mirror of https://github.com/bol-van/zapret/
bol-van
3 years ago
3 changed files with 458 additions and 4 deletions
@ -0,0 +1,452 @@ |
|||
#!/bin/sh |
|||
|
|||
EXEDIR="$(dirname "$0")" |
|||
EXEDIR="$(cd "$EXEDIR"; pwd)" |
|||
ZAPRET_BASE="$EXEDIR" |
|||
|
|||
[ -n "$QNUM" ] || QNUM=59780 |
|||
[ -n "$NFQWS" ] || NFQWS="$ZAPRET_BASE/nfq/nfqws" |
|||
[ -n "$MDIG" ] || MDIG="$ZAPRET_BASE/mdig/mdig" |
|||
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000 |
|||
DOMAIN=rutracker.org |
|||
CURL_MAX_TIME=5 |
|||
MIN_TTL=1 |
|||
MAX_TTL=12 |
|||
HDRTEMP=/tmp/zapret-hdr.txt |
|||
ECHON="echo -n" |
|||
|
|||
DNSCHECK_DNS="8.8.8.8 1.1.1.1 77.88.8.8" |
|||
DNSCHECK_DOM="pornhub.com putinhuylo.com rutracker.org nnmclub.to protonmail.com" |
|||
DNSCHECK_DIG1=/tmp/dig1.txt |
|||
DNSCHECK_DIG2=/tmp/dig2.txt |
|||
DNSCHECK_DIGS=/tmp/digs.txt |
|||
|
|||
|
|||
exists() |
|||
{ |
|||
which $1 >/dev/null 2>/dev/null |
|||
} |
|||
killwait() |
|||
{ |
|||
# $1 - signal (-9, -2, ...) |
|||
# $2 - pid |
|||
kill $1 $2 |
|||
# suppress job kill message |
|||
wait $2 2>/dev/null |
|||
} |
|||
|
|||
exitp() |
|||
{ |
|||
local A |
|||
|
|||
echo |
|||
echo press enter to continue |
|||
read A |
|||
exit $1 |
|||
} |
|||
|
|||
read_yes_no() |
|||
{ |
|||
# $1 - default (Y/N) |
|||
local A |
|||
read A |
|||
[ -z "$A" ] || ([ "$A" != "Y" ] && [ "$A" != "y" ] && [ "$A" != "N" ] && [ "$A" != "n" ]) && A=$1 |
|||
[ "$A" = "Y" ] || [ "$A" = "y" ] || [ "$A" = "1" ] |
|||
} |
|||
ask_yes_no() |
|||
{ |
|||
# $1 - default (Y/N or 0/1) |
|||
# $2 - text |
|||
local DEFAULT=$1 |
|||
[ "$1" = "1" ] && DEFAULT=Y |
|||
[ "$1" = "0" ] && DEFAULT=N |
|||
[ -z "$DEFAULT" ] && DEFAULT=N |
|||
$ECHON "$2 (default : $DEFAULT) (Y/N) ? " |
|||
read_yes_no $DEFAULT |
|||
} |
|||
ask_yes_no_var() |
|||
{ |
|||
# $1 - variable name for answer : 0/1 |
|||
# $2 - text |
|||
local DEFAULT |
|||
eval DEFAULT="\$$1" |
|||
if ask_yes_no "$DEFAULT" "$2"; then |
|||
eval $1=1 |
|||
else |
|||
eval $1=0 |
|||
fi |
|||
} |
|||
|
|||
|
|||
require_root() |
|||
{ |
|||
echo \* checking privileges |
|||
[ $(id -u) -ne "0" ] && { |
|||
echo root is required |
|||
exists sudo && exec sudo "$0" |
|||
exists su && exec su -c "$0" |
|||
echo su or sudo not found |
|||
exitp 2 |
|||
} |
|||
} |
|||
|
|||
IPT() |
|||
{ |
|||
$IPTABLES -C "$@" >/dev/null 2>/dev/null || $IPTABLES -I "$@" |
|||
} |
|||
IPT_DEL() |
|||
{ |
|||
$IPTABLES -C "$@" >/dev/null 2>/dev/null && $IPTABLES -D "$@" |
|||
} |
|||
|
|||
|
|||
check_system() |
|||
{ |
|||
echo \* checking system |
|||
|
|||
local UNAME=$(uname) |
|||
[ "$UNAME" = "Linux" ] || { |
|||
echo not supported |
|||
exitp 5 |
|||
} |
|||
} |
|||
|
|||
check_prerequisites() |
|||
{ |
|||
echo \* checking prerequisites |
|||
|
|||
[ -x "$NFQWS" ] && [ -x "$MDIG" ] || { |
|||
echo $NFQWS or $MDIG is not available. run $ZAPRET_BASE/install_bin.sh |
|||
exitp 6 |
|||
} |
|||
|
|||
for prog in iptables ip6tables curl; do |
|||
exists $prog || { |
|||
echo $prog does not exist. please install |
|||
exitp 6 |
|||
} |
|||
