with possible references to each other # delete all chains with possible references to each other
@ -54,12 +45,12 @@ nft_del_all_chains_from_table()
# avoid infinite loops # avoid infinite loops
local chains deleted=1 error=1 local chains deleted=1 error=1
while [ -n "$deleted" -a -n "$error" ]; do while [ -n "$deleted" -a -n "$error" ]; do
chains=$(nft -t list table $1 2>/dev/null | sed -nre "s/^[ ]*chain ([^ ]+) \{/\1/p" | xargs) chains=$(nft -t list table "$1" 2>/dev/null | sed -nre "s/^[ ]*chain ([^ ]+) \{/\1/p" | xargs)
[ -n "$chains" ] || break [ -n "$chains" ] || break
deleted= deleted=
error= error=
for chain in $chains; do for chain in $chains; do
if nft delete chain $1 $chain 2>/dev/null; then if nft delete chain "$1" "$chain" 2>/dev/null; then
deleted=1 deleted=1
else else
error=1 error=1
@ -68,8 +59,7 @@ nft_del_all_chains_from_table()
done done
} }
nft_create_chains() nft_create_chains() {
{
cat <<EOF | nft -f - cat <<EOF | nft -f -
add chain inet $ZAPRET_NFT_TABLE dnat_output { type nat hook output priority -101; } add chain inet $ZAPRET_NFT_TABLE dnat_output { type nat hook output priority -101; }
flush chain inet $ZAPRET_NFT_TABLE dnat_output flush chain inet $ZAPRET_NFT_TABLE dnat_output
@ -113,8 +103,7 @@ EOF
nft_add_rule predefrag_nfqws notrack comment \"do not track nfqws generated packets to avoid nat tampering and defragmentation\" nft_add_rule predefrag_nfqws notrack comment \"do not track nfqws generated packets to avoid nat tampering and defragmentation\"
} }
} }
nft_del_chains() nft_del_chains() {
{
# do not delete all chains because of additional user hooks # do not delete all chains because of additional user hooks
# they must be inside zapret table to use nfsets # they must be inside zapret table to use nfsets
@ -135,12 +124,10 @@ EOF
# unfortunately this approach breaks udp desync of the connection initiating packet (new, first one) # unfortunately this approach breaks udp desync of the connection initiating packet (new, first one)
# delete chain inet $ZAPRET_NFT_TABLE predefrag # delete chain inet $ZAPRET_NFT_TABLE predefrag
} }
nft_del_flowtable() nft_del_flowtable() {
{ nft delete flowtable inet "$ZAPRET_NFT_TABLE" ft 2>/dev/null
nft delete flowtable inet $ZAPRET_NFT_TABLE ft 2>/dev/null
} }
nft_create_or_update_flowtable() nft_create_or_update_flowtable() {
{
# $1 = flags ('offload' for hw offload) # $1 = flags ('offload' for hw offload)
# $2,$3,$4,... - interfaces # $2,$3,$4,... - interfaces
# can be called multiple times to add interfaces. interfaces can only be added , not removed # can be called multiple times to add interfaces. interfaces can only be added , not removed
@ -153,11 +140,10 @@ nft_create_or_update_flowtable()
for makelist in make_quoted_comma_list make_comma_list; do for makelist in make_quoted_comma_list make_comma_list; do
$makelist devices "$@" $makelist devices "$@"
[ -n "$devices" ] && devices="devices={$devices};" [ -n "$devices" ] && devices="devices={$devices};"
nft add flowtable inet $ZAPRET_NFT_TABLE ft "{ hook ingress priority -1; $flags $devices }" && break nft add flowtable inet "$ZAPRET_NFT_TABLE" ft "{ hook ingress priority -1; $flags $devices }" && break
done done
} }
nft_flush_ifsets() nft_flush_ifsets() {
{
cat <<EOF | nft -f - 2>/dev/null cat <<EOF | nft -f - 2>/dev/null
flush set inet $ZAPRET_NFT_TABLE lanif flush set inet $ZAPRET_NFT_TABLE lanif
flush set inet $ZAPRET_NFT_TABLE wanif flush set inet $ZAPRET_NFT_TABLE wanif
@ -165,105 +151,91 @@ cat << EOF | nft -f - 2>/dev/null
flush map inet $ZAPRET_NFT_TABLE link_local flush map inet $ZAPRET_NFT_TABLE link_local
EOF EOF
} }
nft_flush_link_local() nft_flush_link_local() {
{ nft flush map inet "$ZAPRET_NFT_TABLE" link_local 2>/dev/null
nft flush map inet $ZAPRET_NFT_TABLE link_local 2>/dev/null
} }
nft_list_ifsets() nft_list_ifsets() {
{ nft list set inet "$ZAPRET_NFT_TABLE" lanif
nft list set inet $ZAPRET_NFT_TABLE lanif nft list set inet "$ZAPRET_NFT_TABLE" wanif
nft list set inet $ZAPRET_NFT_TABLE wanif nft list set inet "$ZAPRET_NFT_TABLE" wanif6
nft list set inet $ZAPRET_NFT_TABLE wanif6 nft list map inet "$ZAPRET_NFT_TABLE" link_local
nft list map inet $ZAPRET_NFT_TABLE link_local nft list flowtable inet "$ZAPRET_NFT_TABLE" ft 2>/dev/null
nft list flowtable inet $ZAPRET_NFT_TABLE ft 2>/dev/null
} }
nft_create_firewall() nft_create_firewall() {
{
nft_create_table nft_create_table
nft_del_flowtable nft_del_flowtable
nft_flush_link_local nft_flush_link_local
nft_create_chains nft_create_chains
} }
nft_del_firewall() nft_del_firewall() {
{
nft_del_chains nft_del_chains
nft_del_flowtable nft_del_flowtable
nft_flush_link_local nft_flush_link_local
# leave ifsets and ipsets because they may be used by custom rules # leave ifsets and ipsets because they may be used by custom rules
} }
nft_add_rule() nft_add_rule() {
{
# $1 - chain # $1 - chain
# $2,$3,... - rule(s) # $2,$3,... - rule(s)
local chain="$1" local chain="$1"
shift shift
nft add rule inet $ZAPRET_NFT_TABLE $chain "$@" nft add rule inet "$ZAPRET_NFT_TABLE" "$chain" "$@"
} }
nft_add_set_element() nft_add_set_element() {
{
# $1 - set or map name # $1 - set or map name
# $2 - element # $2 - element
[ -z "$2" ] || nft add element inet $ZAPRET_NFT_TABLE $1 "{ $2 }" [ -z "$2" ] || nft add element inet "$ZAPRET_NFT_TABLE" "$1" "{ $2 }"
} }
nft_add_set_elements() nft_add_set_elements() {
{
# $1 - set or map name # $1 - set or map name
# $2,$3,... - element(s) # $2,$3,... - element(s)
local set="$1" elements local set="$1" elements
shift shift
make_comma_list elements "$@" make_comma_list elements "$@"
nft_add_set_element $set "$elements" nft_add_set_element "$set" "$elements"
} }
nft_reverse_nfqws_rule() nft_reverse_nfqws_rule() {
{
echo "$@" | sed -e 's/oifname /iifname /g' -e 's/dport /sport /g' -e 's/daddr /saddr /g' -e 's/ct original /ct reply /g' -e "s/mark and $DESYNC_MARK == 0//g" echo "$@" | sed -e 's/oifname /iifname /g' -e 's/dport /sport /g' -e 's/daddr /saddr /g' -e 's/ct original /ct reply /g' -e "s/mark and $DESYNC_MARK == 0//g"
} }
nft_clean_nfqws_rule() nft_clean_nfqws_rule() {
{
echo "$@" | sed -e "s/mark and $DESYNC_MARK == 0//g" -e "s/oifname @wanif6//g" -e "s/oifname @wanif//g" echo "$@" | sed -e "s/mark and $DESYNC_MARK == 0//g" -e "s/oifname @wanif6//g" -e "s/oifname @wanif//g"
} }
nft_add_nfqws_flow_exempt_rule() nft_add_nfqws_flow_exempt_rule() {
{
# $1 - rule (must be all filters in one var) # $1 - rule (must be all filters in one var)
nft_add_rule flow_offload $(nft_clean_nfqws_rule $1) return comment \"direct flow offloading exemption\" nft_add_rule flow_offload $(nft_clean_nfqws_rule "$1") return comment \"direct flow offloading exemption\"
# do not need this because of oifname @wanif/@wanif6 filter in forward chain # do not need this because of oifname @wanif/@wanif6 filter in forward chain
#nft_add_rule flow_offload $(nft_reverse_nfqws_rule $1) return comment \"reverse flow offloading exemption\" #nft_add_rule flow_offload $(nft_reverse_nfqws_rule $1) return comment \"reverse flow offloading exemption\"
} }
nft_add_flow_offload_exemption() nft_add_flow_offload_exemption() {
{
# "$1" - rule for ipv4 # "$1" - rule for ipv4
# "$2" - rule for ipv6 # "$2" - rule for ipv6
# "$3" - comment # "$3" - comment
[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || nft_add_rule flow_offload oifname @wanif $1 ip daddr != @nozapret return comment \"$3\" [ "$DISABLE_IPV4" = "1" -o -z "$1" ] || nft_add_rule flow_offload oifname @wanif "$1" ip daddr != @nozapret return comment \""$3"\"
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || nft_add_rule flow_offload oifname @wanif6 $2 ip6 daddr != @nozapret6 return comment \"$3\" [ "$DISABLE_IPV6" = "1" -o -z "$2" ] || nft_add_rule flow_offload oifname @wanif6 "$2" ip6 daddr != @nozapret6 return comment \""$3"\"
} }
nft_hw_offload_supported() nft_hw_offload_supported() {
{
# $1,$2,... - interface names # $1,$2,... - interface names
local devices res=1 local devices res=1
make_quoted_comma_list devices "$@" make_quoted_comma_list devices "$@"
[ -n "$devices" ] && devices="devices={$devices};" [ -n "$devices" ] && devices="devices={$devices};"
nft add table ${ZAPRET_NFT_TABLE}_test && nft add flowtable ${ZAPRET_NFT_TABLE}_test ft "{ flags offload; $devices }" 2>/dev/null && res=0 nft add table "${ZAPRET_NFT_TABLE}"_test && nft add flowtable "${ZAPRET_NFT_TABLE}"_test ft "{ flags offload; $devices }" 2>/dev/null && res=0
nft delete table ${ZAPRET_NFT_TABLE}_test 2>/dev/null nft delete table "${ZAPRET_NFT_TABLE}"_test 2>/dev/null
return $res return $res
} }
nft_hw_offload_find_supported() nft_hw_offload_find_supported() {
{
# $1,$2,... - interface names # $1,$2,... - interface names
local supported_list local supported_list
while [ -n "$1" ]; do while [ -n "$1" ]; do
nft_hw_offload_supported "$1" && append_separator_list supported_list ' ' '' "$1" nft_hw_offload_supported "$1" && append_separator_list supported_list ' ' '' "$1"
shift shift
done done
echo $supported_list echo "$supported_list"
} }
nft_apply_flow_offloading() nft_apply_flow_offloading() {
{
# ft can be absent # ft can be absent
nft_add_rule flow_offload meta l4proto "{ tcp, udp }" flow add @ft 2>/dev/null && { nft_add_rule flow_offload meta l4proto "{ tcp, udp }" flow add @ft 2>/dev/null && {
nft_add_rule flow_offload meta l4proto "{ tcp, udp }" counter comment \"if offload works here must not be too much traffic\" nft_add_rule flow_offload meta l4proto "{ tcp, udp }" counter comment \"if offload works here must not be too much traffic\"
@ -273,10 +245,7 @@ nft_apply_flow_offloading()
} }
} }
nft_filter_apply_port_target() {
nft_filter_apply_port_target()
{
# $1 - var name of nftables filter # $1 - var name of nftables filter
local f local f
if [ "$MODE_HTTP" = "1" ] && [ "$MODE_HTTPS" = "1" ]; then if [ "$MODE_HTTP" = "1" ] && [ "$MODE_HTTPS" = "1" ]; then
@ -288,58 +257,51 @@ nft_filter_apply_port_target()
else else
echo WARNING !!! HTTP and HTTPS are both disabled echo WARNING !!! HTTP and HTTPS are both disabled
fi fi
eval $1="\"\$$1 $f\"" eval "$1"="\"\$$1 $f\""
} }
nft_filter_apply_port_target_quic() nft_filter_apply_port_target_quic() {
{
# $1 - var name of nftables filter # $1 - var name of nftables filter
local f local f
f="udp dport {$QUIC_PORTS}" f="udp dport {$QUIC_PORTS}"
eval $1="\"\$$1 $f\"" eval "$1"="\"\$$1 $f\""
} }
nft_filter_apply_ipset_target4() nft_filter_apply_ipset_target4() {
{
# $1 - var name of ipv4 nftables filter # $1 - var name of ipv4 nftables filter
if [ "$MODE_FILTER" = "ipset" ]; then if [ "$MODE_FILTER" = "ipset" ]; then
eval $1="\"\$$1 ip daddr @zapret\"" eval "$1"="\"\$$1 ip daddr @zapret\""
fi fi
} }
nft_filter_apply_ipset_target6() nft_filter_apply_ipset_target6() {
{
# $1 - var name of ipv6 nftables filter # $1 - var name of ipv6 nftables filter
if [ "$MODE_FILTER" = "ipset" ]; then if [ "$MODE_FILTER" = "ipset" ]; then
eval $1="\"\$$1 ip6 daddr @zapret6\"" eval "$1"="\"\$$1 ip6 daddr @zapret6\""
fi fi
} }
nft_filter_apply_ipset_target() nft_filter_apply_ipset_target() {
{
# $1 - var name of ipv4 nftables filter # $1 - var name of ipv4 nftables filter
# $2 - var name of ipv6 nftables filter # $2 - var name of ipv6 nftables filter
nft_filter_apply_ipset_target4 $1 nft_filter_apply_ipset_target4 "$1"
nft_filter_apply_ipset_target6 $2 nft_filter_apply_ipset_target6 "$2"
} }
nft_script_add_ifset_element() {
nft_script_add_ifset_element()
{
# $1 - set name # $1 - set name
# $2 - space separated elements # $2 - space separated elements
local elements local elements
[ -n "$2" ] && { [ -n "$2" ] && {
make_quoted_comma_list elements $2 make_quoted_comma_list elements "$2"
script="${script} script="${script}
add element inet $ZAPRET_NFT_TABLE $1 { $elements }" add element inet $ZAPRET_NFT_TABLE $1 { $elements }"
} }
} }
nft_fill_ifsets() nft_fill_ifsets() {
{ # $1 - space separated LAN interface names
# $1 - space separated lan interface names # $2 - space separated WAN interface names
# $2 - space separated wan interface names # $3 - space separated WAN6 interface names
# $3 - space separated wan6 interface names # 4,5,6 is needed for PPPoE+OpenWrt case. looks like it's not easily possible to resolve Ethernet device behind a PPPoE interface
# 4,5,6 is needed for pppoe+openwrt case. looks like it's not easily possible to resolve ethernet device behind a pppoe interface # $4 - space separated LAN physical interface names (optional)
# $4 - space separated lan physical interface names (optional) # $5 - space separated WAN physical interface names (optional)
# $5 - space separated wan physical interface names (optional) # $6 - space separated WAN6 physical interface names (optional)
# $6 - space separated wan6 physical interface names (optional)
local script i j ALLDEVS devs local script i j ALLDEVS devs
@ -359,25 +321,25 @@ flush set inet $ZAPRET_NFT_TABLE lanif"
case "$FLOWOFFLOAD" in case "$FLOWOFFLOAD" in
software) software)
ALLDEVS=$(unique $1 $2 $3) ALLDEVS=$(unique "$1" "$2" "$3")
# unbound flowtable may cause error in older nft version # unbound flowtable may cause error in older nft version
nft_create_or_update_flowtable '' $ALLDEVS 2>/dev/null nft_create_or_update_flowtable '' "$ALLDEVS" 2>/dev/null
;; ;;
hardware) hardware)
ALLDEVS=$(unique $1 $2 $3 $4 $5 $6) ALLDEVS=$(unique "$1" "$2" "$3" "$4" "$5" "$6")
# first create unbound flowtable. may cause error in older nft version # first create unbound flowtable. may cause error in older nft version
nft_create_or_update_flowtable 'offload' 2>/dev/null nft_create_or_update_flowtable 'offload' 2>/dev/null
# then add elements. some of them can cause error because unsupported # then add elements. some of them can cause error because unsupported
for i in $ALLDEVS; do for i in $ALLDEVS; do
if nft_hw_offload_supported $i; then if nft_hw_offload_supported "$i"; then
nft_create_or_update_flowtable 'offload' $i nft_create_or_update_flowtable 'offload' "$i"
else else
# bridge members must be added instead of the bridge itself # bridge members must be added instead of the bridge itself
# some members may not support hw offload. example: lan1 lan2 lan3 support, wlan0 wlan1 - not # some members may not support hw offload. example: lan1 lan2 lan3 support, wlan0 wlan1 - not
devs=$(resolve_lower_devices $i) devs=$(resolve_lower_devices "$i")
for j in $devs; do for j in $devs; do
# do not display error if addition failed # do not display error if addition failed
nft_create_or_update_flowtable 'offload' $j 2>/dev/null nft_create_or_update_flowtable 'offload' "$j" 2>/dev/null
done done
fi fi
done done
@ -385,8 +347,7 @@ flush set inet $ZAPRET_NFT_TABLE lanif"
esac esac
} }
nft_only() nft_only() {
{
linux_fwtype linux_fwtype
case "$FWTYPE" in case "$FWTYPE" in
@ -396,13 +357,10 @@ nft_only()
esac esac
} }
nft_print_op() {
nft_print_op() echo "Adding nftables IPv$3 rule for $2: $1"
{
echo "Adding nftables ipv$3 rule for $2 : $1"
} }
_nft_fw_tpws4() _nft_fw_tpws4() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - tpws port # $2 - tpws port
# $3 - not-empty if wan interface filtering required # $3 - not-empty if wan interface filtering required
@ -410,13 +368,12 @@ _nft_fw_tpws4()
[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || { [ "$DISABLE_IPV4" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" local filter="$1" port="$2"
nft_print_op "$filter" "tpws (port $2)" 4 nft_print_op "$filter" "tpws (port $2)" 4
nft_add_rule dnat_output skuid != $WS_USER ${3:+oifname @wanif }$filter ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$port nft_add_rule dnat_output skuid != "$WS_USER" ${3:+oifname @wanif }"$filter" ip daddr != @nozapret dnat ip to "$TPWS_LOCALHOST4":"$port"
nft_add_rule dnat_pre iifname @lanif $filter ip daddr != @nozapret dnat ip to $TPWS_LOCALHOST4:$port nft_add_rule dnat_pre iifname @lanif "$filter" ip daddr != @nozapret dnat ip to "$TPWS_LOCALHOST4":"$port"
prepare_route_localnet prepare_route_localnet
} }
} }
_nft_fw_tpws6() _nft_fw_tpws6() {
{
# $1 - filter ipv6 # $1 - filter ipv6
# $2 - tpws port # $2 - tpws port
# $3 - lan interface names space separated # $3 - lan interface names space separated
@ -425,48 +382,43 @@ _nft_fw_tpws6()
[ "$DISABLE_IPV6" = "1" -o -z "$1" ] || { [ "$DISABLE_IPV6" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" DNAT6 i local filter="$1" port="$2" DNAT6 i
nft_print_op "$filter" "tpws (port $port)" 6 nft_print_op "$filter" "tpws (port $port)" 6
nft_add_rule dnat_output skuid != $WS_USER ${4:+oifname @wanif6 }$filter ip6 daddr != @nozapret6 dnat ip6 to [::1]:$port nft_add_rule dnat_output skuid != "$WS_USER" ${4:+oifname @wanif6 }"$filter" ip6 daddr != @nozapret6 dnat ip6 to [::1]:"$port"
[ -n "$3" ] && { [ -n "$3" ] && {
nft_add_rule dnat_pre $filter ip6 daddr != @nozapret6 dnat ip6 to iifname map @link_local:$port nft_add_rule dnat_pre "$filter" ip6 daddr != @nozapret6 dnat ip6 to iifname map @link_local:"$port"
for i in $3; do for i in $3; do
_dnat6_target $i DNAT6 _dnat6_target "$i" DNAT6
# can be multiple tpws processes on different ports # can be multiple tpws processes on different ports
[ -n "$DNAT6" -a "$DNAT6" != '-' ] && nft_add_set_element link_local "$i : $DNAT6" [ -n "$DNAT6" -a "$DNAT6" != '-' ] && nft_add_set_element link_local "$i : $DNAT6"
done done
} }
} }
} }
nft_fw_tpws() nft_fw_tpws() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - filter ipv6 # $2 - filter ipv6
# $3 - tpws port # $3 - tpws port
nft_fw_tpws4 "$1" $3 nft_fw_tpws4 "$1" "$3"
nft_fw_tpws6 "$2" $3 nft_fw_tpws6 "$2" "$3"
} }
is_postnat() is_postnat() {
{
[ "$POSTNAT" != 0 -o "$POSTNAT_ALL" = 1 ] [ "$POSTNAT" != 0 -o "$POSTNAT_ALL" = 1 ]
} }
get_postchain() get_postchain() {
{
if is_postnat; then if is_postnat; then
echo -n postnat echo -n postnat
else else
echo -n postrouting echo -n postrouting
fi fi
} }
get_prechain() get_prechain() {
{
if is_postnat; then if is_postnat; then
echo -n prenat echo -n prenat
else else
echo -n prerouting echo -n prerouting
fi fi
} }
_nft_fw_nfqws_post4() _nft_fw_nfqws_post4() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - queue number # $2 - queue number
# $3 - not-empty if wan interface filtering required # $3 - not-empty if wan interface filtering required
@ -476,12 +428,11 @@ _nft_fw_nfqws_post4()
nft_print_op "$filter" "nfqws postrouting (qnum $port)" 4 nft_print_op "$filter" "nfqws postrouting (qnum $port)" 4
rule="${3:+oifname @wanif }$filter ip daddr != @nozapret" rule="${3:+oifname @wanif }$filter ip daddr != @nozapret"
is_postnat && setmark="meta mark set meta mark or $DESYNC_MARK_POSTNAT" is_postnat && setmark="meta mark set meta mark or $DESYNC_MARK_POSTNAT"
nft_add_rule $chain $rule $setmark queue num $port bypass nft_add_rule "$chain" "$rule" "$setmark" queue num "$port" bypass
nft_add_nfqws_flow_exempt_rule "$rule" nft_add_nfqws_flow_exempt_rule "$rule"
} }
} }
_nft_fw_nfqws_post6() _nft_fw_nfqws_post6() {
{
# $1 - filter ipv6 # $1 - filter ipv6
# $2 - queue number # $2 - queue number
# $3 - not-empty if wan interface filtering required # $3 - not-empty if wan interface filtering required
@ -491,22 +442,20 @@ _nft_fw_nfqws_post6()
nft_print_op "$filter" "nfqws postrouting (qnum $port)" 6 nft_print_op "$filter" "nfqws postrouting (qnum $port)" 6
rule="${3:+oifname @wanif6 }$filter ip6 daddr != @nozapret6" rule="${3:+oifname @wanif6 }$filter ip6 daddr != @nozapret6"
is_postnat && setmark="meta mark set meta mark or $DESYNC_MARK_POSTNAT" is_postnat && setmark="meta mark set meta mark or $DESYNC_MARK_POSTNAT"
nft_add_rule $chain $rule $setmark queue num $port bypass nft_add_rule "$chain" "$rule" "$setmark" queue num "$port" bypass
nft_add_nfqws_flow_exempt_rule "$rule" nft_add_nfqws_flow_exempt_rule "$rule"
} }
} }
nft_fw_nfqws_post() nft_fw_nfqws_post() {
{ # $1 - filter IPv4
# $1 - filter ipv4
# $2 - filter ipv6 # $2 - filter ipv6
# $3 - queue number # $3 - queue number
nft_fw_nfqws_post4 "$1" $3 nft_fw_nfqws_post4 "$1" "$3"
nft_fw_nfqws_post6 "$2" $3 nft_fw_nfqws_post6 "$2" "$3"
} }
_nft_fw_nfqws_pre4() _nft_fw_nfqws_pre4() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - queue number # $2 - queue number
# $3 - not-empty if wan interface filtering required # $3 - not-empty if wan interface filtering required
@ -515,11 +464,10 @@ _nft_fw_nfqws_pre4()
local filter="$1" port="$2" rule local filter="$1" port="$2" rule
nft_print_op "$filter" "nfqws prerouting (qnum $port)" 4 nft_print_op "$filter" "nfqws prerouting (qnum $port)" 4
rule="${3:+iifname @wanif }$filter ip saddr != @nozapret" rule="${3:+iifname @wanif }$filter ip saddr != @nozapret"
nft_add_rule $(get_prechain) $rule queue num $port bypass nft_add_rule $(get_prechain) "$rule" queue num "$port" bypass
} }
} }
_nft_fw_nfqws_pre6() _nft_fw_nfqws_pre6() {
{
# $1 - filter ipv6 # $1 - filter ipv6
# $2 - queue number # $2 - queue number
# $3 - not-empty if wan interface filtering required # $3 - not-empty if wan interface filtering required
@ -528,35 +476,31 @@ _nft_fw_nfqws_pre6()
local filter="$1" port="$2" rule local filter="$1" port="$2" rule
nft_print_op "$filter" "nfqws prerouting (qnum $port)" 6 nft_print_op "$filter" "nfqws prerouting (qnum $port)" 6
rule="${3:+iifname @wanif6 }$filter ip6 saddr != @nozapret6" rule="${3:+iifname @wanif6 }$filter ip6 saddr != @nozapret6"
nft_add_rule $(get_prechain) $rule queue num $port bypass nft_add_rule $(get_prechain) "$rule" queue num "$port" bypass
} }
} }
nft_fw_nfqws_pre() nft_fw_nfqws_pre() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - filter ipv6 # $2 - filter ipv6
# $3 - queue number # $3 - queue number
nft_fw_nfqws_pre4 "$1" $3 nft_fw_nfqws_pre4 "$1" "$3"
nft_fw_nfqws_pre6 "$2" $3 nft_fw_nfqws_pre6 "$2" "$3"
} }
nft_fw_nfqws_both4() nft_fw_nfqws_both4() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - queue number # $2 - queue number
nft_fw_nfqws_post4 "$@" nft_fw_nfqws_post4 "$@"
nft_fw_nfqws_pre4 "$(nft_reverse_nfqws_rule $1)" $2 nft_fw_nfqws_pre4 "$(nft_reverse_nfqws_rule "$1")" "$2"
} }
nft_fw_nfqws_both6() nft_fw_nfqws_both6() {
{
# $1 - filter ipv6 # $1 - filter ipv6
# $2 - queue number # $2 - queue number
nft_fw_nfqws_post6 "$@" nft_fw_nfqws_post6 "$@"
nft_fw_nfqws_pre6 "$(nft_reverse_nfqws_rule $1)" $2 nft_fw_nfqws_pre6 "$(nft_reverse_nfqws_rule "$1")" "$2"
} }
nft_fw_nfqws_both() nft_fw_nfqws_both() {
{
# $1 - filter ipv4 # $1 - filter ipv4
# $2 - filter ipv6 # $2 - filter ipv6
# $3 - queue number # $3 - queue number
@ -564,26 +508,21 @@ nft_fw_nfqws_both()
nft_fw_nfqws_both6 "$2" "$3" nft_fw_nfqws_both6 "$2" "$3"
} }
zapret_reload_ifsets() zapret_reload_ifsets() {
{ nft_only nft_create_table
nft_only nft_create_table ; nft_fill_ifsets_overload nft_fill_ifsets_overload
return 0 return 0
} }
zapret_list_ifsets() zapret_list_ifsets() {
{
nft_only nft_list_ifsets nft_only nft_list_ifsets
return 0 return 0
} }
zapret_list_table() zapret_list_table() {
{
nft_only nft_list_table nft_only nft_list_table
return 0 return 0
} }
nft_produce_reverse_nfqws_rule() {
nft_produce_reverse_nfqws_rule()
{
local rule="$1" local rule="$1"
if contains "$rule" "$nft_connbytes "; then if contains "$rule" "$nft_connbytes "; then
# autohostlist - need several incoming packets # autohostlist - need several incoming packets
@ -596,28 +535,24 @@ nft_produce_reverse_nfqws_rule()
[ "$range" = 1 ] || range="1-$range" [ "$range" = 1 ] || range="1-$range"
rule="$nft_connbytes $range $rule" rule="$nft_connbytes $range $rule"
fi fi
nft_reverse_nfqws_rule $rule nft_reverse_nfqws_rule "$rule"
} }
nft_fw_reverse_nfqws_rule4() nft_fw_reverse_nfqws_rule4() {
{ nft_fw_nfqws_pre4 "$(nft_produce_reverse_nfqws_rule "$1")" "$2"
nft_fw_nfqws_pre4 "$(nft_produce_reverse_nfqws_rule "$1")" $2
} }
nft_fw_reverse_nfqws_rule6() nft_fw_reverse_nfqws_rule6() {
{ nft_fw_nfqws_pre6 "$(nft_produce_reverse_nfqws_rule "$1")" "$2"
nft_fw_nfqws_pre6 "$(nft_produce_reverse_nfqws_rule "$1")" $2
} }
nft_fw_reverse_nfqws_rule() nft_fw_reverse_nfqws_rule() {
{
# ensure that modes relying on incoming traffic work # ensure that modes relying on incoming traffic work
# $1 - rule4 # $1 - rule4
# $2 - rule6 # $2 - rule6
# $3 - queue number # $3 - queue number
nft_fw_reverse_nfqws_rule4 "$1" $3 nft_fw_reverse_nfqws_rule4 "$1" "$3"
nft_fw_reverse_nfqws_rule6 "$2" $3 nft_fw_reverse_nfqws_rule6 "$2" "$3"
} }
zapret_apply_firewall_rules_nft() zapret_apply_firewall_rules_nft() {
{
local mode="${MODE_OVERRIDE:-$MODE}" local mode="${MODE_OVERRIDE:-$MODE}"
local first_packets_only local first_packets_only
@ -629,12 +564,12 @@ zapret_apply_firewall_rules_nft()
case "$mode" in case "$mode" in
tpws) tpws)
if [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ]; then if [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ]; then
echo both http and https are disabled. not applying redirection. echo both HTTP and HTTPS are disabled. not applying redirection.
else else
nft_filter_apply_port_target f4 nft_filter_apply_port_target f4
f6=$f4 f6=$f4
nft_filter_apply_ipset_target f4 f6 nft_filter_apply_ipset_target f4 f6
nft_fw_tpws "$f4" "$f6" $TPPORT nft_fw_tpws "$f4" "$f6" "$TPPORT"
fi fi
;; ;;
nfqws) nfqws)
@ -647,42 +582,42 @@ zapret_apply_firewall_rules_nft()
nft_filter_apply_port_target f4 nft_filter_apply_port_target f4
f4="$f4 $first_packets_only" f4="$f4 $first_packets_only"
nft_filter_apply_ipset_target4 f4 nft_filter_apply_ipset_target4 f4
nft_fw_nfqws_post4 "$f4 $desync" $qn nft_fw_nfqws_post4 "$f4 $desync" "$qn"
nft_fw_reverse_nfqws_rule4 "$f4" $qn nft_fw_reverse_nfqws_rule4 "$f4" "$qn"
else else
if [ -n "$qn" ]; then if [ -n "$qn" ]; then
f4="tcp dport {$HTTP_PORTS}" f4="tcp dport {$HTTP_PORTS}"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packets_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packets_only"
nft_filter_apply_ipset_target4 f4 nft_filter_apply_ipset_target4 f4
nft_fw_nfqws_post4 "$f4 $desync" $qn nft_fw_nfqws_post4 "$f4 $desync" "$qn"
nft_fw_reverse_nfqws_rule4 "$f4" $qn nft_fw_reverse_nfqws_rule4 "$f4" "$qn"
fi fi
if [ -n "$qns" ]; then if [ -n "$qns" ]; then
f4="tcp dport {$HTTPS_PORTS} $first_packets_only" f4="tcp dport {$HTTPS_PORTS} $first_packets_only"
nft_filter_apply_ipset_target4 f4 nft_filter_apply_ipset_target4 f4
nft_fw_nfqws_post4 "$f4 $desync" $qns nft_fw_nfqws_post4 "$f4 $desync" "$qns"
nft_fw_reverse_nfqws_rule4 "$f4" $qns nft_fw_reverse_nfqws_rule4 "$f4" "$qns"
fi fi
fi fi
if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn6" ] && [ "$qn6" = "$qns6" ]; then if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn6" ] && [ "$qn6" = "$qns6" ]; then
nft_filter_apply_port_target f6 nft_filter_apply_port_target f6
f6="$f6 $first_packets_only" f6="$f6 $first_packets_only"
nft_filter_apply_ipset_target6 f6 nft_filter_apply_ipset_target6 f6
nft_fw_nfqws_post6 "$f6 $desync" $qn6 nft_fw_nfqws_post6 "$f6 $desync" "$qn6"
nft_fw_reverse_nfqws_rule6 "$f6" $qn6 nft_fw_reverse_nfqws_rule6 "$f6" "$qn6"
else else
if [ -n "$qn6" ]; then if [ -n "$qn6" ]; then
f6="tcp dport {$HTTP_PORTS}" f6="tcp dport {$HTTP_PORTS}"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packets_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packets_only"
nft_filter_apply_ipset_target6 f6 nft_filter_apply_ipset_target6 f6
nft_fw_nfqws_post6 "$f6 $desync" $qn6 nft_fw_nfqws_post6 "$f6 $desync" "$qn6"
nft_fw_reverse_nfqws_rule6 "$f6" $qn6 nft_fw_reverse_nfqws_rule6 "$f6" "$qn6"
fi fi
if [ -n "$qns6" ]; then if [ -n "$qns6" ]; then
f6="tcp dport {$HTTPS_PORTS} $first_packets_only" f6="tcp dport {$HTTPS_PORTS} $first_packets_only"
nft_filter_apply_ipset_target6 f6 nft_filter_apply_ipset_target6 f6
nft_fw_nfqws_post6 "$f6 $desync" $qns6 nft_fw_nfqws_post6 "$f6 $desync" "$qns6"
nft_fw_reverse_nfqws_rule6 "$f6" $qns6 nft_fw_reverse_nfqws_rule6 "$f6" "$qns6"
fi fi
fi fi
@ -692,14 +627,14 @@ zapret_apply_firewall_rules_nft()
nft_filter_apply_port_target_quic f4 nft_filter_apply_port_target_quic f4
f4="$f4 $first_packets_only" f4="$f4 $first_packets_only"
nft_filter_apply_ipset_target4 f4 nft_filter_apply_ipset_target4 f4
nft_fw_nfqws_post4 "$f4 $desync" $qn nft_fw_nfqws_post4 "$f4 $desync" "$qn"
fi fi
if [ -n "$qn6" ]; then if [ -n "$qn6" ]; then
f6= f6=
nft_filter_apply_port_target_quic f6 nft_filter_apply_port_target_quic f6
f6="$f6 $first_packets_only" f6="$f6 $first_packets_only"
nft_filter_apply_ipset_target6 f6 nft_filter_apply_ipset_target6 f6
nft_fw_nfqws_post6 "$f6 $desync" $qn6 nft_fw_nfqws_post6 "$f6 $desync" "$qn6"
fi fi
POSTNAT=$POSTNAT_SAVE POSTNAT=$POSTNAT_SAVE
@ -710,8 +645,7 @@ zapret_apply_firewall_rules_nft()
esac esac
} }
zapret_apply_firewall_nft() zapret_apply_firewall_nft() {
{
echo Applying nftables echo Applying nftables
local mode="${MODE_OVERRIDE:-$MODE}" local mode="${MODE_OVERRIDE:-$MODE}"
@ -728,16 +662,14 @@ zapret_apply_firewall_nft()
return 0 return 0
} }
zapret_unapply_firewall_nft() zapret_unapply_firewall_nft() {
{
echo Clearing nftables echo Clearing nftables
unprepare_route_localnet unprepare_route_localnet
nft_del_firewall nft_del_firewall
return 0 return 0
} }
zapret_do_firewall_nft() zapret_do_firewall_nft() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
if [ "$1" = 0 ]; then if [ "$1" = 0 ]; then

