mirror of https://github.com/bol-van/zapret/
NewUse
10 months ago
committed by
GitHub
GitHub
71 changed files with 1679 additions and 672 deletions
@ -1,3 +1,13 @@ |
|||||
googlevideo.com |
googlevideo.com |
||||
youtubei.googleapis.com |
youtubei.googleapis.com |
||||
i.ytimg.com |
ytimg.com |
||||
|
yt3.ggpht.com |
||||
|
yt4.ggpht.com |
||||
|
youtube.com |
||||
|
youtubeembeddedplayer.googleapis.com |
||||
|
ytimg.l.google.com |
||||
|
jnn-pa.googleapis.com |
||||
|
youtube-nocookie.com |
||||
|
youtube-ui.l.google.com |
||||
|
yt-video-upload.l.google.com |
||||
|
wide-youtube.l.google.com |
||||
|
|||||
@ -0,0 +1,43 @@ |
|||||
|
custom_runner() |
||||
|
{ |
||||
|
# $1 - function name |
||||
|
# $2+ - params |
||||
|
|
||||
|
local n script FUNC=$1 |
||||
|
|
||||
|
shift |
||||
|
|
||||
|
[ -f "$CUSTOM_DIR/custom" ] && { |
||||
|
unset -f $FUNC |
||||
|
. "$CUSTOM_DIR/custom" |
||||
|
existf $FUNC && $FUNC "$@" |
||||
|
} |
||||
|
[ -d "$CUSTOM_DIR/custom.d" ] && { |
||||
|
n=$(ls "$CUSTOM_DIR/custom.d" | wc -c | xargs) |
||||
|
[ "$n" = 0 ] || { |
||||
|
for script in "$CUSTOM_DIR/custom.d/"*; do |
||||
|
[ -f "$script" ] || continue |
||||
|
unset -f $FUNC |
||||
|
. "$script" |
||||
|
existf $FUNC && $FUNC "$@" |
||||
|
done |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
alloc_tpws_port() |
||||
|
{ |
||||
|
# $1 - target var name |
||||
|
alloc_num NUMPOOL_TPWS_PORT $1 910 979 |
||||
|
} |
||||
|
alloc_qnum() |
||||
|
{ |
||||
|
# $1 - target var name |
||||
|
alloc_num NUMPOOL_QNUM $1 65400 65499 |
||||
|
} |
||||
|
alloc_dnum() |
||||
|
{ |
||||
|
# alloc daemon number |
||||
|
# $1 - target var name |
||||
|
alloc_num NUMPOOL_DNUM $1 1000 1999 |
||||
|
} |
||||
@ -1,26 +0,0 @@ |
|||||
# this script is an example describing how to run tpws on a custom port |
|
||||
|
|
||||
TPPORT_MY=987 |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
local opt="--user=root --port=$TPPORT_MY" |
|
||||
tpws_apply_binds opt |
|
||||
opt="$opt $TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX" |
|
||||
do_daemon $1 1 "$TPWS" "$opt" |
|
||||
} |
|
||||
|
|
||||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
|
||||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
|
||||
|
|
||||
zapret_custom_firewall_v4() |
|
||||
{ |
|
||||
pf_anchor_zapret_v4_tpws $TPPORT_MY |
|
||||
} |
|
||||
zapret_custom_firewall_v6() |
|
||||
{ |
|
||||
pf_anchor_zapret_v6_tpws $TPPORT_MY |
|
||||
} |
|
||||
@ -0,0 +1,31 @@ |
|||||
|
# this script is an example describing how to run tpws on a custom port |
||||
|
|
||||
|
TPWS_OPT_EXTRA=${TPWS_OPT_EXTRA:---split-pos=2} |
||||
|
TPWS_OPT_SUFFIX_EXTRA="${TPWS_OPT_SUFFIX_EXTRA:-}" |
||||
|
DPORTS_EXTRA=${DPORTS_EXTRA:-20443,20444,30000-30009} |
||||
|
|
||||
|
alloc_dnum DNUM_EXTRA_TPWS |
||||
|
alloc_tpws_port TPPORT_EXTRA_TPWS |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
local opt="--user=root --port=$TPPORT_EXTRA_TPWS" |
||||
|
tpws_apply_binds opt |
||||
|
opt="$opt $TPWS_OPT_EXTRA" |
||||
|
filter_apply_hostlist_target opt |
||||
|
filter_apply_suffix opt "$TPWS_OPT_SUFFIX_EXTRA" |
||||
|
do_daemon $1 $DNUM_EXTRA_TPWS "$TPWS" "$opt" |
||||
|
} |
||||
|
|
||||
|
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
||||
|
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
||||
|
|
||||
|
zapret_custom_firewall_v4() |
||||
|
{ |
||||
|
pf_anchor_zapret_v4_tpws $TPPORT_EXTRA_TPWS $(replace_char - : $DPORTS_EXTRA) |
||||
|
} |
||||
|
zapret_custom_firewall_v6() |
||||
|
{ |
||||
|
pf_anchor_zapret_v6_tpws $TPPORT_EXTRA_TPWS $(replace_char - : $DPORTS_EXTRA) |
||||
|
} |
||||
@ -0,0 +1,18 @@ |
|||||
|
# this custom script applies tpws mode as it would be with MODE=tpws |
||||