done |
|||
} |
|||
|
|||
|
|||
hdrfile_http_code() |
|||
{ |
|||
# $1 - hdr file |
|||
sed -nre '1,1 s/^HTTP\/1\.[0,1] ([0-9]+) .*$/\1/p' "$1" |
|||
} |
|||
hdrfile_location() |
|||
{ |
|||
# $1 - hdr file |
|||
|
|||
# some DPIs return CRLF line ending |
|||
tr -d '\015' <"$1" | sed -nre 's/^[L|l][O|o][C|c][A|a][T|t][I|i][O|o][N|n]:[ \t]*([^ \t]*)[ \t]*$/\1/p' |
|||
} |
|||
curl_test_http() |
|||
{ |
|||
# $1 - ip version : 4/6 |
|||
# $2 - domain name |
|||
local code loc |
|||
curl -${1}SsD "$HDRTEMP" --max-time $CURL_MAX_TIME $CURL_OPT "http://$2" -o /dev/null 2>&1 || { |
|||
code=$? |
|||
rm -f "$HDRTEMP" |
|||
return $code |
|||
} |
|||
code=$(hdrfile_http_code "$HDRTEMP") |
|||
[ "$code" = 301 -o "$code" = 302 -o "$code" = 307 -o "$code" = 308 ] && { |
|||
loc=$(hdrfile_location "$HDRTEMP") |
|||
[ "${loc#*$2}" = "$loc" ] && { |
|||
echo suspicious redirection to : $loc |
|||
rm -f "$HDRTEMP" |
|||
return 254 |
|||
} |
|||
} |
|||
rm -f "$HDRTEMP" |
|||
return 0 |
|||
} |
|||
curl_test_https() |
|||
{ |
|||
# $1 - ip version : 4/6 |
|||
# $2 - domain name |
|||
|
|||
# prevent using QUIC if available in curl |
|||
curl -${1}Ss --max-time $CURL_MAX_TIME $CURL_OPT --http1.1 "https://$2" -o /dev/null 2>&1 |
|||
} |
|||
|
|||
nfqws_ipt_prepare() |
|||
{ |
|||
# $1 - port |
|||
IPT POSTROUTING -t mangle -p tcp --dport $1 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK -j NFQUEUE --queue-num $QNUM |
|||
} |
|||
nfqws_ipt_unprepare() |
|||
{ |
|||
# $1 - port |
|||
IPT_DEL POSTROUTING -t mangle -p tcp --dport $1 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK -j NFQUEUE --queue-num $QNUM |
|||
} |
|||
nfqws_start() |
|||
{ |
|||
"$NFQWS" --dpi-desync-fwmark=$DESYNC_MARK --qnum=$QNUM "$@" >/dev/null & |
|||
} |
|||
|
|||
curl_test() |
|||
{ |
|||
# $1 - test function |
|||
# $2 - domain |
|||
$1 $IPV $2 && { |
|||
echo '!!!!! AVAILABLE !!!!!' |
|||
return 0 |
|||
} |
|||
local code=$? |
|||
if [ $code = 254 ]; then |
|||
echo UNAVAILABLE |
|||
else |
|||
echo UNAVAILABLE code=$code |
|||
fi |
|||
return $code |
|||
} |
|||
nfqws_curl_test() |
|||
{ |
|||
# $1 - test function |
|||
# $2 - domain |
|||
# $3,$4,$5, ... - nfqws params |
|||
local code pid testf=$1 dom=$2 |
|||
shift |
|||
shift |
|||
echo - checking nfqws "$@" |
|||
nfqws_start "$@" |
|||
pid=$! |
|||
curl_test $testf $dom |
|||
code=$? |
|||
killwait -9 $pid |
|||
return $code |
|||
} |
|||
check_domain_bypass() |
|||
{ |
|||
# $1 - test function |
|||
# $2 - domain |
|||
|
|||
local pid strategy tests='fake' |
|||
|
|||
if nfqws_curl_test $1 $2 --dpi-desync=split2; then |
|||
strategy='--dpi-desync=split2' |
|||
else |
|||
tests="$tests split fake,split" |
|||
fi |
|||
if nfqws_curl_test $1 $2 --dpi-desync=disorder2; then |
|||
[ -n "$strategy" ] || strategy='--dpi-desync=disorder2' |
|||
else |
|||
tests="$tests disorder fake,disorder" |
|||
fi |
|||
|
|||
local ttls=$(seq -s ' ' $MIN_TTL $MAX_TTL) |
|||
for desync in $tests; do |
|||
for ttl in $ttls; do |
|||
nfqws_curl_test $1 $2 --dpi-desync=$desync --dpi-desync-ttl=$ttl && { |