56
common/pf.sh
View File

@ -6,14 +6,12 @@ PF_ANCHOR_ZAPRET_V6="$PF_ANCHOR_DIR/zapret-v6"
std_ports std_ports
pf_anchor_root_reload() pf_anchor_root_reload() {
{
echo reloading PF root anchor echo reloading PF root anchor
pfctl -qf "$PF_MAIN" pfctl -qf "$PF_MAIN"
} }
pf_anchor_root() pf_anchor_root() {
{
local patch local patch
[ -f "$PF_MAIN" ] && { [ -f "$PF_MAIN" ] && {
grep -q '^rdr-anchor "zapret"$' "$PF_MAIN" || { grep -q '^rdr-anchor "zapret"$' "$PF_MAIN" || {
@ -57,13 +55,11 @@ set limit table-entries 5000000
echo ---------------------------------- echo ----------------------------------
return 1 return 1
} }
pf_anchor_root_del() pf_anchor_root_del() {
{
sed -i '' -e '/^anchor "zapret"$/d' -e '/^rdr-anchor "zapret"$/d' -e '/^set limit table-entries/d' "$PF_MAIN" sed -i '' -e '/^anchor "zapret"$/d' -e '/^rdr-anchor "zapret"$/d' -e '/^set limit table-entries/d' "$PF_MAIN"
} }
pf_anchor_zapret() pf_anchor_zapret() {
{
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
if [ -f "$ZIPLIST_EXCLUDE" ]; then if [ -f "$ZIPLIST_EXCLUDE" ]; then
echo "table <nozapret> persist file \"$ZIPLIST_EXCLUDE\"" echo "table <nozapret> persist file \"$ZIPLIST_EXCLUDE\""
@ -83,8 +79,7 @@ pf_anchor_zapret()
[ "$DISABLE_IPV4" = "1" ] || echo "anchor \"/zapret-v4\" inet to !<nozapret>" [ "$DISABLE_IPV4" = "1" ] || echo "anchor \"/zapret-v4\" inet to !<nozapret>"
[ "$DISABLE_IPV6" = "1" ] || echo "anchor \"/zapret-v6\" inet6 to !<nozapret6>" [ "$DISABLE_IPV6" = "1" ] || echo "anchor \"/zapret-v6\" inet6 to !<nozapret6>"
} }
pf_anchor_zapret_tables() pf_anchor_zapret_tables() {
{
# $1 - variable to receive applied table names # $1 - variable to receive applied table names
# $2/$3 $4/$5 ... table_name/table_file # $2/$3 $4/$5 ... table_name/table_file
local tblv=$1 local tblv=$1
@ -104,10 +99,9 @@ pf_anchor_zapret_tables()
} }
[ -n "$_tbl" ] || _tbl="any" [ -n "$_tbl" ] || _tbl="any"
eval $tblv="\"\$_tbl\"" eval "$tblv"="\"\$_tbl\""
} }
pf_anchor_port_target() pf_anchor_port_target() {
{
if [ "$MODE_HTTP" = "1" ] && [ "$MODE_HTTPS" = "1" ]; then if [ "$MODE_HTTP" = "1" ] && [ "$MODE_HTTPS" = "1" ]; then
echo "{$HTTP_PORTS_IPT,$HTTPS_PORTS_IPT}" echo "{$HTTP_PORTS_IPT,$HTTPS_PORTS_IPT}"
elif [ "$MODE_HTTPS" = "1" ]; then elif [ "$MODE_HTTPS" = "1" ]; then
@ -117,8 +111,7 @@ pf_anchor_port_target()
fi fi
} }
pf_anchor_zapret_v4_tpws() pf_anchor_zapret_v4_tpws() {
{
# $1 - port # $1 - port
local rule port=$(pf_anchor_port_target) local rule port=$(pf_anchor_port_target)
@ -140,15 +133,14 @@ pf_anchor_zapret_v4_tpws()
done done
} }
pf_anchor_zapret_v4() pf_anchor_zapret_v4() {
{
local tbl port local tbl port
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
case $MODE in case $MODE in
tpws) tpws)
[ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ] && return [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ] && return
pf_anchor_zapret_tables tbl zapret-user "$ZIPLIST_USER" zapret "$ZIPLIST" pf_anchor_zapret_tables tbl zapret-user "$ZIPLIST_USER" zapret "$ZIPLIST"
pf_anchor_zapret_v4_tpws $TPPORT pf_anchor_zapret_v4_tpws "$TPPORT"
;; ;;
custom) custom)
pf_anchor_zapret_tables tbl zapret-user "$ZIPLIST_USER" zapret "$ZIPLIST" pf_anchor_zapret_tables tbl zapret-user "$ZIPLIST_USER" zapret "$ZIPLIST"
@ -157,14 +149,13 @@ pf_anchor_zapret_v4()
esac esac
} }
} }
pf_anchor_zapret_v6_tpws() pf_anchor_zapret_v6_tpws() {
{
# $1 - port # $1 - port
local LL_LAN rule port=$(pf_anchor_port_target) local LL_LAN rule port=$(pf_anchor_port_target)
# LAN link local is only for router # LAN link local is only for router
for lan in $IFACE_LAN; do for lan in $IFACE_LAN; do
LL_LAN=$(get_ipv6_linklocal $lan) LL_LAN=$(get_ipv6_linklocal "$lan")
[ -n "$LL_LAN" ] && { [ -n "$LL_LAN" ] && {
for t in $tbl; do for t in $tbl; do
echo "rdr on $lan inet6 proto tcp from any to $t port $port -> $LL_LAN port $1" echo "rdr on $lan inet6 proto tcp from any to $t port $port -> $LL_LAN port $1"
@ -183,8 +174,7 @@ pf_anchor_zapret_v6_tpws()
fi fi
done done
} }
pf_anchor_zapret_v6() pf_anchor_zapret_v6() {
{
local tbl port local tbl port
[ "$DISABLE_IPV6" = "1" ] || { [ "$DISABLE_IPV6" = "1" ] || {
@ -192,7 +182,7 @@ pf_anchor_zapret_v6()
tpws) tpws)
[ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ] && return [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ] && return
pf_anchor_zapret_tables tbl zapret6-user "$ZIPLIST_USER6" zapret6 "$ZIPLIST6" pf_anchor_zapret_tables tbl zapret6-user "$ZIPLIST_USER6" zapret6 "$ZIPLIST6"
pf_anchor_zapret_v6_tpws $TPPORT pf_anchor_zapret_v6_tpws "$TPPORT"
;; ;;
custom) custom)
pf_anchor_zapret_tables tbl zapret6-user "$ZIPLIST_USER6" zapret6 "$ZIPLIST6" pf_anchor_zapret_tables tbl zapret6-user "$ZIPLIST_USER6" zapret6 "$ZIPLIST6"
@ -202,19 +192,16 @@ pf_anchor_zapret_v6()
} }
} }
pf_anchors_create() pf_anchors_create() {
{
wait_lan_ll wait_lan_ll
pf_anchor_zapret >"$PF_ANCHOR_ZAPRET" pf_anchor_zapret >"$PF_ANCHOR_ZAPRET"
pf_anchor_zapret_v4 >"$PF_ANCHOR_ZAPRET_V4" pf_anchor_zapret_v4 >"$PF_ANCHOR_ZAPRET_V4"
pf_anchor_zapret_v6 >"$PF_ANCHOR_ZAPRET_V6" pf_anchor_zapret_v6 >"$PF_ANCHOR_ZAPRET_V6"
} }
pf_anchors_del() pf_anchors_del() {
{
rm -f "$PF_ANCHOR_ZAPRET" "$PF_ANCHOR_ZAPRET_V4" "$PF_ANCHOR_ZAPRET_V6" rm -f "$PF_ANCHOR_ZAPRET" "$PF_ANCHOR_ZAPRET_V4" "$PF_ANCHOR_ZAPRET_V6"
} }
pf_anchors_load() pf_anchors_load() {
{
echo loading zapret anchor from "$PF_ANCHOR_ZAPRET" echo loading zapret anchor from "$PF_ANCHOR_ZAPRET"
pfctl -qa zapret -f "$PF_ANCHOR_ZAPRET" || { pfctl -qa zapret -f "$PF_ANCHOR_ZAPRET" || {
echo error loading zapret anchor echo error loading zapret anchor
@ -243,20 +230,17 @@ pf_anchors_load()
echo successfully loaded PF anchors echo successfully loaded PF anchors
return 0 return 0
} }
pf_anchors_clear() pf_anchors_clear() {
{
echo clearing zapret anchors echo clearing zapret anchors
pfctl -qa zapret-v4 -F all 2>/dev/null pfctl -qa zapret-v4 -F all 2>/dev/null
pfctl -qa zapret-v6 -F all 2>/dev/null pfctl -qa zapret-v6 -F all 2>/dev/null
pfctl -qa zapret -F all 2>/dev/null pfctl -qa zapret -F all 2>/dev/null
} }
pf_enable() pf_enable() {
{
echo enabling PF echo enabling PF
pfctl -qe pfctl -qe
} }
pf_table_reload() pf_table_reload() {
{
echo reloading zapret tables echo reloading zapret tables
[ "$DISABLE_IPV4" = "1" ] || pfctl -qTl -a zapret-v4 -f "$PF_ANCHOR_ZAPRET_V4" [ "$DISABLE_IPV4" = "1" ] || pfctl -qTl -a zapret-v4 -f "$PF_ANCHOR_ZAPRET_V4"
[ "$DISABLE_IPV6" = "1" ] || pfctl -qTl -a zapret-v6 -f "$PF_ANCHOR_ZAPRET_V6" [ "$DISABLE_IPV6" = "1" ] || pfctl -qTl -a zapret-v6 -f "$PF_ANCHOR_ZAPRET_V6"