|
|
||||
|
OVERRIDE=tpws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall_v4() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4 |
||||
|
} |
||||
|
zapret_custom_firewall_v6() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6 |
||||
|
} |
||||
@ -0,0 +1,18 @@ |
|||||
|
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
||||
|
|
||||
|
OVERRIDE=tpws-socks |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall_v4() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4 |
||||
|
} |
||||
|
zapret_custom_firewall_v6() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6 |
||||
|
} |
||||
@ -1,21 +0,0 @@ |
|||||
# this script contain your special code to launch daemons and configure firewall |
|
||||
# use helpers from "functions" file |
|
||||
# in case of upgrade keep this file only, do not modify others |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
: |
|
||||
} |
|
||||
|
|
||||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
|
||||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
|
||||
|
|
||||
zapret_custom_firewall_v4() |
|
||||
{ |
|
||||
: |
|
||||
} |
|
||||
zapret_custom_firewall_v6() |
|
||||
{ |
|
||||
: |
|
||||
} |
|
||||
@ -1,47 +0,0 @@ |
|||||
# this custom script demonstrates how to reuse built-in modes and add something from yourself |
|
||||
|
|
||||
MY_TPPORT=$(($TPPORT + 1)) |
|
||||
MY_TPWS_OPT="--methodeol --hostcase" |
|
||||
MY_DPORT=81 |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# stop logic is managed by procd |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local opt |
|
||||
|
|
||||
start_daemons_procd |
|
||||
|
|
||||
opt="--port=$MY_TPPORT $MY_TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
run_tpws 100 "$opt" |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f4="-p tcp --dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f4="tcp dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
@ -1,69 +0,0 @@ |
|||||
# this custom script demonstrates how to apply tpws to http and nfqws to https |
|
||||
# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# stop logic is managed by procd |
|
||||
|
|
||||
local opt |
|
||||
|
|
||||
[ "$MODE_HTTP" = "1" ] && { |
|
||||
opt="--port=$TPPORT $TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX" |
|
||||
run_tpws 1 "$opt" |
|
||||
} |
|
||||
|
|
||||
[ "$MODE_HTTPS" = "1" ] && { |
|
||||
opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS" |
|
||||
filter_apply_hostlist_target opt |
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX" |
|
||||
run_daemon 2 $NFQWS "$opt" |
|
||||
} |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local f4 f6 |
|
||||
local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)" |
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|
||||
|
|
||||
[ "$MODE_HTTP" = "1" ] && { |
|
||||
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_tpws $1 "$f4" "$f6" $TPPORT |
|
||||
} |
|
||||
|
|
||||
[ "$MODE_HTTPS" = "1" ] && { |
|
||||
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM |
|
||||
} |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local f4 f6 |
|
||||
local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)" |
|
||||
local desync="mark and $DESYNC_MARK == 0" |
|
||||
|
|
||||
[ "$MODE_HTTP" = "1" ] && { |
|
||||
f4="tcp dport {$HTTP_PORTS}" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_tpws "$f4" "$f6" $TPPORT |
|
||||
} |
|
||||
|
|
||||
[ "$MODE_HTTPS" = "1" ] && { |
|
||||
f4="tcp dport {$HTTPS_PORTS} $first_packet_only" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM |
|
||||
# for modes that require incoming traffic |
|
||||
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM |
|
||||
} |
|
||||
} |
|
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies nfqws mode as it would be with MODE=nfqws |
||||
|
|
||||
|
OVERRIDE=nfqws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# stop logic is managed by procd |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws mode as it would be with MODE=tpws |
||||
|
|
||||
|
OVERRIDE=tpws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# stop logic is managed by procd |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
||||
|
|
||||
|
OVERRIDE=tpws-socks |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# stop logic is managed by procd |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,35 @@ |
|||||
|
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic |
||||
|
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts |
||||
|
|
||||
|
nfqws_tpws_inheritor() |
||||
|
{ |
||||
|
# $1 - inherited function |
||||
|
# $2 - 1 - run, 0 - stop |
||||
|
|
||||
|
[ "$MODE_HTTP" = "1" ] && { |
||||
|
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2 |
||||
|
} |
||||
|
|
||||
|
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && { |
||||
|
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2 |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# stop logic is managed by procd |
||||
|
|
||||
|
nfqws_tpws_inheritor start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -1,47 +1,38 @@ |
|||||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
||||
|
|
||||
QNUM2=$(($QNUM+20)) |
alloc_dnum DNUM_DHT4ALL |
||||
|
alloc_qnum QNUM_DHT4ALL |
||||
|
|
||||
zapret_custom_daemons() |
zapret_custom_daemons() |
||||
{ |
{ |
||||
# stop logic is managed by procd |
# stop logic is managed by procd |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
||||
local opt |
run_daemon $DNUM_DHT4ALL $NFQWS "$opt" |
||||
|
|
||||
start_daemons_procd |
|
||||
|
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|
||||
run_daemon 100 $NFQWS "$opt" |
|
||||
} |
} |
||||
zapret_custom_firewall() |
zapret_custom_firewall() |
||||
{ |
{ |
||||
# $1 - 1 - run, 0 - stop |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f uf4 uf6 |
local f uf4 uf6 |
||||
local first_packet_only="$ipt_connbytes 1:1" |
local first_packet_only="$ipt_connbytes 1:1" |
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32' |
f='-p udp -m length --length 109:407 -m u32 --u32' |
||||
uf4='0>>22&0x3C@8>>16=0x6431' |
uf4='0>>22&0x3C@8>>16=0x6431' |
||||
uf6='48>>16=0x6431' |
uf6='48>>16=0x6431' |
||||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 |
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL |
||||
|
|
||||
} |
} |
||||
zapret_custom_firewall_nft() |
zapret_custom_firewall_nft() |
||||
{ |
{ |
||||
# stop logic is not required |
# stop logic is not required |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packet_only="$nft_connbytes 1" |
local first_packet_only="$nft_connbytes 1" |
||||
local desync="mark and $DESYNC_MARK == 0" |
local desync="mark and $DESYNC_MARK == 0" |
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 |
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL |
||||
} |
} |
||||
File diff suppressed because one or more lines are too long
@ -1,47 +1,37 @@ |
|||||
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering |
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering |
||||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" |
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" |
||||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received |
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received |
||||
|
|
||||
QNUM2=$(($QNUM+10)) |
alloc_dnum DNUM_QUIC4ALL |