|||
[ -n "$strategy" ] || strategy="--dpi-desync=$desync --dpi-desync-ttl=$ttl" |
|||
break |
|||
} |
|||
done |
|||
done |
|||
|
|||
echo |
|||
if [ -n "$strategy" ]; then |
|||
echo "!!!!! working strategy found : nfqws $strategy !!!!!" |
|||
return 0 |
|||
else |
|||
echo 'working strategy not found' |
|||
return 1 |
|||
fi |
|||
} |
|||
|
|||
check_domain() |
|||
{ |
|||
# $1 - test function |
|||
# $2 - port |
|||
# $3 - domain |
|||
|
|||
echo |
|||
echo \* $1 $3 |
|||
|
|||
# in case was interrupted before |
|||
nfqws_ipt_unprepare $2 |
|||
killall nfqws 2>/dev/null |
|||
|
|||
echo "- checking without DPI bypass" |
|||
curl_test $1 $3 && return 0 |
|||
|
|||
echo preparing nfqws redirection |
|||
nfqws_ipt_prepare $2 |
|||
|
|||
check_domain_bypass $1 $3 |
|||
|
|||
echo clearing nfqws redirection |
|||
nfqws_ipt_unprepare $2 |
|||
} |
|||
check_domain_http() |
|||
{ |
|||
# $1 - domain |
|||
check_domain curl_test_http 80 $1 |
|||
} |
|||
check_domain_https() |
|||
{ |
|||
# $1 - domain |
|||
check_domain curl_test_https 443 $1 |
|||
} |
|||
|
|||
ask_params() |
|||
{ |
|||
echo |
|||
echo NOTE ! this test should be run with zapret or any other bypass software disabled, without VPN |
|||
echo NOTE ! this test will kill all nfqws processes. if you have already set up zapret you will need to restart it after test is complete. |
|||
|
|||
$ECHON "test this domain [ $DOMAIN ] : " |
|||
local dom |
|||
read dom |
|||
[ -n "$dom" ] && DOMAIN=$dom |
|||
|
|||
$ECHON "ip protocol version [ 4 ] : " |
|||
read IPV |
|||
[ -n "$IPV" ] || IPV=4 |
|||
[ "$IPV" = 4 -o "$IPV" = 6 ] || { |
|||
echo invalid ip version. should be 4 or 6. |
|||
exitp 1 |
|||
} |
|||
IPTABLES=iptables |
|||
[ "$IPV" = 6 ] && IPTABLES=ip6tables |
|||
|
|||
ENABLE_HTTP=1 |
|||
ask_yes_no_var ENABLE_HTTP "check http" |
|||
|
|||
ENABLE_HTTPS=1 |
|||
ask_yes_no_var ENABLE_HTTPS "check https" |
|||
|
|||
IGNORE_CA=0 |
|||
CURL_OPT= |
|||
[ "$ENABLE_HTTPS" = "1" ] && { |
|||
echo on limited systems like openwrt CA certificates might not be installed to preserve space |
|||
echo in such a case curl cannot verify server certificate and you should either install ca-bundle or disable verification |
|||
echo however disabling verification will break https check if ISP does MitM attack and substitutes server certificate |
|||
ask_yes_no_var IGNORE_CA "do not verify server certificate" |
|||
[ "$IGNORE_CA" = 1 ] && CURL_OPT=-k |
|||
} |
|||
} |
|||
|
|||
|
|||
|
|||
pingtest() |
|||
{ |
|||
ping -c 1 -W 1 $1 >/dev/null |
|||
} |
|||
dnstest() |
|||
{ |
|||
# $1 - dns server. empty for system resolver |
|||
nslookup w3.org $1 >/dev/null 2>/dev/null |
|||
} |
|||
find_working_public_dns() |
|||
{ |
|||
for dns in $DNSCHECK_DNS; do |
|||
pingtest $dns && dnstest $dns && { |
|||
PUBDNS=$dns |
|||
return 0 |
|||
} |
|||
done |
|||
return 1 |
|||
} |
|||
check_dns_spoof() |
|||
{ |
|||
# $1 - domain |
|||
# $2 - public DNS |
|||
echo $1 | "$EXEDIR/mdig/mdig" --family=4 >"$DNSCHECK_DIG1" |
|||