45
common/queue.sh
View File

@ -1,5 +1,4 @@
apply_unspecified_desync_modes() apply_unspecified_desync_modes() {
{
NFQWS_OPT_DESYNC_HTTP="${NFQWS_OPT_DESYNC_HTTP:-$NFQWS_OPT_DESYNC}" NFQWS_OPT_DESYNC_HTTP="${NFQWS_OPT_DESYNC_HTTP:-$NFQWS_OPT_DESYNC}"
NFQWS_OPT_DESYNC_HTTPS="${NFQWS_OPT_DESYNC_HTTPS:-$NFQWS_OPT_DESYNC}" NFQWS_OPT_DESYNC_HTTPS="${NFQWS_OPT_DESYNC_HTTPS:-$NFQWS_OPT_DESYNC}"
NFQWS_OPT_DESYNC_HTTP6="${NFQWS_OPT_DESYNC_HTTP6:-$NFQWS_OPT_DESYNC_HTTP}" NFQWS_OPT_DESYNC_HTTP6="${NFQWS_OPT_DESYNC_HTTP6:-$NFQWS_OPT_DESYNC_HTTP}"
@ -7,8 +6,7 @@ apply_unspecified_desync_modes()
NFQWS_OPT_DESYNC_QUIC6="${NFQWS_OPT_DESYNC_QUIC6:-$NFQWS_OPT_DESYNC_QUIC}" NFQWS_OPT_DESYNC_QUIC6="${NFQWS_OPT_DESYNC_QUIC6:-$NFQWS_OPT_DESYNC_QUIC}"
} }
get_nfqws_qnums() get_nfqws_qnums() {
{
# $1 - var name for ipv4 http # $1 - var name for ipv4 http
# $2 - var name for ipv4 https # $2 - var name for ipv4 https
# $3 - var name for ipv6 http # $3 - var name for ipv6 http
@ -25,36 +23,35 @@ get_nfqws_qnums()
_qns6=$(($QNUM + 3)) _qns6=$(($QNUM + 3))
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
if [ "$NFQWS_OPT_DESYNC_HTTP6" = "$NFQWS_OPT_DESYNC_HTTP" ]; then if [ "$NFQWS_OPT_DESYNC_HTTP6" = "$NFQWS_OPT_DESYNC_HTTP" ]; then
_qn6=$_qn; _qn6=$_qn
elif [ "$NFQWS_OPT_DESYNC_HTTP6" = "$NFQWS_OPT_DESYNC_HTTPS" ]; then elif [ "$NFQWS_OPT_DESYNC_HTTP6" = "$NFQWS_OPT_DESYNC_HTTPS" ]; then
_qn6=$_qns; _qn6=$_qns
fi fi
if [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP" ]; then if [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP" ]; then
_qns6=$_qn; _qns6=$_qn
elif [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTPS" ]; then elif [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTPS" ]; then
_qns6=$_qns; _qns6=$_qns
fi fi
} }
[ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP6" ] && _qns6=$_qn6; [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP6" ] && _qns6=$_qn6
} }
if [ "$MODE_HTTP" = 1 ]; then if [ "$MODE_HTTP" = 1 ]; then
eval $1=$_qn eval "$1"="$_qn"
eval $3=$_qn6 eval "$3"="$_qn6"
else else
eval $1= eval "$1"=
eval $3= eval "$3"=
fi fi
if [ "$MODE_HTTPS" = 1 ]; then if [ "$MODE_HTTPS" = 1 ]; then
eval $2=$_qns eval "$2"="$_qns"
eval $4=$_qns6 eval "$4"="$_qns6"
else else
eval $2= eval "$2"=
eval $4= eval "$4"=
fi fi
} }
get_nfqws_qnums_quic() get_nfqws_qnums_quic() {
{
# $1 - var name for ipv4 quic # $1 - var name for ipv4 quic
# $2 - var name for ipv6 quic # $2 - var name for ipv6 quic
local _qn _qn6 local _qn _qn6
@ -66,15 +63,15 @@ get_nfqws_qnums_quic()
_qn6=$(($QNUM + 11)) _qn6=$(($QNUM + 11))
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
if [ "$NFQWS_OPT_DESYNC_QUIC" = "$NFQWS_OPT_DESYNC_QUIC6" ]; then if [ "$NFQWS_OPT_DESYNC_QUIC" = "$NFQWS_OPT_DESYNC_QUIC6" ]; then
_qn6=$_qn; _qn6=$_qn
fi fi
} }
} }
if [ "$MODE_QUIC" = 1 ]; then if [ "$MODE_QUIC" = 1 ]; then
eval $1=$_qn eval "$1"=$_qn
eval $2=$_qn6 eval "$2"=$_qn6
else else
eval $1= eval "$1"=
eval $2= eval "$2"=
fi fi
} }

6
common/virt.sh
View File

@ -1,5 +1,4 @@
get_virt() get_virt() {
{
local vm s v UNAME local vm s v UNAME
UNAME=$(uname) UNAME=$(uname)
case "$UNAME" in case "$UNAME" in
@ -21,8 +20,7 @@ get_virt()
esac esac
echo "$vm" | awk '{print tolower($0)}' echo "$vm" | awk '{print tolower($0)}'
} }
check_virt() check_virt() {
{
echo \* checking virtualization echo \* checking virtualization
local vm="$(get_virt)" local vm="$(get_virt)"
if [ -n "$vm" ]; then if [ -n "$vm" ]; then

11
init.d/macos/custom-tpws
View File

@ -2,24 +2,21 @@
TPPORT_MY=987 TPPORT_MY=987
zapret_custom_daemons() zapret_custom_daemons() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local opt="--user=root --port=$TPPORT_MY" local opt="--user=root --port=$TPPORT_MY"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
tpws_apply_binds opt tpws_apply_binds opt
opt="$opt $TPWS_OPT" opt="$opt $TPWS_OPT"
do_daemon $1 1 "$TPWS" "$opt" do_daemon "$1" 1 "$TPWS" "$opt"
} }
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors # custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... # they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ...
zapret_custom_firewall_v4() zapret_custom_firewall_v4() {
{
pf_anchor_zapret_v4_tpws $TPPORT_MY pf_anchor_zapret_v4_tpws $TPPORT_MY
} }
zapret_custom_firewall_v6() zapret_custom_firewall_v6() {
{
pf_anchor_zapret_v6_tpws $TPPORT_MY pf_anchor_zapret_v6_tpws $TPPORT_MY
} }

9
init.d/macos/custom.default
View File

@ -2,8 +2,7 @@
# use helpers from "functions" file # use helpers from "functions" file
# in case of upgrade keep this file only, do not modify others # in case of upgrade keep this file only, do not modify others
zapret_custom_daemons() zapret_custom_daemons() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
: :
} }
@ -11,11 +10,9 @@ zapret_custom_daemons()
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors # custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... # they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ...
zapret_custom_firewall_v4() zapret_custom_firewall_v4() {
{
: :
} }
zapret_custom_firewall_v6() zapret_custom_firewall_v6() {
{
: :
} }

84
init.d/macos/functions
View File

@ -21,8 +21,7 @@ TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/macos/custom" CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/macos/custom"
[ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT" [ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT"
run_daemon() run_daemon() {
{
# $1 - daemon number : 1,2,3,... # $1 - daemon number : 1,2,3,...
# $2 - daemon # $2 - daemon
# $3 - daemon args # $3 - daemon args
@ -31,14 +30,13 @@ run_daemon()
local PIDFILE="$PIDDIR/$DAEMONBASE$1.pid" local PIDFILE="$PIDDIR/$DAEMONBASE$1.pid"
local ARGS="--daemon --pidfile=$PIDFILE $3" local ARGS="--daemon --pidfile=$PIDFILE $3"
[ -f "$PIDFILE" ] && pgrep -qF "$PIDFILE" && { [ -f "$PIDFILE" ] && pgrep -qF "$PIDFILE" && {
echo Already running $1: $2 echo Already running "$1": "$2"
return 0 return 0
} }
echo "Starting daemon $1: $2 $ARGS" echo "Starting daemon $1: $2 $ARGS"
"$2" $ARGS "$2" "$ARGS"
} }
stop_daemon() stop_daemon() {
{
# $1 - daemon number : 1,2,3,... # $1 - daemon number : 1,2,3,...
# $2 - daemon # $2 - daemon
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile # use $PIDDIR/$DAEMONBASE$1.pid as pidfile
@ -49,19 +47,17 @@ stop_daemon()
[ -f "$PIDFILE" ] && read PID <"$PIDFILE" [ -f "$PIDFILE" ] && read PID <"$PIDFILE"
[ -n "$PID" ] && { [ -n "$PID" ] && {
echo "Stopping daemon $1: $2 (PID=$PID)" echo "Stopping daemon $1: $2 (PID=$PID)"
kill $PID kill "$PID"
rm -f "$PIDFILE" rm -f "$PIDFILE"
} }
return 0 return 0
} }
do_daemon() do_daemon() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
on_off_function run_daemon stop_daemon "$@" on_off_function run_daemon stop_daemon "$@"
} }
tpws_apply_binds() tpws_apply_binds() {
{
local o local o
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1" [ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1"
[ "$DISABLE_IPV6" = "1" ] || { [ "$DISABLE_IPV6" = "1" ] || {
@ -69,10 +65,9 @@ tpws_apply_binds()
o="$o --bind-iface6=$i --bind-linklocal=force $TPWS_WAIT" o="$o --bind-iface6=$i --bind-linklocal=force $TPWS_WAIT"
done done
} }
eval $1="\"\$$1 $o\"" eval "$1"="\"\$$1 $o\""
} }
tpws_apply_socks_binds() tpws_apply_socks_binds() {
{
local o local o
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1" [ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1"
@ -82,19 +77,17 @@ tpws_apply_socks_binds()
[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT" [ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT"
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6" [ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
done done
eval $1="\"\$$1 $o\"" eval "$1"="\"\$$1 $o\""
} }
wait_interface_ll() wait_interface_ll() {
{ echo waiting for an IPv6 link local address on "$1" ...
echo waiting for an ipv6 link local address on $1 ... "$TPWS" --bind-wait-only --bind-iface6="$1" --bind-linklocal=force "$TPWS_WAIT"
"$TPWS" --bind-wait-only --bind-iface6=$1 --bind-linklocal=force $TPWS_WAIT
} }
wait_lan_ll() wait_lan_ll() {
{
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" != "1" ] && {
for lan in $IFACE_LAN; do for lan in $IFACE_LAN; do
wait_interface_ll $lan >&2 || { wait_interface_ll "$lan" >&2 || {
echo "wait interface failed on $lan" echo "wait interface failed on $lan"
return 1 return 1
} }
@ -102,14 +95,11 @@ wait_lan_ll()
} }
return 0 return 0
} }
get_ipv6_linklocal() get_ipv6_linklocal() {
{ ifconfig "$1" | sed -nEe 's/^.*inet6 (fe80:[a-f0-9:]+).*/\1/p'
ifconfig $1 | sed -nEe 's/^.*inet6 (fe80:[a-f0-9:]+).*/\1/p'
} }
zapret_do_firewall() {
zapret_do_firewall()
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
[ "$1" = 1 -a -n "$INIT_FW_PRE_UP_HOOK" ] && $INIT_FW_PRE_UP_HOOK [ "$1" = 1 -a -n "$INIT_FW_PRE_UP_HOOK" ] && $INIT_FW_PRE_UP_HOOK
@ -133,24 +123,18 @@ zapret_do_firewall()
return 0 return 0
} }
zapret_apply_firewall() zapret_apply_firewall() {
{
zapret_do_firewall 1 "$@" zapret_do_firewall 1 "$@"
} }
zapret_unapply_firewall() zapret_unapply_firewall() {
{
zapret_do_firewall 0 "$@" zapret_do_firewall 0 "$@"
} }
zapret_restart_firewall() zapret_restart_firewall() {
{
zapret_unapply_firewall "$@" zapret_unapply_firewall "$@"
zapret_apply_firewall "$@" zapret_apply_firewall "$@"
} }
zapret_do_daemons() {
zapret_do_daemons()
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local opt local opt
@ -158,31 +142,30 @@ zapret_do_daemons()
case "${MODE_OVERRIDE:-$MODE}" in case "${MODE_OVERRIDE:-$MODE}" in
tpws) tpws)
[ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && { [ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && {
echo "both ipv4 and ipv6 are disabled. nothing to do" echo "both IPv4 and IPv6 are disabled. nothing to do"
return 0 return 0
} }
# MacOS requires root. kernel hardcoded requirement for /dev/pf ioctls # macOS requires root. kernel hardcoded requirement for /dev/pf ioctls
opt="--user=root --port=$TPPORT" opt="--user=root --port=$TPPORT"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
tpws_apply_binds opt tpws_apply_binds opt
opt="$opt $TPWS_OPT" opt="$opt $TPWS_OPT"
do_daemon $1 1 "$TPWS" "$opt" do_daemon "$1" 1 "$TPWS" "$opt"
;; ;;
tpws-socks) tpws-socks)
[ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && { [ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && {
echo "both ipv4 and ipv6 are disabled. nothing to do" echo "both IPv4 and IPv6 are disabled. nothing to do"
return 0 return 0
} }
opt="--socks --user=$WS_USER --port=$TPPORT" opt="--socks --user=$WS_USER --port=$TPPORT"
tpws_apply_socks_binds opt tpws_apply_socks_binds opt
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
opt="$opt $TPWS_OPT" opt="$opt $TPWS_OPT"
do_daemon $1 1 "$TPWS" "$opt" do_daemon "$1" 1 "$TPWS" "$opt"
;;
filter)
;; ;;
filter) ;;
custom) custom)
existf zapret_custom_daemons && zapret_custom_daemons $1 existf zapret_custom_daemons && zapret_custom_daemons "$1"
;; ;;
*) *)
echo "unsupported MODE=$MODE" echo "unsupported MODE=$MODE"
@ -192,16 +175,13 @@ zapret_do_daemons()
return 0 return 0
} }
zapret_run_daemons() zapret_run_daemons() {
{
zapret_do_daemons 1 "$@" zapret_do_daemons 1 "$@"
} }
zapret_stop_daemons() zapret_stop_daemons() {
{
zapret_do_daemons 0 "$@" zapret_do_daemons 0 "$@"
} }
zapret_restart_daemons() zapret_restart_daemons() {
{
zapret_stop_daemons "$@" zapret_stop_daemons "$@"
zapret_run_daemons "$@" zapret_run_daemons "$@"
} }

5
init.d/macos/zapret
View File

@ -2,7 +2,10 @@
EXEDIR="$(dirname "$0")" EXEDIR="$(dirname "$0")"
ZAPRET_BASE="$EXEDIR/../.." ZAPRET_BASE="$EXEDIR/../.."
ZAPRET_BASE="$(cd "$ZAPRET_BASE"; pwd)" ZAPRET_BASE="$(
cd "$ZAPRET_BASE"
pwd
)"
. "$EXEDIR/functions" . "$EXEDIR/functions"

38
init.d/openrc/zapret
View File

@ -4,7 +4,10 @@
# on some systems (alpine) for unknown reason non-openrc-run scripts are not started from /etc/init.d # on some systems (alpine) for unknown reason non-openrc-run scripts are not started from /etc/init.d
EXEDIR=$(dirname "$RC_SERVICE") EXEDIR=$(dirname "$RC_SERVICE")
EXEDIR="$(cd "$EXEDIR"; pwd)" EXEDIR="$(
cd "$EXEDIR"
pwd
)"
ZAPRET_BASE="$EXEDIR/../.." ZAPRET_BASE="$EXEDIR/../.."
ZAPRET_INIT="$ZAPRET_BASE/init.d/sysv/zapret" ZAPRET_INIT="$ZAPRET_BASE/init.d/sysv/zapret"
@ -23,47 +26,36 @@ description_restart_daemons="Restart zapret firewall only"
depend() { depend() {
rc-service -e networking && need networking rc-service -e networking && need networking
} }
start() start() {
{
"$ZAPRET_INIT" start "$ZAPRET_INIT" start
} }
stop() stop() {
{
"$ZAPRET_INIT" stop "$ZAPRET_INIT" stop
} }
start_fw() start_fw() {
{
"$ZAPRET_INIT" start_fw "$ZAPRET_INIT" start_fw
} }
stop_fw() stop_fw() {
{
"$ZAPRET_INIT" stop_fw "$ZAPRET_INIT" stop_fw
} }
restart_fw() restart_fw() {
{
"$ZAPRET_INIT" restart_fw "$ZAPRET_INIT" restart_fw
} }
start_daemons() start_daemons() {
{
"$ZAPRET_INIT" start_daemons "$ZAPRET_INIT" start_daemons
} }
stop_daemons() stop_daemons() {
{
"$ZAPRET_INIT" stop_daemons "$ZAPRET_INIT" stop_daemons
} }
restart_daemons() restart_daemons() {
{
"$ZAPRET_INIT" restart_daemons "$ZAPRET_INIT" restart_daemons
} }
reload_ifsets() reload_ifsets() {
{
"$ZAPRET_INIT" reload_ifsets "$ZAPRET_INIT" reload_ifsets
} }
list_ifsets() list_ifsets() {
{
"$ZAPRET_INIT" list_ifsets "$ZAPRET_INIT" list_ifsets
} }
list_table() list_table() {
{
"$ZAPRET_INIT" list_table "$ZAPRET_INIT" list_table
} }

15
init.d/openwrt/90-zapret
View File

@ -2,8 +2,7 @@
ZAPRET=/etc/init.d/zapret ZAPRET=/etc/init.d/zapret
check_lan() check_lan() {
{
IS_LAN= IS_LAN=
[ -n "$OPENWRT_LAN" ] || OPENWRT_LAN=lan [ -n "$OPENWRT_LAN" ] || OPENWRT_LAN=lan
for lan in $OPENWRT_LAN; do for lan in $OPENWRT_LAN; do
@ -13,8 +12,7 @@ check_lan()
} }
done done
} }
check_need_to_reload_tpws6() check_need_to_reload_tpws6() {
{
# tpws6 dnat target nft map can only be reloaded within firewall apply procedure # tpws6 dnat target nft map can only be reloaded within firewall apply procedure
# interface ifsets (wanif, wanif6, lanif) can be reloaded independently # interface ifsets (wanif, wanif6, lanif) can be reloaded independently
check_lan check_lan
@ -22,7 +20,6 @@ check_need_to_reload_tpws6()
[ "$ACTION" = "ifup" -a "$DISABLE_IPV6" != 1 -a -n "$IS_LAN" ] && [ "$MODE" = "tpws" -o "$MODE" = "custom" ] && RELOAD_TPWS6=1 [ "$ACTION" = "ifup" -a "$DISABLE_IPV6" != 1 -a -n "$IS_LAN" ] && [ "$MODE" = "tpws" -o "$MODE" = "custom" ] && RELOAD_TPWS6=1
} }
[ -n "$INTERFACE" ] && [ "$ACTION" = ifup -o "$ACTION" = ifdown ] && [ -x "$ZAPRET" ] && "$ZAPRET" enabled && { [ -n "$INTERFACE" ] && [ "$ACTION" = ifup -o "$ACTION" = ifdown ] && [ -x "$ZAPRET" ] && "$ZAPRET" enabled && {
SCRIPT=$(readlink "$ZAPRET") SCRIPT=$(readlink "$ZAPRET")
if [ -n "$SCRIPT" ]; then if [ -n "$SCRIPT" ]; then
@ -37,7 +34,7 @@ check_need_to_reload_tpws6()
check_need_to_reload_tpws6 check_need_to_reload_tpws6
[ -n "$RELOAD_TPWS6" ] && { [ -n "$RELOAD_TPWS6" ] && {
logger -t zapret restarting daemons due to $ACTION of $INTERFACE to update tpws6 dnat target logger -t zapret restarting daemons due to "$ACTION" of "$INTERFACE" to update tpws6 dnat target
"$ZAPRET" restart_daemons "$ZAPRET" restart_daemons
} }
. "$ZAPRET_BASE/common/base.sh" . "$ZAPRET_BASE/common/base.sh"
@ -46,16 +43,16 @@ check_need_to_reload_tpws6()
case "$FWTYPE" in case "$FWTYPE" in
nftables) nftables)
if [ -n "$RELOAD_TPWS6" ]; then if [ -n "$RELOAD_TPWS6" ]; then
logger -t zapret reloading nftables due to $ACTION of $INTERFACE to update tpws6 dnat target logger -t zapret reloading nftables due to "$ACTION" of "$INTERFACE" to update tpws6 dnat target
"$ZAPRET" restart_fw "$ZAPRET" restart_fw
else else
logger -t zapret reloading nftables ifsets due to $ACTION of $INTERFACE logger -t zapret reloading nftables ifsets due to "$ACTION" of "$INTERFACE"
"$ZAPRET" reload_ifsets "$ZAPRET" reload_ifsets
fi fi
;; ;;
iptables) iptables)
openwrt_fw3 || { openwrt_fw3 || {
logger -t zapret reloading iptables due to $ACTION of $INTERFACE logger -t zapret reloading iptables due to "$ACTION" of "$INTERFACE"
"$ZAPRET" restart_fw "$ZAPRET" restart_fw
} }
;; ;;

15
init.d/openwrt/custom-nfqws-dht4all
View File

@ -3,8 +3,7 @@
QNUM2=$(($QNUM + 20)) QNUM2=$(($QNUM + 20))
zapret_custom_daemons() zapret_custom_daemons() {
{
# stop logic is managed by procd # stop logic is managed by procd
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -13,10 +12,9 @@ zapret_custom_daemons()
start_daemons_procd start_daemons_procd
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
run_daemon 100 $NFQWS "$opt" run_daemon 100 "$NFQWS" "$opt"
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -24,15 +22,14 @@ zapret_custom_firewall()
local first_packet_only="$ipt_connbytes 1:1" local first_packet_only="$ipt_connbytes 1:1"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
zapret_do_firewall_rules_ipt $1 zapret_do_firewall_rules_ipt "$1"
f='-p udp -m length --length 109:407 -m u32 --u32' f='-p udp -m length --length 109:407 -m u32 --u32'
uf4='0>>22&0x3C@8>>16=0x6431' uf4='0>>22&0x3C@8>>16=0x6431'
uf6='48>>16=0x6431' uf6='48>>16=0x6431'
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 fw_nfqws_post "$1" "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws

15
init.d/openwrt/custom-nfqws-quic4all
View File

@ -4,8 +4,7 @@
QNUM2=$(($QNUM + 10)) QNUM2=$(($QNUM + 10))
zapret_custom_daemons() zapret_custom_daemons() {
{
# stop logic is managed by procd # stop logic is managed by procd
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -14,10 +13,9 @@ zapret_custom_daemons()
start_daemons_procd start_daemons_procd
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
run_daemon 100 $NFQWS "$opt" run_daemon 100 "$NFQWS" "$opt"
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -25,14 +23,13 @@ zapret_custom_firewall()
local first_packets_only="$ipt_connbytes 1:3" local first_packets_only="$ipt_connbytes 1:3"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
zapret_do_firewall_rules_ipt $1 zapret_do_firewall_rules_ipt "$1"
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 fw_nfqws_post "$1" "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws

13
init.d/openwrt/custom-reuse-builtin-mode
View File

@ -4,8 +4,7 @@ MY_TPPORT=$(($TPPORT + 1))
MY_TPWS_OPT="--methodeol --hostcase" MY_TPWS_OPT="--methodeol --hostcase"
MY_DPORT=81 MY_DPORT=81
zapret_custom_daemons() zapret_custom_daemons() {
{
# stop logic is managed by procd # stop logic is managed by procd
local MODE_OVERRIDE=tpws local MODE_OVERRIDE=tpws
@ -17,22 +16,20 @@ zapret_custom_daemons()
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
run_tpws 100 "$opt" run_tpws 100 "$opt"
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=tpws local MODE_OVERRIDE=tpws
local f4 f6 local f4 f6
zapret_do_firewall_rules_ipt $1 zapret_do_firewall_rules_ipt "$1"
f4="-p tcp --dport $MY_DPORT" f4="-p tcp --dport $MY_DPORT"
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_tpws $1 "$f4" "$f6" $MY_TPPORT fw_tpws "$1" "$f4" "$f6" $MY_TPPORT
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local MODE_OVERRIDE=tpws local MODE_OVERRIDE=tpws

21
init.d/openwrt/custom-tpws4http-nfqws4https
View File

@ -1,8 +1,7 @@
# this custom script demonstrates how to apply tpws to http and nfqws to https # this custom script demonstrates how to apply tpws to http and nfqws to https
# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS # it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS
zapret_custom_daemons() zapret_custom_daemons() {
{
# stop logic is managed by procd # stop logic is managed by procd
local opt local opt
@ -16,11 +15,10 @@ zapret_custom_daemons()
[ "$MODE_HTTPS" = "1" ] && { [ "$MODE_HTTPS" = "1" ] && {
opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS" opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
run_daemon 2 $NFQWS "$opt" run_daemon 2 "$NFQWS" "$opt"
} }
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local f4 f6 local f4 f6
@ -31,18 +29,17 @@ zapret_custom_firewall()
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT"
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_tpws $1 "$f4" "$f6" $TPPORT fw_tpws "$1" "$f4" "$f6" "$TPPORT"
} }
[ "$MODE_HTTPS" = "1" ] && { [ "$MODE_HTTPS" = "1" ] && {
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only"
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM fw_nfqws_post "$1" "$f4 $desync" "$f6 $desync" "$QNUM"
} }
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local f4 f6 local f4 f6
@ -53,15 +50,15 @@ zapret_custom_firewall_nft()
f4="tcp dport {$HTTP_PORTS}" f4="tcp dport {$HTTP_PORTS}"
f6=$f4 f6=$f4
nft_filter_apply_ipset_target f4 f6 nft_filter_apply_ipset_target f4 f6
nft_fw_tpws "$f4" "$f6" $TPPORT nft_fw_tpws "$f4" "$f6" "$TPPORT"
} }
[ "$MODE_HTTPS" = "1" ] && { [ "$MODE_HTTPS" = "1" ] && {
f4="tcp dport {$HTTPS_PORTS} $first_packet_only" f4="tcp dport {$HTTPS_PORTS} $first_packet_only"
f6=$f4 f6=$f4
nft_filter_apply_ipset_target f4 f6 nft_filter_apply_ipset_target f4 f6
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" "$QNUM"
# for modes that require incoming traffic # for modes that require incoming traffic
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM nft_fw_reverse_nfqws_rule "$f4" "$f6" "$QNUM"
} }
} }

9
init.d/openwrt/custom.default
View File

@ -2,8 +2,7 @@
# use helpers from "functions" file and "zapret" init script # use helpers from "functions" file and "zapret" init script
# in case of upgrade keep this file only, do not modify others # in case of upgrade keep this file only, do not modify others
zapret_custom_daemons() zapret_custom_daemons() {
{
# stop logic is managed by procd # stop logic is managed by procd
# PLACEHOLDER # PLACEHOLDER
@ -13,8 +12,7 @@ zapret_custom_daemons()
run_daemon 1 /bin/sleep 20 run_daemon 1 /bin/sleep 20
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
# PLACEHOLDER # PLACEHOLDER
@ -22,8 +20,7 @@ zapret_custom_firewall()
echo Configure iptables for required actions echo Configure iptables for required actions
echo Study how other sections work echo Study how other sections work
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
# PLACEHOLDER # PLACEHOLDER

199
init.d/openwrt/functions
View File

@ -35,75 +35,65 @@ IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
apply_unspecified_desync_modes apply_unspecified_desync_modes
# can be multiple IPv6 outgoing interfaces
# can be multiple ipv6 outgoing interfaces # uplink from ISP, tunnelbroker, VPN, ...
# uplink from isp, tunnelbroker, vpn, ...
# want them all. who knows what's the real one that blocks sites # want them all. who knows what's the real one that blocks sites
# dont want any manual configuration - want to do it automatically # dont want any manual configuration - want to do it automatically
# standard network_find_wan[6] return only the first # standard network_find_wan[6] return only the first
# we use low level function from network.sh to avoid this limitation # we use low level function from network.sh to avoid this limitation
# it can change theoretically and stop working # it can change theoretically and stop working
network_find_wan4_all() network_find_wan4_all() {
{
if [ -n "$OPENWRT_WAN4" ]; then if [ -n "$OPENWRT_WAN4" ]; then
eval $1="\$OPENWRT_WAN4" eval "$1"="\$OPENWRT_WAN4"
else else
__network_ifstatus "$1" "" "[@.route[@.target='0.0.0.0' && [email protected]]].interface" "" 10 2>/dev/null && return __network_ifstatus "$1" "" "[@.route[@.target='0.0.0.0' && [email protected]]].interface" "" 10 2>/dev/null && return
network_find_wan $1 network_find_wan "$1"
fi fi
} }
network_find_wan_all() network_find_wan_all() {
{
network_find_wan4_all "$@" network_find_wan4_all "$@"
} }
network_find_wan6_all() network_find_wan6_all() {
{
if [ -n "$OPENWRT_WAN6" ]; then if [ -n "$OPENWRT_WAN6" ]; then
eval $1="\$OPENWRT_WAN6" eval "$1"="\$OPENWRT_WAN6"
else else
__network_ifstatus "$1" "" "[@.route[@.target='::' && [email protected]]].interface" "" 10 2>/dev/null && return __network_ifstatus "$1" "" "[@.route[@.target='::' && [email protected]]].interface" "" 10 2>/dev/null && return
network_find_wan6 $1 network_find_wan6 "$1"
fi fi
} }
network_find_wanX_devices() network_find_wanX_devices() {
{
# $1 - ip version: 4 or 6 # $1 - ip version: 4 or 6
# $2 - variable to put result to # $2 - variable to put result to
local ifaces local ifaces
network_find_wan${1}_all ifaces network_find_wan"${1}"_all ifaces
call_for_multiple_items network_get_device $2 "$ifaces" call_for_multiple_items network_get_device "$2" "$ifaces"
} }
dnat6_target() {
dnat6_target() # $1 - LAN network name
{
# $1 - lan network name
# $2 - var to store target ip6 # $2 - var to store target ip6
network_is_up $1 || { network_is_up "$1" || {
[ -n "$2" ] && eval $2='' [ -n "$2" ] && eval "$2"=''
return return
} }
local DEVICE local DEVICE
network_get_device DEVICE $1 network_get_device DEVICE "$1"
_dnat6_target $DEVICE $2 _dnat6_target "$DEVICE" "$2"
} }
set_route_localnet() set_route_localnet() {
{
# $1 - 1 = enable, 0 = disable # $1 - 1 = enable, 0 = disable
local DLAN local DLAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN" call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
_set_route_localnet $1 $DLAN _set_route_localnet "$1" "$DLAN"
} }
fw_nfqws_prepost_x() {
fw_nfqws_prepost_x()
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - filter # $2 - filter
# $3 - queue number # $3 - queue number
@ -111,29 +101,24 @@ fw_nfqws_prepost_x()
# $5 - post/pre # $5 - post/pre
local ifaces DWAN local ifaces DWAN
network_find_wan${4}_all ifaces network_find_wan"${4}"_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces" call_for_multiple_items network_get_device DWAN "$ifaces"
[ -n "$DWAN" ] && _fw_nfqws_${5}${4} $1 "$2" $3 "$(unique $DWAN)" [ -n "$DWAN" ] && _fw_nfqws_"${5}"${4} "$1" "$2" "$3" "$(unique "$DWAN")"
} }
fw_nfqws_post4() fw_nfqws_post4() {
{ fw_nfqws_prepost_x "$1" "$2" "$3" 4 post
fw_nfqws_prepost_x $1 "$2" $3 4 post
} }
fw_nfqws_post6() fw_nfqws_post6() {
{ fw_nfqws_prepost_x "$1" "$2" "$3" 6 post
fw_nfqws_prepost_x $1 "$2" $3 6 post
} }
fw_nfqws_pre4() fw_nfqws_pre4() {
{ fw_nfqws_prepost_x "$1" "$2" "$3" 4 pre
fw_nfqws_prepost_x $1 "$2" $3 4 pre
} }
fw_nfqws_pre6() fw_nfqws_pre6() {
{ fw_nfqws_prepost_x "$1" "$2" "$3" 6 pre
fw_nfqws_prepost_x $1 "$2" $3 6 pre
} }
fw_tpws_x() fw_tpws_x() {
{
# $1 - 1 - add, 0 - del # $1 - 1 - add, 0 - del
# $2 - filter # $2 - filter
# $3 - tpws port # $3 - tpws port
@ -143,102 +128,88 @@ fw_tpws_x()
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN" call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
network_find_wan${4}_all ifaces network_find_wan"${4}"_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces" call_for_multiple_items network_get_device DWAN "$ifaces"
[ -n "$DWAN" ] && _fw_tpws${4} $1 "$2" $3 "$DLAN" "$(unique $DWAN)" [ -n "$DWAN" ] && _fw_tpws"${4}" "$1" "$2" "$3" "$DLAN" "$(unique "$DWAN")"
} }
fw_tpws4() fw_tpws4() {
{ fw_tpws_x "$1" "$2" "$3" 4
fw_tpws_x $1 "$2" $3 4
} }
fw_tpws6() fw_tpws6() {
{ fw_tpws_x "$1" "$2" "$3" 6
fw_tpws_x $1 "$2" $3 6
} }
create_ipset() {
create_ipset()
{
echo "Creating ip list table (firewall type $FWTYPE)" echo "Creating ip list table (firewall type $FWTYPE)"
"$IPSET_CR" "$@" "$IPSET_CR" "$@"
} }
list_nfqws_rules() list_nfqws_rules() {
{ # $1 = '' for IPv4, '6' for IPv6
# $1 = '' for ipv4, '6' for ipv6 ip"$1"tables -S POSTROUTING -t mangle |
ip$1tables -S POSTROUTING -t mangle | \ grep -E "NFQUEUE --queue-num $QNUM --queue-bypass|NFQUEUE --queue-num $(($QNUM + 1)) --queue-bypass|NFQUEUE --queue-num $(($QNUM + 2)) --queue-bypass|NFQUEUE --queue-num $(($QNUM + 3)) --queue-bypass|NFQUEUE --queue-num $(($QNUM + 10)) --queue-bypass|NFQUEUE --queue-num $(($QNUM + 11)) --queue-bypass" |
grep -E "NFQUEUE --queue-num $QNUM --queue-bypass|NFQUEUE --queue-num $(($QNUM+1)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+2)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+3)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+10)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+11)) --queue-bypass" | \
sed -re 's/^-A POSTROUTING (.*) -j NFQUEUE.*$/\1/' -e "s/-m mark ! --mark $DESYNC_MARK\/$DESYNC_MARK//" sed -re 's/^-A POSTROUTING (.*) -j NFQUEUE.*$/\1/' -e "s/-m mark ! --mark $DESYNC_MARK\/$DESYNC_MARK//"
} }
apply_flow_offloading_enable_rule() apply_flow_offloading_enable_rule() {
{ # $1 = '' for IPv4, '6' for IPv6
# $1 = '' for ipv4, '6' for ipv6
local i off='-j FLOWOFFLOAD' local i off='-j FLOWOFFLOAD'
[ "$FLOWOFFLOAD" = "hardware" ] && off="$off --hw" [ "$FLOWOFFLOAD" = "hardware" ] && off="$off --hw"
i="forwarding_rule_zapret -m comment --comment zapret_traffic_offloading_enable -m conntrack --ctstate RELATED,ESTABLISHED $off" i="forwarding_rule_zapret -m comment --comment zapret_traffic_offloading_enable -m conntrack --ctstate RELATED,ESTABLISHED $off"
echo enabling ipv${1:-4} flow offloading : $i echo enabling ipv"${1:-4}" flow offloading : "$i"
ip$1tables -A $i ip"$1"tables -A "$i"
} }
apply_flow_offloading_exempt_rule() apply_flow_offloading_exempt_rule() {
{ # $1 = '' for IPv4, '6' for IPv6
# $1 = '' for ipv4, '6' for ipv6
local i v local i v
v=$1 v=$1
shift shift
i="forwarding_rule_zapret $@ -m comment --comment zapret_traffic_offloading_exemption -j RETURN" i="forwarding_rule_zapret $@ -m comment --comment zapret_traffic_offloading_exemption -j RETURN"
echo applying ipv${v:-4} flow offloading exemption : $i echo applying ipv"${v:-4}" flow offloading exemption : "$i"
ip${v}tables -A $i ip"${v}"tables -A "$i"
} }
flow_offloading_unexempt_v() flow_offloading_unexempt_v() {
{ # $1 = '' for IPv4, '6' for IPv6
# $1 = '' for ipv4, '6' for ipv6
local DWAN local DWAN
network_find_wanX_devices ${1:-4} DWAN network_find_wanX_devices "${1:-4}" DWAN
for i in $DWAN; do ipt$1_del FORWARD -o $i -j forwarding_rule_zapret ; done for i in $DWAN; do ipt"$1"_del FORWARD -o "$i" -j forwarding_rule_zapret; done
ip$1tables -F forwarding_rule_zapret 2>/dev/null ip"$1"tables -F forwarding_rule_zapret 2>/dev/null
ip$1tables -X forwarding_rule_zapret 2>/dev/null ip"$1"tables -X forwarding_rule_zapret 2>/dev/null
} }
flow_offloading_exempt_v() flow_offloading_exempt_v() {
{ # $1 = '' for IPv4, '6' for IPv6
# $1 = '' for ipv4, '6' for ipv6 is_ipt_flow_offload_avail "$1" || return 0
is_ipt_flow_offload_avail $1 || return 0
flow_offloading_unexempt_v $1 flow_offloading_unexempt_v "$1"
[ "$FLOWOFFLOAD" = 'software' -o "$FLOWOFFLOAD" = 'hardware' ] && { [ "$FLOWOFFLOAD" = 'software' -o "$FLOWOFFLOAD" = 'hardware' ] && {
ip$1tables -N forwarding_rule_zapret ip"$1"tables -N forwarding_rule_zapret
# remove outgoing interface # remove outgoing interface
list_nfqws_rules $1 | sed -re 's/-o +[^ ]+//g' | list_nfqws_rules "$1" | sed -re 's/-o +[^ ]+//g' |
while read rule; do while read rule; do
apply_flow_offloading_exempt_rule "$1" $rule apply_flow_offloading_exempt_rule "$1" "$rule"
done done
apply_flow_offloading_enable_rule $1 apply_flow_offloading_enable_rule "$1"
# only outgoing to WAN packets trigger flow offloading # only outgoing to WAN packets trigger flow offloading
local DWAN local DWAN
network_find_wanX_devices ${1:-4} DWAN network_find_wanX_devices "${1:-4}" DWAN
for i in $DWAN; do ipt$1 FORWARD -o $i -j forwarding_rule_zapret; done for i in $DWAN; do ipt"$1" FORWARD -o "$i" -j forwarding_rule_zapret; done
} }
return 0 return 0
} }
flow_offloading_exempt() flow_offloading_exempt() {
{
[ "$DISABLE_IPV4" = "1" ] || flow_offloading_exempt_v [ "$DISABLE_IPV4" = "1" ] || flow_offloading_exempt_v
[ "$DISABLE_IPV6" = "1" ] || flow_offloading_exempt_v 6 [ "$DISABLE_IPV6" = "1" ] || flow_offloading_exempt_v 6
} }
flow_offloading_unexempt() flow_offloading_unexempt() {
{
[ "$DISABLE_IPV4" = "1" ] || flow_offloading_unexempt_v [ "$DISABLE_IPV4" = "1" ] || flow_offloading_unexempt_v
[ "$DISABLE_IPV6" = "1" ] || flow_offloading_unexempt_v 6 [ "$DISABLE_IPV6" = "1" ] || flow_offloading_unexempt_v 6
} }
nft_fill_ifsets_overload() {
nft_fill_ifsets_overload()
{
local ifaces DLAN DWAN DWAN6 PDLAN PDWAN PDWAN6 local ifaces DLAN DWAN DWAN6 PDLAN PDWAN PDWAN6
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN" call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
@ -255,29 +226,23 @@ nft_fill_ifsets_overload()
nft_fill_ifsets "$DLAN" "$DWAN" "$DWAN6" "$PDLAN" "$PDWAN" "$PDWAN6" nft_fill_ifsets "$DLAN" "$DWAN" "$DWAN6" "$PDLAN" "$PDWAN" "$PDWAN6"
} }
nft_fw_tpws4() nft_fw_tpws4() {
{ _nft_fw_tpws4 "$1" "$2" always_apply_wan_filter
_nft_fw_tpws4 "$1" $2 always_apply_wan_filter
} }
nft_fw_tpws6() nft_fw_tpws6() {
{
local DLAN local DLAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN" call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
_nft_fw_tpws6 "$1" $2 "$DLAN" always_apply_wan_filter _nft_fw_tpws6 "$1" "$2" "$DLAN" always_apply_wan_filter
} }
nft_fw_nfqws_post4() nft_fw_nfqws_post4() {
{ _nft_fw_nfqws_post4 "$1" "$2" always_apply_wan_filter
_nft_fw_nfqws_post4 "$1" $2 always_apply_wan_filter
} }
nft_fw_nfqws_post6() nft_fw_nfqws_post6() {
{ _nft_fw_nfqws_post6 "$1" "$2" always_apply_wan_filter
_nft_fw_nfqws_post6 "$1" $2 always_apply_wan_filter
} }
nft_fw_nfqws_pre4() nft_fw_nfqws_pre4() {
{ _nft_fw_nfqws_pre4 "$1" "$2" always_apply_wan_filter
_nft_fw_nfqws_pre4 "$1" $2 always_apply_wan_filter
} }
nft_fw_nfqws_pre6() nft_fw_nfqws_pre6() {
{ _nft_fw_nfqws_pre6 "$1" "$2" always_apply_wan_filter
_nft_fw_nfqws_pre6 "$1" $2 always_apply_wan_filter
} }

78
init.d/openwrt/zapret
View File

@ -33,9 +33,8 @@ fi
. "$ZAPRET_BASE/init.d/openwrt/functions" . "$ZAPRET_BASE/init.d/openwrt/functions"
# !!!!! in old OpenWrt 21.x- with iptables firewall rules are configured separately
# !!!!! in old openwrt 21.x- with iptables firewall rules are configured separately # !!!!! in new OpenWrt >21.x with nftables firewall is configured here
# !!!!! in new openwrt >21.x with nftables firewall is configured here
PIDDIR=/var/run PIDDIR=/var/run
@ -50,8 +49,7 @@ TPWS_WAIT="--bind-wait-ifup=30 --bind-wait-ip=30"
TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30" TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3" TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3"
run_daemon() run_daemon() {
{
# $1 - daemon string id or number. can use 1,2,3,... # $1 - daemon string id or number. can use 1,2,3,...
# $2 - daemon # $2 - daemon
# $3 - daemon args # $3 - daemon args
@ -59,13 +57,12 @@ run_daemon()
local DAEMONBASE="$(basename "$2")" local DAEMONBASE="$(basename "$2")"
echo "Starting daemon $1: $2 $3" echo "Starting daemon $1: $2 $3"
procd_open_instance procd_open_instance
procd_set_param command $2 $3 procd_set_param command "$2" "$3"
procd_set_param pidfile $PIDDIR/$DAEMONBASE$1.pid procd_set_param pidfile $PIDDIR/"$DAEMONBASE"$1.pid
procd_close_instance procd_close_instance
} }
run_tpws() run_tpws() {
{
[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0 [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0
local OPT="$TPWS_OPT_BASE" local OPT="$TPWS_OPT_BASE"
@ -75,47 +72,41 @@ run_tpws()
[ "$DISABLE_IPV6" = "1" ] || { [ "$DISABLE_IPV6" = "1" ] || {
OPT="$OPT $TPWS_OPT_BASE6" OPT="$OPT $TPWS_OPT_BASE6"
for lan in $OPENWRT_LAN; do for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan network_get_device DEVICE "$lan"
[ -n "$DEVICE" ] && OPT="$OPT --bind-iface6=$DEVICE $TPWS_OPT_BASE6_PRE" [ -n "$DEVICE" ] && OPT="$OPT --bind-iface6=$DEVICE $TPWS_OPT_BASE6_PRE"
done done
} }
run_daemon $1 "$TPWS" "$OPT $2" run_daemon "$1" "$TPWS" "$OPT $2"
} }
run_tpws_socks() run_tpws_socks() {
{
[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0 [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0
local opt="$TPWS_OPT_BASE --socks" local opt="$TPWS_OPT_BASE --socks"
tpws_apply_socks_binds opt tpws_apply_socks_binds opt
run_daemon $1 "$TPWS" "$opt $2" run_daemon "$1" "$TPWS" "$opt $2"
} }
stop_tpws() stop_tpws() {
{ stop_daemon "$1" "$TPWS"
stop_daemon $1 "$TPWS"
} }
tpws_apply_socks_binds() {
tpws_apply_socks_binds()
{
local o local o
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1" [ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1"
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-addr=::1" [ "$DISABLE_IPV6" = "1" ] || o="$o --bind-addr=::1"
for lan in $OPENWRT_LAN; do for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan network_get_device DEVICE "$lan"
[ -n "$DEVICE" ] || continue [ -n "$DEVICE" ] || continue
[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$DEVICE $TPWS_WAIT" [ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$DEVICE $TPWS_WAIT"
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$DEVICE --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6" [ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$DEVICE --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
done done
eval $1="\"\$$1 $o\"" eval "$1"="\"\$$1 $o\""
} }
start_daemons_procd() {
start_daemons_procd()
{
local opt qn qns qn6 qns6 local opt qn qns qn6 qns6
case "${MODE_OVERRIDE:-$MODE}" in case "${MODE_OVERRIDE:-$MODE}" in
@ -165,54 +156,44 @@ start_daemons_procd()
} }
;; ;;
custom) custom)
existf zapret_custom_daemons && zapret_custom_daemons $1 existf zapret_custom_daemons && zapret_custom_daemons "$1"
;; ;;
esac esac
return 0 return 0
} }
start_daemons() start_daemons() {
{
rc_procd start_daemons_procd "$@" rc_procd start_daemons_procd "$@"
} }
stop_daemons() stop_daemons() {
{ procd_kill "$(basename "${basescript:-$initscript}")" "$1"
procd_kill "$(basename ${basescript:-$initscript})" "$1"
} }
restart_daemons() restart_daemons() {
{
stop_daemons stop_daemons
start_daemons start_daemons
} }
start_fw() start_fw() {
{
zapret_apply_firewall zapret_apply_firewall
} }
stop_fw() stop_fw() {
{
zapret_unapply_firewall zapret_unapply_firewall
} }
restart_fw() restart_fw() {
{
stop_fw stop_fw
start_fw start_fw
} }
reload_ifsets() reload_ifsets() {
{
zapret_reload_ifsets zapret_reload_ifsets
} }
list_ifsets() list_ifsets() {
{
zapret_list_ifsets zapret_list_ifsets
} }
list_table() list_table() {
{
zapret_list_table zapret_list_table
} }
start_service() start_service() {
{
start_daemons_procd start_daemons_procd
[ "$INIT_APPLY_FW" != "1" ] || { [ "$INIT_APPLY_FW" != "1" ] || {
linux_fwtype linux_fwtype
@ -220,8 +201,7 @@ start_service()
} }
} }
stop_service() stop_service() {
{
# this procedure is called from stop() # this procedure is called from stop()
# stop() already stop daemons # stop() already stop daemons
[ "$INIT_APPLY_FW" != "1" ] || { [ "$INIT_APPLY_FW" != "1" ] || {