||||
|
alloc_qnum QNUM_QUIC4ALL |
||||
|
|
||||
zapret_custom_daemons() |
zapret_custom_daemons() |
||||
{ |
{ |
||||
# $1 - 1 - run, 0 - stop |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
||||
local opt |
run_daemon $DNUM_QUIC4ALL $NFQWS "$opt" |
||||
|
|
||||
zapret_do_daemons $1 |
|
||||
|
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
|
||||
do_nfqws $1 100 "$opt" |
|
||||
} |
} |
||||
zapret_custom_firewall() |
zapret_custom_firewall() |
||||
{ |
{ |
||||
# $1 - 1 - run, 0 - stop |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packets_only="$ipt_connbytes 1:3" |
local first_packets_only="$ipt_connbytes 1:3" |
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" |
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" |
||||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
||||
|
|
||||
} |
} |
||||
zapret_custom_firewall_nft() |
zapret_custom_firewall_nft() |
||||
{ |
{ |
||||
# stop logic is not required |
# stop logic is not required |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packets_only="$nft_connbytes 1-3" |
local first_packets_only="$nft_connbytes 1-3" |
||||
local desync="mark and $DESYNC_MARK == 0" |
local desync="mark and $DESYNC_MARK == 0" |
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f="udp dport {$QUIC_PORTS}" |
f="udp dport {$QUIC_PORTS}" |
||||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
||||
} |
} |
||||
@ -1,33 +0,0 @@ |
|||||
# this script contain your special code to launch daemons and configure firewall |
|
||||
# use helpers from "functions" file and "zapret" init script |
|
||||
# in case of upgrade keep this file only, do not modify others |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# stop logic is managed by procd |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Start daemon\(s\) |
|
||||
echo Study how other sections work |
|
||||
|
|
||||
run_daemon 1 /bin/sleep 20 |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure iptables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure nftables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
@ -1,47 +0,0 @@ |
|||||
# this custom script demonstrates how to reuse built-in modes and add something from yourself |
|
||||
|
|
||||
MY_TPPORT=$(($TPPORT + 1)) |
|
||||
MY_TPWS_OPT="--methodeol --hostcase" |
|
||||
MY_DPORT=81 |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local opt |
|
||||
|
|
||||
zapret_do_daemons $1 |
|
||||
|
|
||||
opt="--port=$MY_TPPORT $MY_TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
do_tpws $1 100 "$opt" |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f4="-p tcp --dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f4="tcp dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
@ -1,71 +0,0 @@ |
|||||
# this custom script demonstrates how to apply tpws to http and nfqws to https |
|
||||
# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local opt |
|
||||
|
|
||||
[ "$MODE_HTTP" = "1" ] && { |
|
||||
opt="--port=$TPPORT $TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX" |
|
||||
do_tpws $1 1 "$opt" |
|
||||
} |
|
||||
|
|
||||
[ "$MODE_HTTPS" = "1" ] && { |
|
||||
opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTPS" |
|
||||
filter_apply_hostlist_target opt |
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX" |
|
||||
do_nfqws $1 2 "$opt" |
|
||||
} |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local f4 f6 |
|
||||
local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)" |
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
|
||||
|
|
||||
[ "$MODE_HTTP" = "1" ] && { |
|
||||
f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_tpws $1 "$f4" "$f6" $TPPORT |
|
||||