nslookup $1 $2 | sed -n '/Name:/,$p' | grep ^Address | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' >"$DNSCHECK_DIG2" |
|||
# check whether system resolver returns anything other than public DNS |
|||
grep -qvFf "$DNSCHECK_DIG2" "$DNSCHECK_DIG1" |
|||
} |
|||
check_dns_cleanup() |
|||
{ |
|||
rm -f "$DNSCHECK_DIG1" "$DNSCHECK_DIG2" "$DNSCHECK_DIGS" 2>/dev/null |
|||
} |
|||
check_dns() |
|||
{ |
|||
local C1 C2 |
|||
|
|||
echo \* checking DNS |
|||
|
|||
[ -f "$DNSCHECK_DIGS" ] && rm -f "$DNSCHECK_DIGS" |
|||
|
|||
dnstest || { |
|||
echo -- DNS is not working. It's either misconfigured or blocked or you don't have inet access. |
|||
return 1 |
|||
} |
|||
echo system DNS is working |
|||
|
|||
if find_working_public_dns ; then |
|||
echo comparing system resolver to public DNS : $PUBDNS |
|||
for dom in $DNSCHECK_DOM; do |
|||
if check_dns_spoof $dom $PUBDNS ; then |
|||
echo $dom : MISMATCH |
|||
echo -- system resolver : |
|||
cat "$DNSCHECK_DIG1" |
|||
echo -- $PUBDNS : |
|||
cat "$DNSCHECK_DIG2" |
|||
check_dns_cleanup |
|||
echo -- POSSIBLE DNS HIJACK DETECTED. ZAPRET WILL NOT HELP YOU IN CASE DNS IS SPOOFED !!! |
|||
echo -- DNS CHANGE OR DNSCRYPT MAY BE REQUIRED |
|||
return 1 |
|||
else |
|||
echo $dom : OK |
|||
cat "$DNSCHECK_DIG1" >>"$DNSCHECK_DIGS" |
|||
fi |
|||
done |
|||
else |
|||
echo no working public DNS was found. looks like public DNS blocked. |
|||
for dom in $DNSCHECK_DOM; do echo $dom; done | "$EXEDIR/mdig/mdig" --threads=10 --family=4 >"$DNSCHECK_DIGS" |
|||
fi |
|||
|
|||
echo checking resolved IP uniqueness for : $DNSCHECK_DOM |
|||
echo censor\'s DNS can return equal result for multiple blocked domains. |
|||
C1=$(wc -l <"$DNSCHECK_DIGS") |
|||
C2=$(sort -u "$DNSCHECK_DIGS" | wc -l) |
|||
[ "$C1" -eq 0 ] && |
|||
{ |
|||
echo -- DNS is not working. It's either misconfigured or blocked or you don't have inet access. |
|||
check_dns_cleanup |
|||
return 1 |
|||
} |
|||
[ "$C1" = "$C2" ] || |
|||
{ |
|||
echo system dns resolver has returned equal IPs for some domains checked above \($C1 total, $C2 unique\) |
|||
echo non-unique IPs : |
|||
sort "$DNSCHECK_DIGS" | uniq -d |
|||
echo -- POSSIBLE DNS HIJACK DETECTED. ZAPRET WILL NOT HELP YOU IN CASE DNS IS SPOOFED !!! |
|||
echo -- DNSCRYPT MAY BE REQUIRED |
|||
check_dns_cleanup |
|||
return 1 |
|||
} |
|||
echo all resolved IPs are unique |
|||
echo -- DNS looks good |
|||
echo -- NOTE this check is Russia targeted. In your country other domains may be blocked. |
|||
check_dns_cleanup |
|||
return 0 |
|||
} |
|||
|
|||
|
|||
sigint() |
|||
{ |
|||
# make sure we are not in a middle state that impacts connectivity |
|||
echo |
|||
echo terminating... |
|||
nfqws_ipt_unprepare 80 |
|||
nfqws_ipt_unprepare 443 |
|||
killall nfqws 2>/dev/null |
|||
exit 1 |
|||
} |
|||
|
|||
trap 'sigint' 2 |
|||
|
|||
check_system |
|||
check_prerequisites |
|||
require_root |
|||
check_dns |
|||
ask_params |
|||
|
|||
[ "$ENABLE_HTTP" = 1 ] && check_domain_http $DOMAIN |
|||
[ "$ENABLE_HTTPS" = 1 ] && check_domain_https $DOMAIN |
|||
Loading…
Reference in new issue