3
init.d/pfsense/zapret.sh
View File

@ -14,7 +14,8 @@ sysctl net.inet6.ip6.pfil.outbound=ipfw,pf
sysctl net.inet6.ip6.pfil.inbound=ipfw,pf sysctl net.inet6.ip6.pfil.inbound=ipfw,pf
# required for newer pfsense versions (2.6.0 tested) to return ipfw to functional state # required for newer pfsense versions (2.6.0 tested) to return ipfw to functional state
pfctl -d ; pfctl -e pfctl -d
pfctl -e
# add ipfw rules and start daemon # add ipfw rules and start daemon

18
init.d/sysv/custom-nfqws-dht4all
View File

@ -3,20 +3,18 @@
QNUM2=$(($QNUM + 20)) QNUM2=$(($QNUM + 20))
zapret_custom_daemons() zapret_custom_daemons() {
{
# stop logic is managed by procd # stop logic is managed by procd
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
local opt local opt
zapret_do_daemons $1 zapret_do_daemons "$1"
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
do_nfqws $1 100 "$opt" do_nfqws "$1" 100 "$opt"
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -24,16 +22,15 @@ zapret_custom_firewall()
local first_packet_only="$ipt_connbytes 1:1" local first_packet_only="$ipt_connbytes 1:1"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
zapret_do_firewall_rules_ipt $1 zapret_do_firewall_rules_ipt "$1"
f='-p udp -m length --length 109:407 -m u32 --u32' f='-p udp -m length --length 109:407 -m u32 --u32'
uf4='0>>22&0x3C@8>>16=0x6431' uf4='0>>22&0x3C@8>>16=0x6431'
uf6='48>>16=0x6431' uf6='48>>16=0x6431'
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 fw_nfqws_post "$1" "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -46,4 +43,3 @@ zapret_custom_firewall_nft()
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2
} }

17
init.d/sysv/custom-nfqws-quic4all
View File

@ -4,20 +4,18 @@
QNUM2=$(($QNUM + 10)) QNUM2=$(($QNUM + 10))
zapret_custom_daemons() zapret_custom_daemons() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
local opt local opt
zapret_do_daemons $1 zapret_do_daemons "$1"
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
do_nfqws $1 100 "$opt" do_nfqws "$1" 100 "$opt"
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws
@ -25,14 +23,13 @@ zapret_custom_firewall()
local first_packets_only="$ipt_connbytes 1:3" local first_packets_only="$ipt_connbytes 1:3"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
zapret_do_firewall_rules_ipt $1 zapret_do_firewall_rules_ipt "$1"
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 fw_nfqws_post "$1" "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local MODE_OVERRIDE=nfqws local MODE_OVERRIDE=nfqws

17
init.d/sysv/custom-reuse-builtin-mode
View File

@ -4,35 +4,32 @@ MY_TPPORT=$(($TPPORT + 1))
MY_TPWS_OPT="--methodeol --hostcase" MY_TPWS_OPT="--methodeol --hostcase"
MY_DPORT=81 MY_DPORT=81
zapret_custom_daemons() zapret_custom_daemons() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=tpws local MODE_OVERRIDE=tpws
local opt local opt
zapret_do_daemons $1 zapret_do_daemons "$1"
opt="--port=$MY_TPPORT $MY_TPWS_OPT" opt="--port=$MY_TPPORT $MY_TPWS_OPT"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_tpws $1 100 "$opt" do_tpws "$1" 100 "$opt"
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=tpws local MODE_OVERRIDE=tpws
local f4 f6 local f4 f6
zapret_do_firewall_rules_ipt $1 zapret_do_firewall_rules_ipt "$1"
f4="-p tcp --dport $MY_DPORT" f4="-p tcp --dport $MY_DPORT"
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_tpws $1 "$f4" "$f6" $MY_TPPORT fw_tpws "$1" "$f4" "$f6" $MY_TPPORT
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local MODE_OVERRIDE=tpws local MODE_OVERRIDE=tpws

25
init.d/sysv/custom-tpws4http-nfqws4https
View File

@ -1,8 +1,7 @@
# this custom script demonstrates how to apply tpws to http and nfqws to https # this custom script demonstrates how to apply tpws to http and nfqws to https
# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS # it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS
zapret_custom_daemons() zapret_custom_daemons() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local opt local opt
@ -10,17 +9,16 @@ zapret_custom_daemons()
[ "$MODE_HTTP" = "1" ] && { [ "$MODE_HTTP" = "1" ] && {
opt="--port=$TPPORT $TPWS_OPT" opt="--port=$TPPORT $TPWS_OPT"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_tpws $1 1 "$opt" do_tpws "$1" 1 "$opt"
} }
[ "$MODE_HTTPS" = "1" ] && { [ "$MODE_HTTPS" = "1" ] && {
opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTPS" opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTPS"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 2 "$opt" do_nfqws "$1" 2 "$opt"
} }
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local f4 f6 local f4 f6
@ -31,20 +29,19 @@ zapret_custom_firewall()
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT"
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_tpws $1 "$f4" "$f6" $TPPORT fw_tpws "$1" "$f4" "$f6" "$TPPORT"
} }
[ "$MODE_HTTPS" = "1" ] && { [ "$MODE_HTTPS" = "1" ] && {
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only"
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM fw_nfqws_post "$1" "$f4 $desync" "$f6 $desync" "$QNUM"
# for modes that require incoming traffic # for modes that require incoming traffic
fw_reverse_nfqws_rule $1 "$f4" "$f6" $QNUM fw_reverse_nfqws_rule "$1" "$f4" "$f6" "$QNUM"
} }
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
local f4 f6 local f4 f6
@ -55,15 +52,15 @@ zapret_custom_firewall_nft()
f4="tcp dport {$HTTP_PORTS}" f4="tcp dport {$HTTP_PORTS}"
f6=$f4 f6=$f4
nft_filter_apply_ipset_target f4 f6 nft_filter_apply_ipset_target f4 f6
nft_fw_tpws "$f4" "$f6" $TPPORT nft_fw_tpws "$f4" "$f6" "$TPPORT"
} }
[ "$MODE_HTTPS" = "1" ] && { [ "$MODE_HTTPS" = "1" ] && {
f4="tcp dport {$HTTPS_PORTS} $first_packet_only" f4="tcp dport {$HTTPS_PORTS} $first_packet_only"
f6=$f4 f6=$f4
nft_filter_apply_ipset_target f4 f6 nft_filter_apply_ipset_target f4 f6
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" "$QNUM"
# for modes that require incoming traffic # for modes that require incoming traffic
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM nft_fw_reverse_nfqws_rule "$f4" "$f6" "$QNUM"
} }
} }

11
init.d/sysv/custom.default
View File

@ -2,8 +2,7 @@
# use helpers from "functions" file # use helpers from "functions" file
# in case of upgrade keep this file only, do not modify others # in case of upgrade keep this file only, do not modify others
zapret_custom_daemons() zapret_custom_daemons() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
# PLACEHOLDER # PLACEHOLDER
@ -11,10 +10,9 @@ zapret_custom_daemons()
echo Start daemon\(s\) echo Start daemon\(s\)
echo Study how other sections work echo Study how other sections work
do_daemon $1 1 /bin/sleep 20 do_daemon "$1" 1 /bin/sleep 20
} }
zapret_custom_firewall() zapret_custom_firewall() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
# PLACEHOLDER # PLACEHOLDER
@ -23,8 +21,7 @@ zapret_custom_firewall()
echo Study how other sections work echo Study how other sections work
} }
zapret_custom_firewall_nft() zapret_custom_firewall_nft() {
{
# stop logic is not required # stop logic is not required
# PLACEHOLDER # PLACEHOLDER

172
init.d/sysv/functions
View File

@ -13,38 +13,34 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
. "$ZAPRET_BASE/common/linux_fw.sh" . "$ZAPRET_BASE/common/linux_fw.sh"
. "$ZAPRET_BASE/common/list.sh" . "$ZAPRET_BASE/common/list.sh"
user_exists() {
user_exists() id -u "$1" >/dev/null 2>/dev/null
{
id -u $1 >/dev/null 2>/dev/null
} }
useradd_compat() useradd_compat() {
{
# $1 - username # $1 - username
# skip for readonly systems # skip for readonly systems
[ -w "/etc" ] && { [ -w "/etc" ] && {
if exists useradd; then if exists useradd; then
useradd --no-create-home --system --shell /bin/false $1 useradd --no-create-home --system --shell /bin/false "$1"
elif is_linked_to_busybox adduser; then elif is_linked_to_busybox adduser; then
# some systems may miss nogroup group in /etc/group # some systems may miss nogroup group in /etc/group
# adduser fails if it's absent and no group is specified # adduser fails if it's absent and no group is specified
addgroup nogroup 2>/dev/null addgroup nogroup 2>/dev/null
# busybox has special adduser syntax # busybox has special adduser syntax
adduser -S -H -D $1 adduser -S -H -D "$1"
elif exists adduser; then elif exists adduser; then
adduser --no-create-home --system --disabled-login $1 adduser --no-create-home --system --disabled-login "$1"
fi fi
} }
user_exists $1 user_exists "$1"
} }
prepare_user() prepare_user() {
{
# $WS_USER is required to prevent redirection of the traffic originating from TPWS itself # $WS_USER is required to prevent redirection of the traffic originating from TPWS itself
# otherwise infinite loop will occur # otherwise infinite loop will occur
# also its good idea not to run tpws as root # also its good idea not to run tpws as root
user_exists $WS_USER || { user_exists "$WS_USER" || {
# fallback to daemon if we cant add WS_USER # fallback to daemon if we cant add WS_USER
useradd_compat $WS_USER || { useradd_compat "$WS_USER" || {
for user in daemon nobody; do for user in daemon nobody; do
user_exists $user && { user_exists $user && {
WS_USER=$user WS_USER=$user
@ -97,72 +93,54 @@ CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/sysv/custom"
IPSET_EXCLUDE="-m set ! --match-set nozapret" IPSET_EXCLUDE="-m set ! --match-set nozapret"
IPSET_EXCLUDE6="-m set ! --match-set nozapret6" IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
dnat6_target() {
dnat6_target()
{
_dnat6_target "$@" _dnat6_target "$@"
} }
set_route_localnet() set_route_localnet() {
{ _set_route_localnet "$1" "$IFACE_LAN"
_set_route_localnet $1 "$IFACE_LAN"
} }
fw_nfqws_post4() fw_nfqws_post4() {
{ _fw_nfqws_post4 "$1" "$2" "$3" "$IFACE_WAN"
_fw_nfqws_post4 $1 "$2" $3 "$IFACE_WAN"
} }
fw_nfqws_post6() fw_nfqws_post6() {
{ _fw_nfqws_post6 "$1" "$2" "$3" "${IFACE_WAN6:-$IFACE_WAN}"
_fw_nfqws_post6 $1 "$2" $3 "${IFACE_WAN6:-$IFACE_WAN}"
} }
fw_nfqws_pre4() fw_nfqws_pre4() {
{ _fw_nfqws_pre4 "$1" "$2" "$3" "$IFACE_WAN"
_fw_nfqws_pre4 $1 "$2" $3 "$IFACE_WAN"
} }
fw_nfqws_pre6() fw_nfqws_pre6() {
{ _fw_nfqws_pre6 "$1" "$2" "$3" "${IFACE_WAN6:-$IFACE_WAN}"
_fw_nfqws_pre6 $1 "$2" $3 "${IFACE_WAN6:-$IFACE_WAN}"
} }
fw_tpws4() fw_tpws4() {
{ _fw_tpws4 "$1" "$2" "$3" "$IFACE_LAN" "$IFACE_WAN"
_fw_tpws4 $1 "$2" $3 "$IFACE_LAN" "$IFACE_WAN"
} }
fw_tpws6() fw_tpws6() {
{ _fw_tpws6 "$1" "$2" "$3" "$IFACE_LAN" "${IFACE_WAN6:-$IFACE_WAN}"
_fw_tpws6 $1 "$2" $3 "$IFACE_LAN" "${IFACE_WAN6:-$IFACE_WAN}"
} }
nft_fw_tpws4() nft_fw_tpws4() {
{ _nft_fw_tpws4 "$1" "$2" "$IFACE_WAN"
_nft_fw_tpws4 "$1" $2 "$IFACE_WAN"
} }
nft_fw_tpws6() nft_fw_tpws6() {
{ _nft_fw_tpws6 "$1" "$2" "$IFACE_LAN" "${IFACE_WAN6:-$IFACE_WAN}"
_nft_fw_tpws6 "$1" $2 "$IFACE_LAN" "${IFACE_WAN6:-$IFACE_WAN}"
} }
nft_fw_nfqws_post4() nft_fw_nfqws_post4() {
{ _nft_fw_nfqws_post4 "$1" "$2" "$IFACE_WAN"
_nft_fw_nfqws_post4 "$1" $2 "$IFACE_WAN"
} }
nft_fw_nfqws_post6() nft_fw_nfqws_post6() {
{ _nft_fw_nfqws_post6 "$1" "$2" "${IFACE_WAN6:-$IFACE_WAN}"
_nft_fw_nfqws_post6 "$1" $2 "${IFACE_WAN6:-$IFACE_WAN}"
} }
nft_fw_nfqws_pre4() nft_fw_nfqws_pre4() {
{ _nft_fw_nfqws_pre4 "$1" "$2" "$IFACE_WAN"
_nft_fw_nfqws_pre4 "$1" $2 "$IFACE_WAN"
} }
nft_fw_nfqws_pre6() nft_fw_nfqws_pre6() {
{ _nft_fw_nfqws_pre6 "$1" "$2" "${IFACE_WAN6:-$IFACE_WAN}"
_nft_fw_nfqws_pre6 "$1" $2 "${IFACE_WAN6:-$IFACE_WAN}"
} }
nft_fill_ifsets_overload() nft_fill_ifsets_overload() {
{
nft_fill_ifsets "$IFACE_LAN" "$IFACE_WAN" "${IFACE_WAN6:-$IFACE_WAN}" nft_fill_ifsets "$IFACE_LAN" "$IFACE_WAN" "${IFACE_WAN6:-$IFACE_WAN}"
} }
run_daemon() {
run_daemon()
{
# $1 - daemon number : 1,2,3,... # $1 - daemon number : 1,2,3,...
# $2 - daemon # $2 - daemon
# $3 - daemon args # $3 - daemon args
@ -172,24 +150,23 @@ run_daemon()
local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
echo "Starting daemon $1: $2 $3" echo "Starting daemon $1: $2 $3"
if exists start-stop-daemon; then if exists start-stop-daemon; then
start-stop-daemon -S -p "$PIDFILE" -m -b -x "$2" -- $3 start-stop-daemon -S -p "$PIDFILE" -m -b -x "$2" -- "$3"
else else
if [ -f "$PIDFILE" ] && pgrep -F "$PIDFILE" "$DAEMONBASE" >/dev/null; then if [ -f "$PIDFILE" ] && pgrep -F "$PIDFILE" "$DAEMONBASE" >/dev/null; then
echo already running echo already running
else else
"$2" $3 >/dev/null 2>/dev/null & "$2" "$3" >/dev/null 2>/dev/null &
PID=$! PID=$!
if [ -n "$PID" ]; then if [ -n "$PID" ]; then
echo $PID >$PIDFILE echo $PID >"$PIDFILE"
else else
echo could not start daemon $1 : $2 $3 echo could not start daemon "$1" : "$2" "$3"
false false
fi fi
fi fi
fi fi
} }
stop_daemon() stop_daemon() {
{
# $1 - daemon number : 1,2,3,... # $1 - daemon number : 1,2,3,...
# $2 - daemon # $2 - daemon
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile # use $PIDDIR/$DAEMONBASE$1.pid as pidfile
@ -201,22 +178,19 @@ stop_daemon()
else else
if [ -f "$PIDFILE" ]; then if [ -f "$PIDFILE" ]; then
read PID <"$PIDFILE" read PID <"$PIDFILE"
kill $PID kill "$PID"
rm -f "$PIDFILE" rm -f "$PIDFILE"
else else
echo no pidfile : $PIDFILE echo no pidfile : "$PIDFILE"
fi fi
fi fi
} }
do_daemon() do_daemon() {
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
on_off_function run_daemon stop_daemon "$@" on_off_function run_daemon stop_daemon "$@"
} }
do_tpws() {
do_tpws()
{
# $1 : 1 - run, 0 - stop # $1 : 1 - run, 0 - stop
# $2 : daemon number # $2 : daemon number
# $3 : daemon args # $3 : daemon args
@ -233,10 +207,9 @@ do_tpws()
done done
} }
do_daemon $1 $2 "$TPWS" "$OPT $3" do_daemon "$1" "$2" "$TPWS" "$OPT $3"
} }
do_tpws_socks() do_tpws_socks() {
{
# $1 : 1 - run, 0 - stop # $1 : 1 - run, 0 - stop
# $2 : daemon number # $2 : daemon number
# $3 : daemon args # $3 : daemon args
@ -247,20 +220,18 @@ do_tpws_socks()
tpws_apply_socks_binds opt tpws_apply_socks_binds opt
do_daemon $1 $2 "$TPWS" "$opt $3" do_daemon "$1" "$2" "$TPWS" "$opt $3"
} }
do_nfqws() do_nfqws() {
{
# $1 : 1 - run, 0 - stop # $1 : 1 - run, 0 - stop
# $2 : daemon number # $2 : daemon number
# $3 : daemon args # $3 : daemon args
do_daemon $1 $2 "$NFQWS" "$NFQWS_OPT_BASE $3" do_daemon "$1" "$2" "$NFQWS" "$NFQWS_OPT_BASE $3"
} }
tpws_apply_socks_binds() tpws_apply_socks_binds() {
{
local o local o
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1" [ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1"
@ -270,19 +241,15 @@ tpws_apply_socks_binds()
[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT" [ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT"
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6" [ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
done done
eval $1="\"\$$1 $o\"" eval "$1"="\"\$$1 $o\""
} }
create_ipset() {
create_ipset()
{
echo "Creating ip list table (firewall type $FWTYPE)" echo "Creating ip list table (firewall type $FWTYPE)"
"$IPSET_CR" "$@" "$IPSET_CR" "$@"
} }
zapret_do_daemons() {
zapret_do_daemons()
{
# $1 - 1 - run, 0 - stop # $1 - 1 - run, 0 - stop
local opt qn qns qn6 qns6 local opt qn qns qn6 qns6
@ -291,60 +258,57 @@ zapret_do_daemons()
tpws) tpws)
opt="--port=$TPPORT $TPWS_OPT" opt="--port=$TPPORT $TPWS_OPT"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_tpws $1 1 "$opt" do_tpws "$1" 1 "$opt"
;; ;;
tpws-socks) tpws-socks)
opt="--port=$TPPORT $TPWS_OPT" opt="--port=$TPPORT $TPWS_OPT"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_tpws_socks $1 1 "$opt" do_tpws_socks "$1" 1 "$opt"
;; ;;
nfqws) nfqws)
get_nfqws_qnums qn qns qn6 qns6 get_nfqws_qnums qn qns qn6 qns6
[ -z "$qn" ] || { [ -z "$qn" ] || {
opt="--qnum=$qn $NFQWS_OPT_DESYNC_HTTP" opt="--qnum=$qn $NFQWS_OPT_DESYNC_HTTP"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 1 "$opt" do_nfqws "$1" 1 "$opt"
} }
[ -z "$qns" ] || [ "$qns" = "$qn" ] || { [ -z "$qns" ] || [ "$qns" = "$qn" ] || {
opt="--qnum=$qns $NFQWS_OPT_DESYNC_HTTPS" opt="--qnum=$qns $NFQWS_OPT_DESYNC_HTTPS"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 2 "$opt" do_nfqws "$1" 2 "$opt"
} }
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || { [ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
opt="--qnum=$qn6 $NFQWS_OPT_DESYNC_HTTP6" opt="--qnum=$qn6 $NFQWS_OPT_DESYNC_HTTP6"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 3 "$opt" do_nfqws "$1" 3 "$opt"
} }
[ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || { [ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
opt="--qnum=$qns6 $NFQWS_OPT_DESYNC_HTTPS6" opt="--qnum=$qns6 $NFQWS_OPT_DESYNC_HTTPS6"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 4 "$opt" do_nfqws "$1" 4 "$opt"
} }
get_nfqws_qnums_quic qn qn6 get_nfqws_qnums_quic qn qn6
[ -z "$qn" ] || { [ -z "$qn" ] || {
opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 10 "$opt" do_nfqws "$1" 10 "$opt"
} }
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || { [ -z "$qn6" ] || [ "$qn6" = "$qn" ] || {
opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC6" opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC6"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 11 "$opt" do_nfqws "$1" 11 "$opt"
} }
;; ;;
custom) custom)
existf zapret_custom_daemons && zapret_custom_daemons $1 existf zapret_custom_daemons && zapret_custom_daemons "$1"
;; ;;
esac esac
return 0 return 0
} }
zapret_run_daemons() zapret_run_daemons() {
{
zapret_do_daemons 1 "$@" zapret_do_daemons 1 "$@"
} }
zapret_stop_daemons() zapret_stop_daemons() {
{
zapret_do_daemons 0 "$@" zapret_do_daemons 0 "$@"
} }