} |
|
||||
|
|
||||
[ "$MODE_HTTPS" = "1" ] && { |
|
||||
f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM |
|
||||
# for modes that require incoming traffic |
|
||||
fw_reverse_nfqws_rule $1 "$f4" "$f6" $QNUM |
|
||||
} |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local f4 f6 |
|
||||
local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)" |
|
||||
local desync="mark and $DESYNC_MARK == 0" |
|
||||
|
|
||||
[ "$MODE_HTTP" = "1" ] && { |
|
||||
f4="tcp dport {$HTTP_PORTS}" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_tpws "$f4" "$f6" $TPPORT |
|
||||
} |
|
||||
|
|
||||
[ "$MODE_HTTPS" = "1" ] && { |
|
||||
f4="tcp dport {$HTTPS_PORTS} $first_packet_only" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM |
|
||||
# for modes that require incoming traffic |
|
||||
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM |
|
||||
} |
|
||||
} |
|
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies nfqws mode as it would be with MODE=nfqws |
||||
|
|
||||
|
OVERRIDE=nfqws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws mode as it would be with MODE=tpws |
||||
|
|
||||
|
OVERRIDE=tpws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
||||
|
|
||||
|
OVERRIDE=tpws-socks |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,35 @@ |
|||||
|
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic |
||||
|
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts |
||||
|
|
||||
|
nfqws_tpws_inheritor() |
||||
|
{ |
||||
|
# $1 - inherited function |
||||
|
# $2 - 1 - run, 0 - stop |
||||
|
|
||||
|
[ "$MODE_HTTP" = "1" ] && { |
||||
|
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2 |
||||
|
} |
||||
|
|
||||
|
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && { |
||||
|
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2 |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
nfqws_tpws_inheritor zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -1,49 +1,39 @@ |
|||||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
||||
|
|
||||
QNUM2=$(($QNUM+20)) |
alloc_dnum DNUM_DHT4ALL |
||||
|
alloc_qnum QNUM_DHT4ALL |
||||
|
|
||||
zapret_custom_daemons() |
zapret_custom_daemons() |
||||
{ |
{ |
||||
# stop logic is managed by procd |
# stop logic is managed by procd |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
||||
local opt |
do_nfqws $1 $DNUM_DHT4ALL "$opt" |
||||
|
|
||||
zapret_do_daemons $1 |
|
||||
|
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|
||||
do_nfqws $1 100 "$opt" |
|
||||
} |
} |
||||
zapret_custom_firewall() |
zapret_custom_firewall() |
||||
{ |
{ |
||||
# $1 - 1 - run, 0 - stop |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f uf4 uf6 |
local f uf4 uf6 |
||||
local first_packet_only="$ipt_connbytes 1:1" |
local first_packet_only="$ipt_connbytes 1:1" |
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32' |
f='-p udp -m length --length 109:407 -m u32 --u32' |
||||
uf4='0>>22&0x3C@8>>16=0x6431' |
uf4='0>>22&0x3C@8>>16=0x6431' |
||||
uf6='48>>16=0x6431' |
uf6='48>>16=0x6431' |
||||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 |
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL |
||||
|
|
||||
} |
} |
||||
zapret_custom_firewall_nft() |
zapret_custom_firewall_nft() |
||||
{ |
{ |
||||
# stop logic is not required |
# stop logic is not required |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packet_only="$nft_connbytes 1" |
local first_packet_only="$nft_connbytes 1" |
||||
local desync="mark and $DESYNC_MARK == 0" |
local desync="mark and $DESYNC_MARK == 0" |
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 |
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL |
||||
} |
} |
||||
|
|
||||
File diff suppressed because one or more lines are too long
@ -1,47 +1,37 @@ |
|||||
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering |
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering |
||||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" |
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" |
||||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received |
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received |
||||
|
|
||||
QNUM2=$(($QNUM+10)) |
alloc_dnum DNUM_QUIC4ALL |
||||
|
alloc_qnum QNUM_QUIC4ALL |
||||
|
|
||||
zapret_custom_daemons() |
zapret_custom_daemons() |
||||
{ |
{ |
||||
# stop logic is managed by procd |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local opt |
|
||||
|
|
||||
start_daemons_procd |
|
||||
|
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" |
||||
run_daemon 100 $NFQWS "$opt" |
do_nfqws $1 $DNUM_QUIC4ALL "$opt" |
||||
} |
} |
||||
zapret_custom_firewall() |
zapret_custom_firewall() |
||||
{ |
{ |
||||
# $1 - 1 - run, 0 - stop |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packets_only="$ipt_connbytes 1:3" |
local first_packets_only="$ipt_connbytes 1:3" |
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" |
f="-p udp -m multiport --dports $QUIC_PORTS_IPT" |
||||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
||||
|
|
||||
} |
} |
||||
zapret_custom_firewall_nft() |
zapret_custom_firewall_nft() |
||||
{ |
{ |
||||
# stop logic is not required |
# stop logic is not required |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packets_only="$nft_connbytes 1-3" |
local first_packets_only="$nft_connbytes 1-3" |
||||
local desync="mark and $DESYNC_MARK == 0" |
local desync="mark and $DESYNC_MARK == 0" |
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f="udp dport {$QUIC_PORTS}" |
f="udp dport {$QUIC_PORTS}" |
||||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 |
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL |
||||
} |
} |
||||
@ -1,34 +0,0 @@ |
|||||
# this script contain your special code to launch daemons and configure firewall |
|
||||
# use helpers from "functions" file |
|
||||
# in case of upgrade keep this file only, do not modify others |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Start daemon\(s\) |
|
||||
echo Study how other sections work |
|
||||
|
|
||||
do_daemon $1 1 /bin/sleep 20 |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure iptables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
|
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure nftables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
@ -0,0 +1,42 @@ |
|||||
|
#!/bin/sh |
||||
|
|
||||
|
IPSET_DIR="$(dirname "$0")" |
||||
|
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" |
||||
|
|
||||
|
. "$IPSET_DIR/def.sh" |
||||
|
|
||||
|
TMPLIST="$TMPDIR/list.txt" |
||||
|
|
||||
|
URL="https://github.com/1andrevich/Re-filter-lists/releases/latest/download/domains_all.lst" |
||||
|
|
||||
|
dl() |
||||
|
{ |
||||
|
# $1 - url |
||||
|
# $2 - file |
||||
|
# $3 - minsize |
||||
|
# $4 - maxsize |
||||
|
curl -L -H "Accept-Encoding: gzip" -k --fail --max-time 60 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || |
||||
|
{ |
||||
|
echo list download failed : $1 |
||||
|
exit 2 |
||||
|
} |
||||
|
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') |
||||
|
if test $dlsize -lt $3; then |
||||
|
echo list is too small : $dlsize bytes. can be bad. |
||||
|
exit 2 |
||||
|
fi |
||||
|
zzcat "$TMPLIST" | tr -d '\015' | zz "$2" |
||||
|
rm -f "$TMPLIST" |
||||
|
} |
||||
|
|
||||
|
# useful in case ipban set is used in custom scripts |
||||
|
FAIL= |
||||
|
getipban || FAIL=1 |