6
init.d/sysv/zapret
View File

@ -15,13 +15,11 @@ ZAPRET_BASE=$(readlink -f "$EXEDIR/../..")
NAME=zapret NAME=zapret
DESC=anti-zapret DESC=anti-zapret
do_start() do_start() {
{
zapret_run_daemons zapret_run_daemons
[ "$INIT_APPLY_FW" != "1" ] || { zapret_apply_firewall; } [ "$INIT_APPLY_FW" != "1" ] || { zapret_apply_firewall; }
} }
do_stop() do_stop() {
{
zapret_stop_daemons zapret_stop_daemons
[ "$INIT_APPLY_FW" != "1" ] || zapret_unapply_firewall [ "$INIT_APPLY_FW" != "1" ] || zapret_unapply_firewall
} }

36
install_bin.sh
View File

@ -1,15 +1,17 @@
#!/bin/sh #!/bin/sh
EXEDIR="$(dirname "$0")" EXEDIR="$(dirname "$0")"
EXEDIR="$(cd "$EXEDIR"; pwd)" EXEDIR="$(
cd "$EXEDIR"
pwd
)"
BINS=binaries BINS=binaries
BINDIR="$EXEDIR/$BINS" BINDIR="$EXEDIR/$BINS"
ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"} ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"}
. "$ZAPRET_BASE/common/base.sh" . "$ZAPRET_BASE/common/base.sh"
check_dir() check_dir() {
{
local dir="$BINDIR/$1" local dir="$BINDIR/$1"
local exe="$dir/ip2net" local exe="$dir/ip2net"
local out local out
@ -39,8 +41,7 @@ check_dir()
} }
# link or copy executables. uncomment either ln or cp, comment other # link or copy executables. uncomment either ln or cp, comment other
ccp() ccp() {
{
local F="$(basename "$1")" local F="$(basename "$1")"
[ -d "$ZAPRET_BASE/$2" ] || mkdir "$ZAPRET_BASE/$2" [ -d "$ZAPRET_BASE/$2" ] || mkdir "$ZAPRET_BASE/$2"
[ -f "$ZAPRET_BASE/$2/$F" ] && rm -f "$ZAPRET_BASE/$2/$F" [ -f "$ZAPRET_BASE/$2/$F" ] && rm -f "$ZAPRET_BASE/$2/$F"
@ -69,31 +70,30 @@ case $UNAME in
;; ;;
*) *)
ARCHLIST="my" ARCHLIST="my"
;;
esac esac
if [ "$1" = "getarch" ]; then if [ "$1" = "getarch" ]; then
for arch in $ARCHLIST for arch in $ARCHLIST; do
do
[ -d "$BINDIR/$arch" ] || continue [ -d "$BINDIR/$arch" ] || continue
if check_dir $arch; then if check_dir "$arch"; then
echo $arch echo "$arch"
exit 0 exit 0
fi fi
done done
else else
for arch in $ARCHLIST for arch in $ARCHLIST; do
do
[ -d "$BINDIR/$arch" ] || continue [ -d "$BINDIR/$arch" ] || continue
if check_dir $arch; then if check_dir "$arch"; then
echo $arch is OK echo "$arch" is OK
echo installing binaries ... echo installing binaries ...
ccp $arch/ip2net ip2net ccp "$arch"/ip2net ip2net
ccp $arch/mdig mdig ccp "$arch"/mdig mdig
[ -n "$PKTWS" ] && ccp $arch/$PKTWS nfq [ -n "$PKTWS" ] && ccp "$arch"/$PKTWS nfq
[ "$UNAME" = CYGWIN ] || ccp $arch/tpws tpws [ "$UNAME" = CYGWIN ] || ccp "$arch"/tpws tpws
exit 0 exit 0
else else
echo $arch is NOT OK echo "$arch" is NOT OK
fi fi
done done
echo no compatible binaries found echo no compatible binaries found

210
install_easy.sh
View File

@ -3,7 +3,10 @@
# automated script for easy installing zapret # automated script for easy installing zapret
EXEDIR="$(dirname "$0")" EXEDIR="$(dirname "$0")"
EXEDIR="$(cd "$EXEDIR"; pwd)" EXEDIR="$(
cd "$EXEDIR"
pwd
)"
ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"} ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"}
ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"} ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"}
ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"} ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
@ -31,8 +34,7 @@ GET_LIST="$IPSET_DIR/get_config.sh"
[ -n "$TPPORT" ] || TPPORT=988 [ -n "$TPPORT" ] || TPPORT=988
check_readonly_system() check_readonly_system() {
{
local RO local RO
echo \* checking readonly system echo \* checking readonly system
case $SYSTEM in case $SYSTEM in
@ -51,8 +53,7 @@ check_readonly_system()
} }
} }
check_bins() check_bins() {
{
echo \* checking executables echo \* checking executables
fix_perms_bin_test "$EXEDIR" fix_perms_bin_test "$EXEDIR"
@ -83,17 +84,14 @@ check_bins()
fi fi
} }
call_install_bin() call_install_bin() {
{ sh "$EXEDIR/install_bin.sh" "$1"
sh "$EXEDIR/install_bin.sh" $1
} }
get_bin_arch() get_bin_arch() {
{
call_install_bin getarch call_install_bin getarch
} }
install_binaries() install_binaries() {
{
echo \* installing binaries echo \* installing binaries
call_install_bin || { call_install_bin || {
@ -102,8 +100,7 @@ install_binaries()
} }
} }
select_mode_mode() select_mode_mode() {
{
local edited v vars MODES="tpws tpws-socks nfqws filter custom" local edited v vars MODES="tpws tpws-socks nfqws filter custom"
[ "$SYSTEM" = "macos" ] && MODES="tpws tpws-socks filter custom" [ "$SYSTEM" = "macos" ] && MODES="tpws tpws-socks filter custom"
echo echo
@ -120,35 +117,33 @@ select_mode_mode()
esac esac
[ -n "$vars" ] && { [ -n "$vars" ] && {
echo echo
while [ 1=1 ]; do while true; do
for var in $vars; do for var in $vars; do
eval v="\$$var" eval v="\$$var"
echo $var=\"$v\" echo "$var"=\""$v"\"
done done
ask_yes_no N "do you want to edit the options" || { ask_yes_no N "do you want to edit the options" || {
[ -n "$edited" ] && { [ -n "$edited" ] && {
for var in $vars; do for var in $vars; do
write_config_var $var write_config_var "$var"
done done
} }
break break
} }
edit_vars $vars edit_vars "$vars"
edited=1 edited=1
echo ..edited.. echo ..edited..
done done
} }
} }
select_mode_http() select_mode_http() {
{
[ "$MODE" != "filter" ] && [ "$MODE" != "tpws-socks" ] && { [ "$MODE" != "filter" ] && [ "$MODE" != "tpws-socks" ] && {
echo echo
ask_yes_no_var MODE_HTTP "enable http support" ask_yes_no_var MODE_HTTP "enable http support"
write_config_var MODE_HTTP write_config_var MODE_HTTP
} }
} }
select_mode_keepalive() select_mode_keepalive() {
{
[ "$MODE" = "nfqws" ] && [ "$MODE_HTTP" = "1" ] && { [ "$MODE" = "nfqws" ] && [ "$MODE_HTTP" = "1" ] && {
echo echo
echo enable keep alive support only if DPI checks every outgoing packet for http signature echo enable keep alive support only if DPI checks every outgoing packet for http signature
@ -157,16 +152,14 @@ select_mode_keepalive()
write_config_var MODE_HTTP_KEEPALIVE write_config_var MODE_HTTP_KEEPALIVE
} }
} }
select_mode_https() select_mode_https() {
{
[ "$MODE" != "filter" ] && [ "$MODE" != "tpws-socks" ] && { [ "$MODE" != "filter" ] && [ "$MODE" != "tpws-socks" ] && {
echo echo
ask_yes_no_var MODE_HTTPS "enable https support" ask_yes_no_var MODE_HTTPS "enable https support"
write_config_var MODE_HTTPS write_config_var MODE_HTTPS
} }
} }
select_mode_quic() select_mode_quic() {
{
[ "$SUBSYS" = "keenetic" ] && { [ "$SUBSYS" = "keenetic" ] && {
echo echo
echo "WARNING ! Keenetic is not officially supported by zapret." echo "WARNING ! Keenetic is not officially supported by zapret."
@ -183,16 +176,14 @@ select_mode_quic()
write_config_var MODE_QUIC write_config_var MODE_QUIC
} }
} }
select_mode_filter() select_mode_filter() {
{
local filter="none ipset hostlist autohostlist" local filter="none ipset hostlist autohostlist"
[ "$MODE" = "tpws-socks" ] && filter="none hostlist autohostlist" [ "$MODE" = "tpws-socks" ] && filter="none hostlist autohostlist"
echo echo
echo select filtering : echo select filtering :
ask_list MODE_FILTER "$filter" none && write_config_var MODE_FILTER ask_list MODE_FILTER "$filter" none && write_config_var MODE_FILTER
} }
select_mode() select_mode() {
{
select_mode_mode select_mode_mode
select_mode_iface select_mode_iface
select_mode_http select_mode_http
@ -202,8 +193,7 @@ select_mode()
select_mode_filter select_mode_filter
} }
select_getlist() select_getlist() {
{
if [ "$MODE_FILTER" = "ipset" -o "$MODE_FILTER" = "hostlist" ]; then if [ "$MODE_FILTER" = "ipset" -o "$MODE_FILTER" = "hostlist" ]; then
local D=N local D=N
[ -n "$GETLIST" ] && D=Y [ -n "$GETLIST" ] && D=Y
@ -224,14 +214,12 @@ select_getlist()
write_config_var GETLIST write_config_var GETLIST
} }
ask_config() ask_config() {
{
select_mode select_mode
select_getlist select_getlist
} }
ask_config_offload() ask_config_offload() {
{
[ "$FWTYPE" = nftables ] || is_ipt_flow_offload_avail && { [ "$FWTYPE" = nftables ] || is_ipt_flow_offload_avail && {
echo echo
echo flow offloading can greatly increase speed on slow devices and high speed links \(usually 150+ mbits\) echo flow offloading can greatly increase speed on slow devices and high speed links \(usually 150+ mbits\)
@ -257,8 +245,7 @@ ask_config_offload()
} }
} }
ask_config_tmpdir() ask_config_tmpdir() {
{
# ask tmpdir change for low ram systems with enough free disk space # ask tmpdir change for low ram systems with enough free disk space
[ -n "$GETLIST" ] && [ $(get_free_space_mb "$EXEDIR/tmp") -ge 128 ] && [ $(get_ram_mb) -le 400 ] && { [ -n "$GETLIST" ] && [ $(get_free_space_mb "$EXEDIR/tmp") -ge 128 ] && [ $(get_ram_mb) -le 400 ] && {
echo echo
@ -275,13 +262,11 @@ ask_config_tmpdir()
} }
} }
nft_flow_offload() nft_flow_offload() {
{
[ "$UNAME" = Linux -a "$FWTYPE" = nftables -a "$MODE" != "tpws-socks" ] && [ "$FLOWOFFLOAD" = software -o "$FLOWOFFLOAD" = hardware ] [ "$UNAME" = Linux -a "$FWTYPE" = nftables -a "$MODE" != "tpws-socks" ] && [ "$FLOWOFFLOAD" = software -o "$FLOWOFFLOAD" = hardware ]
} }
ask_iface() ask_iface() {
{
# $1 - var to ask # $1 - var to ask
# $2 - additional name for empty string synonim # $2 - additional name for empty string synonim
@ -297,31 +282,28 @@ ask_iface()
ifs="$(ls /sys/class/net)" ifs="$(ls /sys/class/net)"
;; ;;
esac esac
[ -z "$def" ] && eval $1="$2" [ -z "$def" ] && eval "$1"="$2"
ask_list $1 "$i0$ifs" && { ask_list "$1" "$i0$ifs" && {
eval new="\$$1" eval new="\$$1"
[ "$new" = "$2" ] && eval $1="" [ "$new" = "$2" ] && eval "$1"=""
write_config_var $1 write_config_var "$1"
} }
} }
ask_iface_lan() ask_iface_lan() {
{
echo LAN interface : echo LAN interface :
local opt local opt
nft_flow_offload || opt=NONE nft_flow_offload || opt=NONE
ask_iface IFACE_LAN $opt ask_iface IFACE_LAN $opt
} }
ask_iface_wan() ask_iface_wan() {
{
echo WAN interface : echo WAN interface :
local opt local opt
nft_flow_offload || opt=ANY nft_flow_offload || opt=ANY
ask_iface IFACE_WAN $opt ask_iface IFACE_WAN $opt
} }
select_mode_iface() select_mode_iface() {
{ # OpenWrt has its own interface management scheme
# openwrt has its own interface management scheme
# filter just creates ip tables, no daemons involved # filter just creates ip tables, no daemons involved
# nfqws sits in POSTROUTING chain and unable to filter by incoming interface # nfqws sits in POSTROUTING chain and unable to filter by incoming interface
# tpws redirection works in PREROUTING chain # tpws redirection works in PREROUTING chain
@ -333,8 +315,8 @@ select_mode_iface()
case "$MODE" in case "$MODE" in
tpws-socks) tpws-socks)
echo "select LAN interface to allow socks access from your LAN. select NONE for localhost only." echo "select LAN interface to allow SOCKS access from your LAN. select NONE for localhost only."
echo "expect socks on tcp port $TPPORT" echo "expect SOCKS on tcp port $TPPORT"
ask_iface_lan ask_iface_lan
;; ;;
tpws) tpws)
@ -382,8 +364,7 @@ select_mode_iface()
esac esac
} }
default_files() default_files() {
{
# $1 - ro location # $1 - ro location
# $2 - rw location (can be equal to $1) # $2 - rw location (can be equal to $1)
[ -d "$2/ipset" ] || mkdir -p "$2/ipset" [ -d "$2/ipset" ] || mkdir -p "$2/ipset"
@ -397,15 +378,13 @@ default_files()
} }
done done
} }
copy_all() copy_all() {
{
local dir local dir
cp -R "$1" "$2" cp -R "$1" "$2"
[ -d "$2/tmp" ] || mkdir "$2/tmp" [ -d "$2/tmp" ] || mkdir "$2/tmp"
} }
copy_openwrt() copy_openwrt() {
{
local ARCH="$(get_bin_arch)" local ARCH="$(get_bin_arch)"
local BINDIR="$1/binaries/$ARCH" local BINDIR="$1/binaries/$ARCH"
local file local file
@ -420,13 +399,11 @@ copy_openwrt()
cp "$BINDIR/tpws" "$BINDIR/nfqws" "$BINDIR/ip2net" "$BINDIR/mdig" "$2/binaries/$ARCH" cp "$BINDIR/tpws" "$BINDIR/nfqws" "$BINDIR/ip2net" "$BINDIR/mdig" "$2/binaries/$ARCH"
} }
fix_perms_bin_test() fix_perms_bin_test() {
{
[ -d "$1" ] || return [ -d "$1" ] || return
find "$1/binaries" -name ip2net ! -perm -111 -exec chmod +x {} \; find "$1/binaries" -name ip2net ! -perm -111 -exec chmod +x {} \;
} }
fix_perms() fix_perms() {
{
[ -d "$1" ] || return [ -d "$1" ] || return
find "$1" -type d -exec chmod 755 {} \; find "$1" -type d -exec chmod 755 {} \;
find "$1" -type f -exec chmod 644 {} \; find "$1" -type f -exec chmod 644 {} \;
@ -437,6 +414,7 @@ fix_perms()
;; ;;
*) *)
chow=root:wheel chow=root:wheel
;;
esac esac
chown -R $chow "$1" chown -R $chow "$1"
find "$1/binaries" '(' -name tpws -o -name dvtws -o -name nfqws -o -name ip2net -o -name mdig ')' -exec chmod 755 {} \; find "$1/binaries" '(' -name tpws -o -name dvtws -o -name nfqws -o -name ip2net -o -name mdig ')' -exec chmod 755 {} \;
@ -475,36 +453,30 @@ init.d/runit/zapret/finish \
init.d/openrc/zapret \ init.d/openrc/zapret \
init.d/sysv/zapret \ init.d/sysv/zapret \
init.d/openwrt/zapret \ init.d/openwrt/zapret \
uninstall_easy.sh \ uninstall_easy.sh; do chmod 755 "$1/$f" 2>/dev/null; done
; do chmod 755 "$1/$f" 2>/dev/null ; done
} }
_backup_settings() {
_backup_settings()
{
local i=0 local i=0
for f in "$@"; do for f in "$@"; do
[ -f "$ZAPRET_TARGET/$f" ] && cp -f "$ZAPRET_TARGET/$f" "/tmp/zapret-bkp-$i" [ -f "$ZAPRET_TARGET/$f" ] && cp -f "$ZAPRET_TARGET/$f" "/tmp/zapret-bkp-$i"
i=$(($i + 1)) i=$(($i + 1))
done done
} }
_restore_settings() _restore_settings() {
{
local i=0 local i=0
for f in "$@"; do for f in "$@"; do
[ -f "/tmp/zapret-bkp-$i" ] && mv -f "/tmp/zapret-bkp-$i" "$ZAPRET_TARGET/$f" || rm -f "/tmp/zapret-bkp-$i" [ -f "/tmp/zapret-bkp-$i" ] && mv -f "/tmp/zapret-bkp-$i" "$ZAPRET_TARGET/$f" || rm -f "/tmp/zapret-bkp-$i"
i=$(($i + 1)) i=$(($i + 1))
done done
} }
backup_restore_settings() backup_restore_settings() {
{
# $1 - 1 - backup, 0 - restore # $1 - 1 - backup, 0 - restore
local mode=$1 local mode="$1"
on_off_function _backup_settings _restore_settings $mode "config" "init.d/sysv/custom" "init.d/openwrt/custom" "init.d/macos/custom" "ipset/zapret-hosts-user.txt" "ipset/zapret-hosts-user-exclude.txt" "ipset/zapret-hosts-user-ipban.txt" "ipset/zapret-hosts-auto.txt" on_off_function _backup_settings _restore_settings "$mode" "config" "init.d/sysv/custom" "init.d/openwrt/custom" "init.d/macos/custom" "ipset/zapret-hosts-user.txt" "ipset/zapret-hosts-user-exclude.txt" "ipset/zapret-hosts-user-ipban.txt" "ipset/zapret-hosts-auto.txt"
} }
check_location() check_location() {
{
# $1 - copy function # $1 - copy function
echo \* checking location echo \* checking location
@ -514,13 +486,13 @@ check_location()
default_files "$ZAPRET_TARGET" "$ZAPRET_RW" default_files "$ZAPRET_TARGET" "$ZAPRET_RW"
else else
echo echo
echo easy install is supported only from default location : $ZAPRET_TARGET echo easy install is supported only from default location: "$ZAPRET_TARGET"
echo currently its run from $EXEDIR echo currently its run from "$EXEDIR"
if ask_yes_no N "do you want the installer to copy it for you"; then if ask_yes_no N "do you want the installer to copy it for you"; then
local keep=N local keep=N
if [ -d "$ZAPRET_TARGET" ]; then if [ -d "$ZAPRET_TARGET" ]; then
echo echo
echo installer found existing $ZAPRET_TARGET echo installer found existing "$ZAPRET_TARGET"
echo directory needs to be replaced. config and custom scripts can be kept or replaced with clean version echo directory needs to be replaced. config and custom scripts can be kept or replaced with clean version
if ask_yes_no N "do you want to delete all files there and copy this version"; then if ask_yes_no N "do you want to delete all files there and copy this version"; then
echo echo
@ -530,7 +502,7 @@ check_location()
fi fi
rm -r "$ZAPRET_TARGET" rm -r "$ZAPRET_TARGET"
else else
echo refused to overwrite $ZAPRET_TARGET. exiting echo refused to overwrite "$ZAPRET_TARGET". exiting
exitp 3 exitp 3
fi fi
fi fi
@ -539,19 +511,17 @@ check_location()
$1 "$EXEDIR" "$ZAPRET_TARGET" $1 "$EXEDIR" "$ZAPRET_TARGET"
fix_perms "$ZAPRET_TARGET" fix_perms "$ZAPRET_TARGET"
[ "$keep" = "Y" ] && backup_restore_settings 0 [ "$keep" = "Y" ] && backup_restore_settings 0
echo relaunching itself from $ZAPRET_TARGET echo relaunching itself from "$ZAPRET_TARGET"
exec "$ZAPRET_TARGET/$(basename "$0")" exec "$ZAPRET_TARGET/$(basename "$0")"
else else
echo copying aborted. exiting echo copying aborted. exiting
exitp 3 exitp 3
fi fi
fi fi
echo running from $EXEDIR echo running from "$EXEDIR"
} }
service_install_systemd() {
service_install_systemd()
{
echo \* installing zapret service echo \* installing zapret service
if [ -w "$SYSTEMD_SYSTEM_DIR" ]; then if [ -w "$SYSTEMD_SYSTEM_DIR" ]; then
@ -567,8 +537,7 @@ service_install_systemd()
fi fi
} }
timer_install_systemd() timer_install_systemd() {
{
echo \* installing zapret-list-update timer echo \* installing zapret-list-update timer
if [ -w "$SYSTEMD_SYSTEM_DIR" ]; then if [ -w "$SYSTEMD_SYSTEM_DIR" ]; then
@ -590,8 +559,7 @@ timer_install_systemd()
fi fi
} }
download_list() download_list() {
{
[ -x "$GET_LIST" ] && { [ -x "$GET_LIST" ] && {
echo \* downloading blocked ip/host list echo \* downloading blocked ip/host list
@ -601,27 +569,22 @@ download_list()
} }
} }
dnstest() {
dnstest() # $1 - DNS server. empty for system resolver
{ nslookup w3.org "$1" >/dev/null 2>/dev/null
# $1 - dns server. empty for system resolver
nslookup w3.org $1 >/dev/null 2>/dev/null
} }
check_dns() check_dns() {
{
echo \* checking DNS echo \* checking DNS
dnstest || { dnstest || {
echo -- DNS is not working. It's either misconfigured or blocked or you don't have inet access. echo "-- DNS is not working. It's either misconfigured or blocked or you don't have inet access."
return 1 return 1
} }
echo system DNS is working echo system DNS is working
return 0 return 0
} }
install_systemd() {
install_systemd()
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret"
check_bins check_bins
@ -646,8 +609,7 @@ install_systemd()
service_start_systemd service_start_systemd
} }
_install_sysv() _install_sysv() {
{
# $1 - install init script # $1 - install init script
check_bins check_bins
@ -671,21 +633,17 @@ _install_sysv()
service_start_sysv service_start_sysv
} }
install_sysv() install_sysv() {
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret"
_install_sysv install_sysv_init _install_sysv install_sysv_init
} }
install_openrc() install_openrc() {
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/openrc/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/openrc/zapret"
_install_sysv install_openrc_init _install_sysv install_openrc_init
} }
install_linux() {
install_linux()
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret"
check_bins check_bins
@ -706,14 +664,12 @@ install_linux()
echo echo
echo '!!! WARNING. YOUR SETUP IS INCOMPLETE !!!' echo '!!! WARNING. YOUR SETUP IS INCOMPLETE !!!'
echo you must manually add to auto start : $INIT_SCRIPT_SRC start echo you must manually add to auto start: "$INIT_SCRIPT_SRC" start
echo make sure it\'s executed after your custom/firewall iptables configuration echo make sure it\'s executed after your custom/firewall iptables configuration
echo "if your system uses sysv init : ln -fs $INIT_SCRIPT_SRC /etc/init.d/zapret ; chkconfig zapret on" echo "if your system uses sysv init : ln -fs $INIT_SCRIPT_SRC /etc/init.d/zapret ; chkconfig zapret on"
} }
deoffload_openwrt_firewall() {
deoffload_openwrt_firewall()
{
echo \* checking flow offloading echo \* checking flow offloading
[ "$FWTYPE" = "nftables" ] || is_ipt_flow_offload_avail || { [ "$FWTYPE" = "nftables" ] || is_ipt_flow_offload_avail || {
@ -744,6 +700,7 @@ deoffload_openwrt_firewall()
echo zapret will disable system wide offloading setting and add selective rules if required echo zapret will disable system wide offloading setting and add selective rules if required
uci set firewall.@defaults[0].flow_offloading=0 uci set firewall.@defaults[0].flow_offloading=0
mod=1 mod=1
;;
esac esac
[ "$mod" = "1" ] && uci commit firewall [ "$mod" = "1" ] && uci commit firewall
else else
@ -752,10 +709,7 @@ deoffload_openwrt_firewall()
} }
install_openwrt() {
install_openwrt()
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/openwrt/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/openwrt/zapret"
FW_SCRIPT_SRC="$EXEDIR/init.d/openwrt/firewall.zapret" FW_SCRIPT_SRC="$EXEDIR/init.d/openwrt/firewall.zapret"
OPENWRT_FW_INCLUDE=/etc/firewall.zapret OPENWRT_FW_INCLUDE=/etc/firewall.zapret
@ -768,7 +722,7 @@ install_openwrt()
check_dns check_dns
check_virt check_virt
local FWTYPE_OLD=$FWTYPE local FWTYPE_OLD="$FWTYPE"
echo \* stopping current firewall rules/daemons echo \* stopping current firewall rules/daemons
"$INIT_SCRIPT_SRC" stop_fw "$INIT_SCRIPT_SRC" stop_fw
@ -798,17 +752,13 @@ install_openwrt()
restart_openwrt_firewall restart_openwrt_firewall
} }
remove_pf_zapret_hooks() {
remove_pf_zapret_hooks()
{
echo \* removing zapret PF hooks echo \* removing zapret PF hooks
pf_anchors_clear pf_anchors_clear
} }
macos_fw_reload_trigger_clear() macos_fw_reload_trigger_clear() {
{
case "$MODE" in case "$MODE" in
tpws | tpws-socks | custom) tpws | tpws-socks | custom)
LISTS_RELOAD= LISTS_RELOAD=
@ -816,8 +766,7 @@ macos_fw_reload_trigger_clear()
;; ;;
esac esac
} }
macos_fw_reload_trigger_set() macos_fw_reload_trigger_set() {
{
case "$MODE" in case "$MODE" in
tpws | custom) tpws | custom)
LISTS_RELOAD="$INIT_SCRIPT_SRC reload-fw-tables" LISTS_RELOAD="$INIT_SCRIPT_SRC reload-fw-tables"
@ -826,8 +775,7 @@ macos_fw_reload_trigger_set()
esac esac
} }
install_macos() install_macos() {
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/macos/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/macos/zapret"
# compile before root # compile before root
@ -852,7 +800,6 @@ install_macos()
service_start_macos service_start_macos
} }
# build binaries, do not use precompiled # build binaries, do not use precompiled
[ "$1" = "make" ] && FORCE_BUILD=1 [ "$1" = "make" ] && FORCE_BUILD=1
@ -881,5 +828,4 @@ case $SYSTEM in
;; ;;
esac esac
exitp 0 exitp 0