||||
|
"$IPSET_DIR/create_ipset.sh" |
||||
|
[ -n "$FAIL" ] && exit |
||||
|
|
||||
|
dl "$URL" "$ZHOSTLIST" 32768 4194304 |
||||
|
|
||||
|
hup_zapret_daemons |
||||
|
|
||||
|
exit 0 |
||||
@ -0,0 +1,39 @@ |
|||||
|
#!/bin/sh |
||||
|
|
||||
|
IPSET_DIR="$(dirname "$0")" |
||||
|
IPSET_DIR="$(cd "$IPSET_DIR"; pwd)" |
||||
|
|
||||
|
. "$IPSET_DIR/def.sh" |
||||
|
|
||||
|
TMPLIST="$TMPDIR/list.txt" |
||||
|
|
||||
|
URL="https://github.com/1andrevich/Re-filter-lists/releases/latest/download/ipsum.lst" |
||||
|
|
||||
|
dl() |
||||
|
{ |
||||
|
# $1 - url |
||||
|
# $2 - file |
||||
|
# $3 - minsize |
||||
|
# $4 - maxsize |
||||
|
curl -L -H "Accept-Encoding: gzip" -k --fail --max-time 60 --connect-timeout 10 --retry 4 --max-filesize $4 -o "$TMPLIST" "$1" || |
||||
|
{ |
||||
|
echo list download failed : $1 |
||||
|
exit 2 |
||||
|
} |
||||
|
dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ') |
||||
|
if test $dlsize -lt $3; then |
||||
|
echo list is too small : $dlsize bytes. can be bad. |
||||
|
exit 2 |
||||
|
fi |
||||
|
# remove DOS EOL \r |
||||
|
zzcat "$TMPLIST" | tr -d '\015' | zz "$2" |
||||
|
rm -f "$TMPLIST" |
||||
|
} |
||||
|
|
||||
|
getuser && { |
||||
|
[ "$DISABLE_IPV4" != "1" ] && { |
||||
|
dl "$URL" "$ZIPLIST" 32768 4194304 |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
"$IPSET_DIR/create_ipset.sh" |
||||
@ -0,0 +1,195 @@ |
|||||
|
#include <stdio.h> |
||||
|
#include "ipset.h" |
||||
|
#include "gzip.h" |
||||
|
#include "helpers.h" |
||||
|
|
||||
|
// inplace tolower() and add to pool
|
||||
|
static bool addpool(ipset *ips, char **s, const char *end, int *ct) |
||||
|
{ |
||||
|
char *p, cidr[128]; |
||||
|
size_t l; |
||||
|
struct cidr4 c4; |
||||
|
struct cidr6 c6; |
||||
|
|
||||
|
// advance until eol
|
||||
|
for (p=*s; p<end && *p && *p!='\r' && *p != '\n'; p++); |
||||
|
|
||||
|
// comment line
|
||||
|
if (!(**s == '#' || **s == ';' || **s == '/' || **s == '\r' || **s == '\n' )) |
||||
|
{ |
||||
|
l = p-*s; |
||||
|
if (l>=sizeof(cidr)) l=sizeof(cidr)-1; |
||||
|
memcpy(cidr,*s,l); |
||||
|
cidr[l]=0; |
||||
|
rtrim(cidr); |
||||
|
|
||||
|
if (parse_cidr4(cidr,&c4)) |
||||
|
{ |
||||
|
if (!ipset4AddCidr(&ips->ips4, &c4)) |
||||
|
{ |
||||
|
ipsetDestroy(ips); |
||||
|
return false; |
||||
|
} |
||||
|
(*ct)++; |
||||
|
} |
||||
|
else if (parse_cidr6(cidr,&c6)) |
||||
|
{ |
||||
|
if (!ipset6AddCidr(&ips->ips6, &c6)) |
||||
|
{ |
||||
|
ipsetDestroy(ips); |
||||
|
return false; |
||||
|
} |
||||
|
(*ct)++; |
||||
|
} |
||||
|
else |
||||
|
DLOG_ERR("bad ip or subnet : %s\n",cidr); |
||||
|
} |
||||
|
|
||||
|
// advance to the next line
|
||||
|
for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++); |
||||
|
*s = p; |
||||
|
return true; |
||||
|
|
||||
|
} |
||||
|
|
||||
|
static bool AppendIpset(ipset *ips, const char *filename) |
||||
|
{ |
||||
|
char *p, *e, s[256], *zbuf; |
||||
|
size_t zsize; |
||||
|
int ct = 0; |
||||
|
FILE *F; |
||||
|
int r; |
||||
|
|
||||
|
DLOG_CONDUP("Loading ipset %s\n",filename); |
||||
|
|
||||
|
if (!(F = fopen(filename, "rb"))) |
||||
|
{ |
||||
|
DLOG_ERR("Could not open %s\n", filename); |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
if (is_gzip(F)) |
||||
|
{ |
||||
|
r = z_readfile(F,&zbuf,&zsize); |
||||
|
fclose(F); |
||||
|
if (r==Z_OK) |
||||
|
{ |
||||
|
DLOG_CONDUP("zlib compression detected. uncompressed size : %zu\n", zsize); |
||||
|
|
||||
|
p = zbuf; |
||||
|
e = zbuf + zsize; |
||||
|
while(p<e) |
||||
|
{ |
||||
|
if (!addpool(ips,&p,e,&ct)) |
||||
|
{ |
||||
|
DLOG_ERR("Not enough memory to store ipset : %s\n", filename); |
||||
|
free(zbuf); |
||||
|
return false; |
||||
|
} |
||||
|
} |
||||
|
free(zbuf); |
||||
|
} |
||||
|
else |
||||
|
{ |
||||
|
DLOG_ERR("zlib decompression failed : result %d\n",r); |
||||
|
return false; |
||||
|
} |
||||
|
} |
||||
|
else |
||||
|
{ |
||||
|
DLOG_CONDUP("loading plain text list\n"); |
||||
|
|
||||
|
while (fgets(s, sizeof(s)-1, F)) |
||||
|
{ |
||||
|
p = s; |
||||
|
if (!addpool(ips,&p,p+strlen(p),&ct)) |
||||
|
{ |
||||
|
DLOG_ERR("Not enough memory to store ipset : %s\n", filename); |
||||
|
fclose(F); |
||||
|
return false; |
||||
|
} |
||||
|
} |
||||
|
fclose(F); |
||||
|
} |
||||
|
|
||||
|
DLOG_CONDUP("Loaded %d ip/subnets from %s\n", ct, filename); |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
static bool LoadIpsets(ipset *ips, struct str_list_head *file_list) |
||||
|
{ |
||||
|
struct str_list *file; |
||||
|
|
||||
|
ipsetDestroy(ips); |
||||
|
|
||||
|
LIST_FOREACH(file, file_list, next) |
||||
|
{ |
||||
|
if (!AppendIpset(ips, file->str)) return false; |
||||
|
} |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
bool LoadIncludeIpsets() |
||||
|
{ |
||||
|
struct desync_profile_list *dpl; |
||||
|
LIST_FOREACH(dpl, ¶ms.desync_profiles, next) |
||||
|
if (!LoadIpsets(&dpl->dp.ips, &dpl->dp.ipset_files)) |
||||
|
return false; |
||||
|
return true; |
||||
|
} |
||||
|
bool LoadExcludeIpsets() |
||||
|
{ |
||||
|
struct desync_profile_list *dpl; |
||||
|
LIST_FOREACH(dpl, ¶ms.desync_profiles, next) |
||||
|
if (!LoadIpsets(&dpl->dp.ips_exclude, &dpl->dp.ipset_exclude_files)) |
||||
|
return false; |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
bool SearchIpset(const ipset *ips, const struct in_addr *ipv4, const struct in6_addr *ipv6) |
||||
|
{ |
||||
|
char s_ip[40]; |
||||
|
bool bInSet=false; |
||||
|
|
||||
|
if (!!ipv4 != !!ipv6) |
||||
|
{ |
||||
|
*s_ip=0; |
||||
|
if (ipv4) |
||||
|
{ |
||||
|
if (params.debug) inet_ntop(AF_INET, ipv4, s_ip, sizeof(s_ip)); |
||||
|
if (ips->ips4) bInSet = ipset4Check(ips->ips4, ipv4, 32); |
||||
|
} |
||||
|
if (ipv6) |
||||
|
{ |
||||
|
if (params.debug) inet_ntop(AF_INET6, ipv6, s_ip, sizeof(s_ip)); |
||||
|
if (ips->ips6) bInSet = ipset6Check(ips->ips6, ipv6, 128); |
||||
|
} |
||||
|
VPRINT("ipset check for %s : %s\n", s_ip, bInSet ? "positive" : "negative"); |
||||
|
} |
||||
|
else |
||||
|
// ipv4 and ipv6 are both empty or non-empty
|
||||
|
VPRINT("ipset check error !!!!!!!! ipv4=%p ipv6=%p\n",ipv4,ipv6); |
||||
|
return bInSet; |
||||
|
} |
||||
|
|
||||
|
static bool IpsetCheck_(const ipset *ips, const ipset *ips_exclude, const struct in_addr *ipv4, const struct in6_addr *ipv6) |
||||
|
{ |
||||
|
if (!IPSET_EMPTY(ips_exclude)) |
||||
|
{ |
||||
|
VPRINT("exclude "); |
||||
|
if (SearchIpset(ips_exclude, ipv4, ipv6)) |
||||
|
return false; |
||||
|
} |
||||
|
if (!IPSET_EMPTY(ips)) |
||||
|
{ |
||||
|
VPRINT("include "); |
||||
|
return SearchIpset(ips, ipv4, ipv6); |
||||
|
} |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
bool IpsetCheck(struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6) |
||||
|
{ |
||||
|
if (!PROFILE_IPSETS_EMPTY(dp)) VPRINT("* ipset check for profile %d\n",dp->n); |
||||
|
return IpsetCheck_(&dp->ips,&dp->ips_exclude,ipv4,ipv6); |
||||
|
} |
||||
@ -0,0 +1,11 @@ |
|||||
|
#pragma once |
||||
|
|
||||
|
#include <stdbool.h> |
||||
|
#include <arpa/inet.h> |
||||
|
#include "params.h" |
||||
|
#include "pools.h" |
||||
|
|
||||
|
bool LoadIncludeIpsets(); |
||||
|
bool LoadExcludeIpsets(); |
||||
|
bool SearchIpset(const ipset *ips, const struct in_addr *ipv4, const struct in6_addr *ipv6); |
||||
|
bool IpsetCheck(struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6); |
||||
Loading…
Reference in new issue