9
install_prereq.sh
View File

@ -3,7 +3,10 @@
# install prerequisites # install prerequisites
EXEDIR="$(dirname "$0")" EXEDIR="$(dirname "$0")"
EXEDIR="$(cd "$EXEDIR"; pwd)" EXEDIR="$(
cd "$EXEDIR"
pwd
)"
ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"} ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"}
ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"} ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"}
ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"} ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
@ -27,8 +30,8 @@ umask 0022
fix_sbin_path fix_sbin_path
fsleep_setup fsleep_setup
check_system accept_unknown_rc check_system accept_unknown_rc
[ $UNAME = "Linux" ] || { [ "$UNAME" = "Linux" ] || {
echo no prerequisites required for $UNAME echo no prerequisites required for "$UNAME"
exitp 0 exitp 0
} }
require_root require_root

5
ipset/clear_lists.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

142
ipset/create_ipset.sh
View File

@ -5,7 +5,10 @@
# $1=clear - clear ipset # $1=clear - clear ipset
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
. "$IPSET_DIR/../common/fwtype.sh" . "$IPSET_DIR/../common/fwtype.sh"
@ -27,17 +30,14 @@ while [ -n "$1" ]; do
shift shift
done done
file_extract_lines() {
file_extract_lines()
{
# $1 - filename # $1 - filename
# $2 - from line (starting with 0) # $2 - from line (starting with 0)
# $3 - line count # $3 - line count
# awk "{ err=1 } NR < $(($2+1)) { next } { print; err=0 } NR == $(($2+$3)) { exit err } END {exit err}" "$1" # awk "{ err=1 } NR < $(($2+1)) { next } { print; err=0 } NR == $(($2+$3)) { exit err } END {exit err}" "$1"
$AWK "NR < $(($2 + 1)) { next } { print } NR == $(($2 + $3)) { exit }" "$1" $AWK "NR < $(($2 + 1)) { next } { print } NR == $(($2 + $3)) { exit }" "$1"
} }
ipset_restore_chunked() ipset_restore_chunked() {
{
# $1 - filename # $1 - filename
# $2 - chunk size # $2 - chunk size
local pos lines local pos lines
@ -47,25 +47,21 @@ ipset_restore_chunked()
while [ "$pos" -gt "0" ]; do while [ "$pos" -gt "0" ]; do
pos=$((pos - $2)) pos=$((pos - $2))
[ "$pos" -lt "0" ] && pos=0 [ "$pos" -lt "0" ] && pos=0
file_extract_lines "$1" $pos $2 | ipset -! restore file_extract_lines "$1" $pos "$2" | ipset -! restore
sed -i "$(($pos + 1)),$ d" "$1" sed -i "$(($pos + 1)),$ d" "$1"
done done
} }
ipset_get_script() {
ipset_get_script()
{
# $1 - ipset name # $1 - ipset name
sed -nEe "s/^.+$/add $1 &/p" sed -nEe "s/^.+$/add $1 &/p"
} }
ipset_get_script_from_file() ipset_get_script_from_file() {
{
# $1 - filename # $1 - filename
# $2 - ipset name # $2 - ipset name
zzcat "$1" | sort -u | ipset_get_script $2 zzcat "$1" | sort -u | ipset_get_script "$2"
} }
ipset_restore() ipset_restore() {
{
# $1 - ipset name # $1 - ipset name
# $2 - filename # $2 - filename
@ -78,7 +74,7 @@ ipset_restore()
local T="Adding to ipset $1 " local T="Adding to ipset $1 "
[ "$svram" = "1" ] && T="$T (saveram)" [ "$svram" = "1" ] && T="$T (saveram)"
T="$T : $f" T="$T : $f"
echo $T echo "$T"
if [ "$svram" = "1" ]; then if [ "$svram" = "1" ]; then
ipset_get_script_from_file "$2" "$1" >"$IPSET_CMD" ipset_get_script_from_file "$2" "$1" >"$IPSET_CMD"
@ -88,41 +84,38 @@ ipset_restore()
ipset_get_script_from_file "$2" "$1" | ipset -! restore ipset_get_script_from_file "$2" "$1" | ipset -! restore
fi fi
} }
create_ipset() create_ipset() {
{
if [ "$1" -eq "6" ]; then if [ "$1" -eq "6" ]; then
FAMILY=inet6 FAMILY=inet6
else else
FAMILY=inet FAMILY=inet
fi fi
ipset create $2 $3 $4 family $FAMILY 2>/dev/null || { ipset create "$2" "$3" "$4" family $FAMILY 2>/dev/null || {
[ "$NO_UPDATE" = "1" ] && return 0 [ "$NO_UPDATE" = "1" ] && return 0
} }
ipset flush $2 ipset flush "$2"
[ "$DO_CLEAR" = "1" ] || { [ "$DO_CLEAR" = "1" ] || {
for f in "$5" "$6"; do for f in "$5" "$6"; do
ipset_restore "$2" "$f" ipset_restore "$2" "$f"
done done
[ -n "$IPSET_HOOK" ] && $IPSET_HOOK $2 | ipset_get_script $2 | ipset -! restore [ -n "$IPSET_HOOK" ] && $IPSET_HOOK "$2" | ipset_get_script "$2" | ipset -! restore
} }
return 0 return 0
} }
nfset_get_script_multi() nfset_get_script_multi() {
{
# $1 - set name # $1 - set name
# $2,$3,... - filenames # $2,$3,... - filenames
# all in one shot. this allows to merge overlapping ranges # all in one shot. this allows to merge overlapping ranges
# good but eats lots of RAM # good but eats lots of RAM
local set=$1 nonempty N=1 f local set="$1" nonempty N=1 f
shift shift
# first we need to make sure at least one element exists or nft will fail # first we need to make sure at least one element exists or nft will fail
while : while :; do
do
eval f=\$$N eval f=\$$N
[ -n "$f" ] || break [ -n "$f" ] || break
nonempty=$(zzexist "$f" && zzcat "$f" | head -n 1) nonempty=$(zzexist "$f" && zzcat "$f" | head -n 1)
@ -139,22 +132,20 @@ nfset_get_script_multi()
echo "}" echo "}"
} }
} }
nfset_restore() nfset_restore() {
{
# $1 - set name # $1 - set name
# $2,$3,... - filenames # $2,$3,... - filenames
echo "Adding to nfset $1 : $2 $3 $4 $5" echo "Adding to nfset $1 : $2 $3 $4 $5"
local hookfile local hookfile
[ -n "$IPSET_HOOK" ] && { [ -n "$IPSET_HOOK" ] && {
$IPSET_HOOK $1 >"$IPSET_HOOK_TEMP" $IPSET_HOOK "$1" >"$IPSET_HOOK_TEMP"
[ -s "$IPSET_HOOK_TEMP" ] && hookfile=$IPSET_HOOK_TEMP [ -s "$IPSET_HOOK_TEMP" ] && hookfile=$IPSET_HOOK_TEMP
} }
nfset_get_script_multi "$@" $hookfile | nft -f - nfset_get_script_multi "$@" "$hookfile" | nft -f -
rm -f "$IPSET_HOOK_TEMP" rm -f "$IPSET_HOOK_TEMP"
} }
create_nfset() create_nfset() {
{
# $1 - family # $1 - family
# $2 - set name # $2 - set name
# $3 - maxelem # $3 - maxelem
@ -162,54 +153,50 @@ create_nfset()
local policy local policy
[ $SAVERAM = "1" ] && policy="policy memory;" [ $SAVERAM = "1" ] && policy="policy memory;"
nft_create_set $2 "type ipv${1}_addr; size $3; flags interval; auto-merge; $policy" || { nft_create_set "$2" "type ipv${1}_addr; size $3; flags interval; auto-merge; $policy" || {
[ "$NO_UPDATE" = "1" ] && return 0 [ "$NO_UPDATE" = "1" ] && return 0
nft flush set inet $ZAPRET_NFT_TABLE $2 nft flush set inet "$ZAPRET_NFT_TABLE" "$2"
} }
[ "$DO_CLEAR" = "1" ] || { [ "$DO_CLEAR" = "1" ] || {
nfset_restore $2 $4 $5 nfset_restore "$2" "$4" "$5"
} }
return 0 return 0
} }
add_ipfw_table() add_ipfw_table() {
{
# $1 - table name # $1 - table name
sed -nEe "s/^.+$/table $1 add &/p" | ipfw -q /dev/stdin sed -nEe "s/^.+$/table $1 add &/p" | ipfw -q /dev/stdin
} }
populate_ipfw_table() populate_ipfw_table() {
{
# $1 - table name # $1 - table name
# $2 - ip list file # $2 - ip list file
zzexist "$2" || return zzexist "$2" || return
zzcat "$2" | sort -u | add_ipfw_table $1 zzcat "$2" | sort -u | add_ipfw_table "$1"
} }
create_ipfw_table() create_ipfw_table() {
{
# $1 - table name # $1 - table name
# $2 - table options # $2 - table options
# $3,$4, ... - ip list files. can be v4,v6 or mixed # $3,$4, ... - ip list files. can be v4,v6 or mixed
local name=$1 local name="$1"
ipfw table "$name" create $2 2>/dev/null || { ipfw table "$name" create "$2" 2>/dev/null || {
[ "$NO_UPDATE" = "1" ] && return 0 [ "$NO_UPDATE" = "1" ] && return 0
} }
ipfw -q table $1 flush ipfw -q table "$1" flush
shift shift
shift shift
[ "$DO_CLEAR" = "1" ] || { [ "$DO_CLEAR" = "1" ] || {
while [ -n "$1" ]; do while [ -n "$1" ]; do
echo "Adding to ipfw table $name : $1" echo "Adding to ipfw table $name : $1"
populate_ipfw_table $name "$1" populate_ipfw_table "$name" "$1"
shift shift
done done
[ -n "$IPSET_HOOK" ] && $IPSET_HOOK $name | add_ipfw_table $name [ -n "$IPSET_HOOK" ] && $IPSET_HOOK "$name" | add_ipfw_table "$name"
} }
return 0 return 0
} }
print_reloading_backend() print_reloading_backend() {
{
# $1 - backend name # $1 - backend name
local s="reloading $1 backend" local s="reloading $1 backend"
if [ "$NO_UPDATE" = 1 ]; then if [ "$NO_UPDATE" = 1 ]; then
@ -219,10 +206,9 @@ print_reloading_backend()
else else
s="$s (forced-update)" s="$s (forced-update)"
fi fi
echo $s echo "$s"
} }
oom_adjust_high oom_adjust_high
get_fwtype get_fwtype
@ -231,7 +217,7 @@ if [ -n "$LISTS_RELOAD" ] ; then
echo not reloading ip list backend echo not reloading ip list backend
true true
else else
echo executing custom ip list reload command : $LISTS_RELOAD echo executing custom ip list reload command : "$LISTS_RELOAD"
$LISTS_RELOAD $LISTS_RELOAD
[ -n "$IPSET_HOOK" ] && $IPSET_HOOK [ -n "$IPSET_HOOK" ] && $IPSET_HOOK
fi fi
@ -244,37 +230,37 @@ else
# only /tmp is considered tmpfs. other locations mean tmpdir was redirected to a disk # only /tmp is considered tmpfs. other locations mean tmpdir was redirected to a disk
SAVERAM=0 SAVERAM=0
[ "$TMPDIR" = "/tmp" ] && { [ "$TMPDIR" = "/tmp" ] && {
RAMSIZE=$($GREP MemTotal /proc/meminfo | $AWK '{print $2}') RAMSIZE=$($GREP MemTotal /proc/meminfo | $AWK "{print $2}")
[ "$RAMSIZE" -lt "110000" ] && SAVERAM=1 [ "$RAMSIZE" -lt "110000" ] && SAVERAM=1
} }
print_reloading_backend ipset print_reloading_backend ipset
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" != "1" ] && {
create_ipset 4 $ZIPSET hash:net "$IPSET_OPT" "$ZIPLIST" "$ZIPLIST_USER" create_ipset 4 "$ZIPSET" hash:net "$IPSET_OPT" "$ZIPLIST" "$ZIPLIST_USER"
create_ipset 4 $ZIPSET_IPBAN hash:net "$IPSET_OPT" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN" create_ipset 4 "$ZIPSET_IPBAN" hash:net "$IPSET_OPT" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN"
create_ipset 4 $ZIPSET_EXCLUDE hash:net "$IPSET_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE" create_ipset 4 "$ZIPSET_EXCLUDE" hash:net "$IPSET_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE"
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" != "1" ] && {
create_ipset 6 $ZIPSET6 hash:net "$IPSET_OPT" "$ZIPLIST6" "$ZIPLIST_USER6" create_ipset 6 "$ZIPSET6" hash:net "$IPSET_OPT" "$ZIPLIST6" "$ZIPLIST_USER6"
create_ipset 6 $ZIPSET_IPBAN6 hash:net "$IPSET_OPT" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6" create_ipset 6 "$ZIPSET_IPBAN6" hash:net "$IPSET_OPT" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6"
create_ipset 6 $ZIPSET_EXCLUDE6 hash:net "$IPSET_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE6" create_ipset 6 "$ZIPSET_EXCLUDE6" hash:net "$IPSET_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE6"
} }
true true
;; ;;
nftables) nftables)
nft_create_table && { nft_create_table && {
SAVERAM=0 SAVERAM=0
RAMSIZE=$($GREP MemTotal /proc/meminfo | $AWK '{print $2}') RAMSIZE=$($GREP MemTotal /proc/meminfo | $AWK "{print $2}")
[ "$RAMSIZE" -lt "420000" ] && SAVERAM=1 [ "$RAMSIZE" -lt "420000" ] && SAVERAM=1
print_reloading_backend "nftables set" print_reloading_backend "nftables set"
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" != "1" ] && {
create_nfset 4 $ZIPSET $SET_MAXELEM "$ZIPLIST" "$ZIPLIST_USER" create_nfset 4 "$ZIPSET" "$SET_MAXELEM" "$ZIPLIST" "$ZIPLIST_USER"
create_nfset 4 $ZIPSET_IPBAN $SET_MAXELEM "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN" create_nfset 4 "$ZIPSET_IPBAN" "$SET_MAXELEM" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN"
create_nfset 4 $ZIPSET_EXCLUDE $SET_MAXELEM_EXCLUDE "$ZIPLIST_EXCLUDE" create_nfset 4 "$ZIPSET_EXCLUDE" "$SET_MAXELEM_EXCLUDE" "$ZIPLIST_EXCLUDE"
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" != "1" ] && {
create_nfset 6 $ZIPSET6 $SET_MAXELEM "$ZIPLIST6" "$ZIPLIST_USER6" create_nfset 6 "$ZIPSET6" "$SET_MAXELEM" "$ZIPLIST6" "$ZIPLIST_USER6"
create_nfset 6 $ZIPSET_IPBAN6 $SET_MAXELEM "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6" create_nfset 6 "$ZIPSET_IPBAN6" "$SET_MAXELEM" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6"
create_nfset 6 $ZIPSET_EXCLUDE6 $SET_MAXELEM_EXCLUDE "$ZIPLIST_EXCLUDE6" create_nfset 6 "$ZIPSET_EXCLUDE6" "$SET_MAXELEM_EXCLUDE" "$ZIPLIST_EXCLUDE6"
} }
true true
} }
@ -282,21 +268,21 @@ else
ipfw) ipfw)
print_reloading_backend "ipfw table" print_reloading_backend "ipfw table"
if [ "$DISABLE_IPV4" != "1" ] && [ "$DISABLE_IPV6" != "1" ]; then if [ "$DISABLE_IPV4" != "1" ] && [ "$DISABLE_IPV6" != "1" ]; then
create_ipfw_table $ZIPSET "$IPFW_TABLE_OPT" "$ZIPLIST" "$ZIPLIST_USER" "$ZIPLIST6" "$ZIPLIST_USER6" create_ipfw_table "$ZIPSET" "$IPFW_TABLE_OPT" "$ZIPLIST" "$ZIPLIST_USER" "$ZIPLIST6" "$ZIPLIST_USER6"
create_ipfw_table $ZIPSET_IPBAN "$IPFW_TABLE_OPT" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6" create_ipfw_table "$ZIPSET_IPBAN" "$IPFW_TABLE_OPT" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6"
create_ipfw_table $ZIPSET_EXCLUDE "$IPFW_TABLE_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE" "$ZIPLIST_EXCLUDE6" create_ipfw_table "$ZIPSET_EXCLUDE" "$IPFW_TABLE_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE" "$ZIPLIST_EXCLUDE6"
elif [ "$DISABLE_IPV4" != "1" ]; then elif [ "$DISABLE_IPV4" != "1" ]; then
create_ipfw_table $ZIPSET "$IPFW_TABLE_OPT" "$ZIPLIST" "$ZIPLIST_USER" create_ipfw_table "$ZIPSET" "$IPFW_TABLE_OPT" "$ZIPLIST" "$ZIPLIST_USER"
create_ipfw_table $ZIPSET_IPBAN "$IPFW_TABLE_OPT" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN" create_ipfw_table "$ZIPSET_IPBAN" "$IPFW_TABLE_OPT" "$ZIPLIST_IPBAN" "$ZIPLIST_USER_IPBAN"
create_ipfw_table $ZIPSET_EXCLUDE "$IPFW_TABLE_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE" create_ipfw_table "$ZIPSET_EXCLUDE" "$IPFW_TABLE_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE"
elif [ "$DISABLE_IPV6" != "1" ]; then elif [ "$DISABLE_IPV6" != "1" ]; then
create_ipfw_table $ZIPSET "$IPFW_TABLE_OPT" "$ZIPLIST6" "$ZIPLIST_USER6" create_ipfw_table "$ZIPSET" "$IPFW_TABLE_OPT" "$ZIPLIST6" "$ZIPLIST_USER6"
create_ipfw_table $ZIPSET_IPBAN "$IPFW_TABLE_OPT" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6" create_ipfw_table "$ZIPSET_IPBAN" "$IPFW_TABLE_OPT" "$ZIPLIST_IPBAN6" "$ZIPLIST_USER_IPBAN6"
create_ipfw_table $ZIPSET_EXCLUDE "$IPFW_TABLE_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE6" create_ipfw_table "$ZIPSET_EXCLUDE" "$IPFW_TABLE_OPT_EXCLUDE" "$ZIPLIST_EXCLUDE6"
else else
create_ipfw_table $ZIPSET "$IPFW_TABLE_OPT" create_ipfw_table "$ZIPSET" "$IPFW_TABLE_OPT"
create_ipfw_table $ZIPSET_IPBAN "$IPFW_TABLE_OPT" create_ipfw_table "$ZIPSET_IPBAN" "$IPFW_TABLE_OPT"
create_ipfw_table $ZIPSET_EXCLUDE "$IPFW_TABLE_OPT_EXCLUDE" create_ipfw_table "$ZIPSET_EXCLUDE" "$IPFW_TABLE_OPT_EXCLUDE"
fi fi
true true
;; ;;

91
ipset/def.sh
View File

@ -1,6 +1,9 @@
[ -n "$IPSET_DIR" ] || { [ -n "$IPSET_DIR" ] || {
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
} }
. "$IPSET_DIR/../config" . "$IPSET_DIR/../config"
@ -39,13 +42,10 @@ ZIPLIST_USER_IPBAN6="$IPSET_DIR/zapret-ip-user-ipban6.txt"
ZUSERLIST_IPBAN="$IPSET_DIR/zapret-hosts-user-ipban.txt" ZUSERLIST_IPBAN="$IPSET_DIR/zapret-hosts-user-ipban.txt"
ZUSERLIST_EXCLUDE="$IPSET_DIR/zapret-hosts-user-exclude.txt" ZUSERLIST_EXCLUDE="$IPSET_DIR/zapret-hosts-user-exclude.txt"
[ -n "$IP2NET" ] || IP2NET="$IPSET_DIR/../ip2net/ip2net" [ -n "$IP2NET" ] || IP2NET="$IPSET_DIR/../ip2net/ip2net"
[ -n "$MDIG" ] || MDIG="$IPSET_DIR/../mdig/mdig" [ -n "$MDIG" ] || MDIG="$IPSET_DIR/../mdig/mdig"
[ -z "$MDIG_THREADS" ] && MDIG_THREADS=30 [ -z "$MDIG_THREADS" ] && MDIG_THREADS=30
# BSD grep is damn slow with -f option. prefer GNU grep (ggrep) if present # BSD grep is damn slow with -f option. prefer GNU grep (ggrep) if present
# MacoS in cron does not include /usr/local/bin to PATH # MacoS in cron does not include /usr/local/bin to PATH
if [ -x /usr/local/bin/ggrep ]; then if [ -x /usr/local/bin/ggrep ]; then
@ -65,13 +65,11 @@ else
AWK=awk AWK=awk
fi fi
grep_supports_b() grep_supports_b() {
{
# \b does not work with BSD grep # \b does not work with BSD grep
$GREP --version 2>&1 | $GREP -qE "BusyBox|GNU" $GREP --version 2>&1 | $GREP -qE "BusyBox|GNU"
} }
get_ip_regex() get_ip_regex() {
{
REG_IPV4='((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\/([0-9]|[12][0-9]|3[012]))?' REG_IPV4='((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\/([0-9]|[12][0-9]|3[012]))?'
REG_IPV6='[0-9a-fA-F]{1,4}:([0-9a-fA-F]{1,4}|:)+(\/([0-9][0-9]?|1[01][0-9]|12[0-8]))?' REG_IPV6='[0-9a-fA-F]{1,4}:([0-9a-fA-F]{1,4}|:)+(\/([0-9][0-9]?|1[01][0-9]|12[0-8]))?'
# good but too slow # good but too slow
@ -82,33 +80,28 @@ get_ip_regex()
# } # }
} }
ip2net4() ip2net4() {
{
if [ -x "$IP2NET" ]; then if [ -x "$IP2NET" ]; then
"$IP2NET" -4 $IP2NET_OPT4 "$IP2NET" -4 "$IP2NET_OPT4"
else else
sort -u sort -u
fi fi
} }
ip2net6() ip2net6() {
{
if [ -x "$IP2NET" ]; then if [ -x "$IP2NET" ]; then
"$IP2NET" -6 $IP2NET_OPT6 "$IP2NET" -6 "$IP2NET_OPT6"
else else
sort -u sort -u
fi fi
} }
zzexist() zzexist() {
{
[ -f "$1.gz" ] || [ -f "$1" ] [ -f "$1.gz" ] || [ -f "$1" ]
} }
zztest() zztest() {
{
gzip -t "$1" 2>/dev/null gzip -t "$1" 2>/dev/null
} }
zzcat() zzcat() {
{
if [ -f "$1.gz" ]; then if [ -f "$1.gz" ]; then
gunzip -c "$1.gz" gunzip -c "$1.gz"
elif [ -f "$1" ]; then elif [ -f "$1" ]; then
@ -119,8 +112,7 @@ zzcat()
fi fi
fi fi
} }
zz() zz() {
{
if [ "$GZIP_LISTS" = "1" ]; then if [ "$GZIP_LISTS" = "1" ]; then
gzip -c >"$1.gz" gzip -c >"$1.gz"
rm -f "$1" rm -f "$1"
@ -129,8 +121,7 @@ zz()
rm -f "$1.gz" rm -f "$1.gz"
fi fi
} }
zzsize() zzsize() {
{
local f="$1" local f="$1"
[ -f "$1.gz" ] && f="$1.gz" [ -f "$1.gz" ] && f="$1.gz"
if [ -f "$f" ]; then if [ -f "$f" ]; then
@ -140,34 +131,31 @@ zzsize()
fi fi
} }
digger() digger() {
{
# $1 - family (4|6) # $1 - family (4|6)
# $2 - s=enable mdig stats # $2 - s=enable mdig stats
if [ -x "$MDIG" ]; then if [ -x "$MDIG" ]; then
local cmd local cmd
[ "$2" = "s" ] && cmd=--stats=1000 [ "$2" = "s" ] && cmd=--stats=1000
"$MDIG" --family=$1 --threads=$MDIG_THREADS $cmd "$MDIG" --family="$1" --threads="$MDIG_THREADS" $cmd
else else
local A=A local A=A
[ "$1" = "6" ] && A=AAAA [ "$1" = "6" ] && A=AAAA
dig $A +short +time=8 +tries=2 -f - | $GREP -E '^[^;].*[^\.]$' dig $A +short +time=8 +tries=2 -f - | $GREP -E '^[^;].*[^\.]$'
fi fi
} }
filedigger() filedigger() {
{
# $1 - hostlist # $1 - hostlist
# $2 - family (4|6) # $2 - family (4|6)
>&2 echo digging $(wc -l <"$1" | xargs) ipv$2 domains : "$1" echo ">&2 digging $(wc -l <"$1" | xargs) ipv$2 domains : $1"
zzcat "$1" | digger $2 s zzcat "$1" | digger "$2" s
} }
flush_dns_cache() flush_dns_cache() {
{
echo clearing all known DNS caches echo clearing all known DNS caches
if exists killall; then if exists killall; then
killall -HUP dnsmasq 2>/dev/null killall -HUP dnsmasq 2>/dev/null
# MacOS # macOS
killall -HUP mDNSResponder 2>/dev/null killall -HUP mDNSResponder 2>/dev/null
elif exists pkill; then elif exists pkill; then
pkill -HUP ^dnsmasq$ pkill -HUP ^dnsmasq$
@ -184,13 +172,12 @@ flush_dns_cache()
fi fi
} }
dnstest() dnstest() {
{ local ip
local ip="$(echo w3.org | digger 46)" ip="$(echo w3.org | digger 46)"
[ -n "$ip" ] [ -n "$ip" ]
} }
dnstest_with_cache_clear() dnstest_with_cache_clear() {
{
flush_dns_cache flush_dns_cache
if dnstest; then if dnstest; then
echo DNS is working echo DNS is working
@ -201,26 +188,21 @@ dnstest_with_cache_clear()
fi fi
} }
cut_local() {
cut_local()
{
$GREP -vE '^192\.168\.|^127\.|^10\.' $GREP -vE '^192\.168\.|^127\.|^10\.'
} }
cut_local6() cut_local6() {
{
$GREP -vE '^::|^fc..:|^fd..:|^fe8.:|^fe9.:|^fea.:|^feb.:|^FC..:|^FD..:|^FE8.:|^FE9.:|^FEA.:|^FEB.:' $GREP -vE '^::|^fc..:|^fd..:|^fe8.:|^fe9.:|^fea.:|^feb.:|^FC..:|^FD..:|^FE8.:|^FE9.:|^FEA.:|^FEB.:'
} }
oom_adjust_high() oom_adjust_high() {
{
[ -f /proc/$$/oom_score_adj ] && { [ -f /proc/$$/oom_score_adj ] && {
echo setting high oom kill priority echo setting high oom kill priority
echo -n 100 >/proc/$$/oom_score_adj echo -n 100 >/proc/$$/oom_score_adj
} }
} }
getexclude() getexclude() {
{
oom_adjust_high oom_adjust_high
dnstest_with_cache_clear || return dnstest_with_cache_clear || return
[ -f "$ZUSERLIST_EXCLUDE" ] && { [ -f "$ZUSERLIST_EXCLUDE" ] && {
@ -230,15 +212,13 @@ getexclude()
return 0 return 0
} }
_get_ipban() _get_ipban() {
{
[ -f "$ZUSERLIST_IPBAN" ] && { [ -f "$ZUSERLIST_IPBAN" ] && {
[ "$DISABLE_IPV4" != "1" ] && filedigger "$ZUSERLIST_IPBAN" 4 | cut_local | sort -u >"$ZIPLIST_USER_IPBAN" [ "$DISABLE_IPV4" != "1" ] && filedigger "$ZUSERLIST_IPBAN" 4 | cut_local | sort -u >"$ZIPLIST_USER_IPBAN"
[ "$DISABLE_IPV6" != "1" ] && filedigger "$ZUSERLIST_IPBAN" 6 | cut_local6 | sort -u >"$ZIPLIST_USER_IPBAN6" [ "$DISABLE_IPV6" != "1" ] && filedigger "$ZUSERLIST_IPBAN" 6 | cut_local6 | sort -u >"$ZIPLIST_USER_IPBAN6"
} }
} }
getuser() getuser() {
{
getexclude || return getexclude || return
[ -f "$ZUSERLIST" ] && { [ -f "$ZUSERLIST" ] && {
[ "$DISABLE_IPV4" != "1" ] && filedigger "$ZUSERLIST" 4 | cut_local | sort -u >"$ZIPLIST_USER" [ "$DISABLE_IPV4" != "1" ] && filedigger "$ZUSERLIST" 4 | cut_local | sort -u >"$ZIPLIST_USER"
@ -247,15 +227,13 @@ getuser()
_get_ipban _get_ipban
return 0 return 0
} }
getipban() getipban() {
{
getexclude || return getexclude || return
_get_ipban _get_ipban
return 0 return 0
} }
hup_zapret_daemons() hup_zapret_daemons() {
{
echo forcing zapret daemons to reload their hostlist echo forcing zapret daemons to reload their hostlist
if exists killall; then if exists killall; then
killall -HUP tpws nfqws dvtws 2>/dev/null killall -HUP tpws nfqws dvtws 2>/dev/null
@ -265,4 +243,3 @@ hup_zapret_daemons()
echo no mass killer available ! cant HUP zapret daemons echo no mass killer available ! cant HUP zapret daemons
fi fi
} }

5
ipset/get_antifilter_allyouneed.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

5
ipset/get_antifilter_ip.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

5
ipset/get_antifilter_ipresolve.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

5
ipset/get_antifilter_ipsmart.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

5
ipset/get_antifilter_ipsum.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

8
ipset/get_antizapret_domains.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
@ -14,7 +17,6 @@ getipban || FAIL=1
ZURL=https://antizapret.prostovpn.org:8443/domains-export.txt ZURL=https://antizapret.prostovpn.org:8443/domains-export.txt
ZDOM="$TMPDIR/zapret.txt" ZDOM="$TMPDIR/zapret.txt"
curl -H "Accept-Encoding: gzip" -k --fail --max-time 600 --connect-timeout 5 --retry 3 --max-filesize 251658240 "$ZURL" | gunzip - >"$ZDOM" || curl -H "Accept-Encoding: gzip" -k --fail --max-time 600 --connect-timeout 5 --retry 3 --max-filesize 251658240 "$ZURL" | gunzip - >"$ZDOM" ||
{ {
echo domain list download failed echo domain list download failed
@ -22,7 +24,7 @@ curl -H "Accept-Encoding: gzip" -k --fail --max-time 600 --connect-timeout 5 --r
} }
dlsize=$(LANG=C wc -c "$ZDOM" | xargs | cut -f 1 -d ' ') dlsize=$(LANG=C wc -c "$ZDOM" | xargs | cut -f 1 -d ' ')
if test $dlsize -lt 102400; then if test "$dlsize" -lt 102400; then
echo list file is too small. can be bad. echo list file is too small. can be bad.
exit 2 exit 2
fi fi

5
ipset/get_config.sh
View File

@ -2,7 +2,10 @@
# run script specified in config # run script specified in config
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/../config" . "$IPSET_DIR/../config"

5
ipset/get_exclude.sh
View File

@ -2,7 +2,10 @@
# resolve user host list # resolve user host list
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

5
ipset/get_ipban.sh
View File

@ -2,7 +2,10 @@
# resolve only ipban user host list # resolve only ipban user host list
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

29
ipset/get_reestr_hostlist.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
@ -9,37 +12,33 @@ ZREESTR="$TMPDIR/zapret.txt"
IPB="$TMPDIR/ipb.txt" IPB="$TMPDIR/ipb.txt"
ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv
dl_checked() dl_checked() {
{
# $1 - url # $1 - url
# $2 - file # $2 - file
# $3 - minsize # $3 - minsize
# $4 - maxsize # $4 - maxsize
# $5 - maxtime # $5 - maxtime
curl -k --fail --max-time $5 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$2" "$1" || curl -k --fail --max-time "$5" --connect-timeout 10 --retry 4 --max-filesize "$4" -o "$2" "$1" ||
{ {
echo list download failed : $1 echo list download failed : "$1"
return 2 return 2
} }
dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ') dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
if test $dlsize -lt $3; then if test "$dlsize" -lt "$3"; then
echo list is too small : $dlsize bytes. can be bad. echo list is too small : "$dlsize" bytes. can be bad.
return 2 return 2
fi fi
return 0 return 0
} }
reestr_list() reestr_list() {
{ LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK "{ print tolower($0) }"
LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
} }
reestr_extract_ip() reestr_extract_ip() {
{ LANG=C nice -n 5 "$AWK" -F ";" "($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}" "$ZREESTR" | LANG=C $AWK "{split($1, a, /\|/); for (i in a) {print a[i]}}"
LANG=C nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' "$ZREESTR" | LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
} }
ipban_fin() ipban_fin() {
{
getipban getipban
"$IPSET_DIR/create_ipset.sh" "$IPSET_DIR/create_ipset.sh"
} }

16
ipset/get_reestr_preresolved.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
@ -13,20 +16,19 @@ URL6="$BASEURL/reestr_resolved6.txt"
IPB4="$BASEURL/reestr_ipban4.txt" IPB4="$BASEURL/reestr_ipban4.txt"
IPB6="$BASEURL/reestr_ipban6.txt" IPB6="$BASEURL/reestr_ipban6.txt"
dl() dl() {
{
# $1 - url # $1 - url
# $2 - file # $2 - file
# $3 - minsize # $3 - minsize
# $4 - maxsize # $4 - maxsize
curl -H "Accept-Encoding: gzip" -k --fail --max-time 120 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || curl -H "Accept-Encoding: gzip" -k --fail --max-time 120 --connect-timeout 10 --retry 4 --max-filesize "$4" -o "$TMPLIST" "$1" ||
{ {
echo list download failed : $1 echo list download failed : "$1"
exit 2 exit 2
} }
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
if test $dlsize -lt $3; then if test "$dlsize" -lt "$3"; then
echo list is too small : $dlsize bytes. can be bad. echo list is too small : "$dlsize" bytes. can be bad.
exit 2 exit 2
fi fi
zzcat "$TMPLIST" | zz "$2" zzcat "$TMPLIST" | zz "$2"

16
ipset/get_reestr_preresolved_smart.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
@ -13,20 +16,19 @@ URL6="$BASEURL/reestr_smart6.txt"
IPB4="$BASEURL/reestr_ipban4.txt" IPB4="$BASEURL/reestr_ipban4.txt"
IPB6="$BASEURL/reestr_ipban6.txt" IPB6="$BASEURL/reestr_ipban6.txt"
dl() dl() {
{
# $1 - url # $1 - url
# $2 - file # $2 - file
# $3 - minsize # $3 - minsize
# $4 - maxsize # $4 - maxsize
curl -H "Accept-Encoding: gzip" -k --fail --max-time 120 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || curl -H "Accept-Encoding: gzip" -k --fail --max-time 120 --connect-timeout 10 --retry 4 --max-filesize "$4" -o "$TMPLIST" "$1" ||
{ {
echo list download failed : $1 echo list download failed : "$1"
exit 2 exit 2
} }
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
if test $dlsize -lt $3; then if test "$dlsize" -lt "$3"; then
echo list is too small : $dlsize bytes. can be bad. echo list is too small : "$dlsize" bytes. can be bad.
exit 2 exit 2
fi fi
zzcat "$TMPLIST" | zz "$2" zzcat "$TMPLIST" | zz "$2"

16
ipset/get_reestr_resolvable_domains.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
@ -12,20 +15,19 @@ URL="$BASEURL/reestr_hostname_resolvable.txt"
IPB4="$BASEURL/reestr_ipban4.txt" IPB4="$BASEURL/reestr_ipban4.txt"
IPB6="$BASEURL/reestr_ipban6.txt" IPB6="$BASEURL/reestr_ipban6.txt"
dl() dl() {
{
# $1 - url # $1 - url
# $2 - file # $2 - file
# $3 - minsize # $3 - minsize
# $4 - maxsize # $4 - maxsize
curl -H "Accept-Encoding: gzip" -k --fail --max-time 120 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || curl -H "Accept-Encoding: gzip" -k --fail --max-time 120 --connect-timeout 10 --retry 4 --max-filesize "$4" -o "$TMPLIST" "$1" ||
{ {
echo list download failed : $1 echo list download failed : "$1"
exit 2 exit 2
} }
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
if test $dlsize -lt $3; then if test "$dlsize" -lt "$3"; then
echo list is too small : $dlsize bytes. can be bad. echo list is too small : "$dlsize" bytes. can be bad.
exit 2 exit 2
fi fi
zzcat "$TMPLIST" | zz "$2" zzcat "$TMPLIST" | zz "$2"

24
ipset/get_reestr_resolve.sh
View File

@ -1,7 +1,10 @@
#!/bin/sh #!/bin/sh
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR" || exit
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"
@ -12,33 +15,30 @@ ZIPLISTTMP="$TMPDIR/zapret-ip.txt"
#ZURL=https://reestr.rublacklist.net/api/current #ZURL=https://reestr.rublacklist.net/api/current
ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv
dl_checked() dl_checked() {
{
# $1 - url # $1 - url
# $2 - file # $2 - file
# $3 - minsize # $3 - minsize
# $4 - maxsize # $4 - maxsize
# $5 - maxtime # $5 - maxtime
curl -k --fail --max-time $5 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$2" "$1" || curl -k --fail --max-time "$5" --connect-timeout 10 --retry 4 --max-filesize "$4" -o "$2" "$1" ||
{ {
echo list download failed : $1 echo list download failed : "$1"
return 2 return 2
} }
dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ') dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
if test $dlsize -lt $3; then if test "$dlsize" -lt "$3"; then
echo list is too small : $dlsize bytes. can be bad. echo list is too small : "$dlsize" bytes. can be bad.
return 2 return 2
fi fi
return 0 return 0
} }
reestr_list() reestr_list() {
{
LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p'
} }
reestr_extract_ip() reestr_extract_ip() {
{ LANG=C nice -n 5 "$AWK" -F ';' "($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}" "$ZREESTR" | LANG=C $AWK "{split($1, a, /\|/); for (i in a) {print a[i]}}"
LANG=C nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' "$ZREESTR" | LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
} }
getuser && { getuser && {

5
ipset/get_user.sh
View File

@ -2,7 +2,10 @@
# resolve user host list # resolve user host list
IPSET_DIR="$(dirname "$0")" IPSET_DIR="$(dirname "$0")"
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" IPSET_DIR="$(
cd "$IPSET_DIR"
pwd
)"
. "$IPSET_DIR/def.sh" . "$IPSET_DIR/def.sh"

22
uninstall_easy.sh
View File

@ -3,7 +3,10 @@
# automated script for easy uninstalling zapret # automated script for easy uninstalling zapret
EXEDIR="$(dirname "$0")" EXEDIR="$(dirname "$0")"
EXEDIR="$(cd "$EXEDIR"; pwd)" EXEDIR="$(
cd "$EXEDIR"
pwd
)"
ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"} ZAPRET_BASE=${ZAPRET_BASE:-"$EXEDIR"}
ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"} ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"}
ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"} ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
@ -26,8 +29,7 @@ IPSET_DIR="$ZAPRET_BASE/ipset"
. "$ZAPRET_BASE/common/pf.sh" . "$ZAPRET_BASE/common/pf.sh"
. "$ZAPRET_BASE/common/installer.sh" . "$ZAPRET_BASE/common/installer.sh"
remove_systemd() remove_systemd() {
{
clear_ipset clear_ipset
service_stop_systemd service_stop_systemd
service_remove_systemd service_remove_systemd
@ -36,16 +38,14 @@ remove_systemd()
crontab_del crontab_del
} }
remove_openrc() remove_openrc() {
{
clear_ipset clear_ipset
service_remove_openrc service_remove_openrc
nft_del_table nft_del_table
crontab_del crontab_del
} }
remove_linux() remove_linux() {
{
INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret" INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret"
clear_ipset clear_ipset
@ -61,8 +61,7 @@ remove_linux()
echo 'you must manually remove zapret auto start from your system' echo 'you must manually remove zapret auto start from your system'
} }
remove_openwrt() remove_openwrt() {
{
OPENWRT_FW_INCLUDE=/etc/firewall.zapret OPENWRT_FW_INCLUDE=/etc/firewall.zapret
clear_ipset clear_ipset
@ -74,14 +73,12 @@ remove_openwrt()
crontab_del crontab_del
} }
remove_macos() remove_macos() {
{
remove_macos_firewall remove_macos_firewall
service_remove_macos service_remove_macos
crontab_del crontab_del
} }
fix_sbin_path fix_sbin_path
check_system check_system
require_root require_root
@ -106,5 +103,4 @@ case $SYSTEM in
;; ;;
esac esac
exitp 0 exitp 0

Write Preview
Loading…
Cancel
Save