gsd
/
zapret
mirror of https://github.com/bol-van/zapret/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

init: check MODE_HTTP/MODE_HTTPS to minimize nfqws processes

pull/81/head
bol-van 3 years ago
parent
494ac4b762
commit
e6303e988e
3 changed files with 578 additions and 338 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 826
      init.d/openwrt/functions
  2. 32
      init.d/openwrt/zapret
  3. 58
      init.d/sysv/functions

826
init.d/openwrt/functions
View File

@ -1,60 +1,130 @@
. /lib/functions/network.sh # init script functions library for desktop linux systems
[ -n "$ZAPRET_BASE" ] || ZAPRET_BASE=/opt/zapret [ -n "$ZAPRET_BASE" ] || ZAPRET_BASE=/opt/zapret
# SHOULD EDIT config
. "$ZAPRET_BASE/config" . "$ZAPRET_BASE/config"
exists()
{
which "$1" >/dev/null 2>/dev/null
}
existf()
{
type "$1" >/dev/null 2>/dev/null
}
is_linked_to_busybox()
{
local IFS F P
IFS=:
for path in $PATH; do
F=$path/$1
P="$(readlink $F)"
if [ -z "$P" ] && [ -x $F ] && [ ! -L $F ]; then return 1; fi
[ "${P%busybox*}" != "$P" ] && return
done
}
user_exists()
{
id -u $1 >/dev/null 2>/dev/null
}
useradd_compat()
{
# $1 - username
# skip for readonly systems
[ -w "/etc" ] && {
if exists useradd ; then
useradd --no-create-home --system --shell /bin/false $1
elif is_linked_to_busybox adduser ; then
# busybox has special adduser syntax
adduser -S -H -D $1
elif exists adduser; then
adduser --no-create-home --system --disabled-login $1
fi
}
user_exists $1
}
prepare_user()
{
# $WS_USER is required to prevent redirection of the traffic originating from TPWS itself
# otherwise infinite loop will occur
# also its good idea not to run tpws as root
user_exists $WS_USER || {
# fallback to daemon if we cant add WS_USER
useradd_compat $WS_USER || {
for user in daemon nobody; do
user_exists $user && {
WS_USER=$user
return 0
}
done
return 1
}
}
}
# this complex user selection allows to survive in any locked/readonly/minimalistic environment
[ -n "$WS_USER" ] || WS_USER=tpws
if prepare_user; then
USEROPT="--user=$WS_USER"
else
WS_USER=1
USEROPT="--uid $WS_USER:$WS_USER"
fi
PIDDIR=/var/run
IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
[ -n "$QNUM" ] || QNUM=200 [ -n "$QNUM" ] || QNUM=200
[ -n "$NFQWS" ] || NFQWS="$ZAPRET_BASE/nfq/nfqws"
NFQWS_OPT_BASE="$USEROPT --dpi-desync-fwmark=$DESYNC_MARK"
NFQWS_OPT_DESYNC_HTTP="${NFQWS_OPT_DESYNC_HTTP:-$NFQWS_OPT_DESYNC}"
NFQWS_OPT_DESYNC_HTTPS="${NFQWS_OPT_DESYNC_HTTPS:-$NFQWS_OPT_DESYNC}"
NFQWS_OPT_DESYNC_HTTP6="${NFQWS_OPT_DESYNC_HTTP6:-$NFQWS_OPT_DESYNC_HTTP}"
NFQWS_OPT_DESYNC_HTTPS6="${NFQWS_OPT_DESYNC_HTTPS6:-$NFQWS_OPT_DESYNC_HTTPS}"
[ -n "$TPPORT" ] || TPPORT=988 [ -n "$TPPORT" ] || TPPORT=988
[ -n "$WS_USER" ] || WS_USER=daemon [ -n "$TPWS" ] || TPWS="$ZAPRET_BASE/tpws/tpws"
TPWS_LOCALHOST4=127.0.0.127 TPWS_LOCALHOST4=127.0.0.127
HOSTLIST="$ZAPRET_BASE/ipset/zapret-hosts.txt.gz"
[ -f "$HOSTLIST" ] || HOSTLIST="$ZAPRET_BASE/ipset/zapret-hosts.txt"
[ -f "$HOSTLIST" ] || HOSTLIST="$ZAPRET_BASE/ipset/zapret-hosts-user.txt"
TPWS_OPT_BASE="$USEROPT"
TPWS_OPT_BASE4="--bind-addr=$TPWS_LOCALHOST4"
TPWS_OPT_BASE6="--bind-addr=::1"
TPWS_WAIT="--bind-wait-ifup=30 --bind-wait-ip=30"
TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
# first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case
TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3"
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000 [ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
[ -n "$OPENWRT_LAN" ] || OPENWRT_LAN=lan
# max wait time for the link local ipv6 on the LAN interface # max wait time for the link local ipv6 on the LAN interface
LINKLOCAL_WAIT_SEC=5 LINKLOCAL_WAIT_SEC=5
IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh" CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/sysv/custom"
CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/openwrt/custom"
[ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT" [ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT"
IPSET_EXCLUDE="-m set ! --match-set nozapret" IPSET_EXCLUDE="-m set ! --match-set nozapret"
IPSET_EXCLUDE6="-m set ! --match-set nozapret6" IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
NFQWS_OPT_DESYNC_HTTP="${NFQWS_OPT_DESYNC_HTTP:-$NFQWS_OPT_DESYNC}"
NFQWS_OPT_DESYNC_HTTPS="${NFQWS_OPT_DESYNC_HTTPS:-$NFQWS_OPT_DESYNC}"
NFQWS_OPT_DESYNC_HTTP6="${NFQWS_OPT_DESYNC_HTTP6:-$NFQWS_OPT_DESYNC_HTTP}"
NFQWS_OPT_DESYNC_HTTPS6="${NFQWS_OPT_DESYNC_HTTPS6:-$NFQWS_OPT_DESYNC_HTTPS}"
exists() on_off_function()
{
which "$1" >/dev/null 2>/dev/null
}
existf()
{ {
type "$1" >/dev/null 2>/dev/null # $1 : function name on
# $2 : function name off
# $3 : 0 - off, 1 - on
local F="$1"
[ "$3" = "1" ] || F="$2"
shift
shift
shift
"$F" "$@"
} }
# can be multiple ipv6 outgoing interfaces
# uplink from isp, tunnelbroker, vpn, ...
# want them all. who knows what's the real one that blocks sites
# dont want any manual configuration - want to do it automatically
# standard network_find_wan[6] return only the first
# we use low level function from network.sh to avoid this limitation
# it can change theoretically and stop working
network_find_wan_all()
{
__network_ifstatus "$1" "" "[@.route[@.target='0.0.0.0' && [email protected]]].interface" "" 10 2>/dev/null && return
network_find_wan $1
}
network_find_wan6_all()
{
__network_ifstatus "$1" "" "[@.route[@.target='::' && [email protected]]].interface" "" 10 2>/dev/null && return
network_find_wan6 $1
}
ipt() ipt()
{ {
iptables -C "$@" >/dev/null 2>/dev/null || iptables -I "$@" iptables -C "$@" >/dev/null 2>/dev/null || iptables -I "$@"
@ -63,6 +133,10 @@ ipt_del()
{ {
iptables -C "$@" >/dev/null 2>/dev/null && iptables -D "$@" iptables -C "$@" >/dev/null 2>/dev/null && iptables -D "$@"
} }
ipt_add_del()
{
on_off_function ipt ipt_del "$@"
}
ipt6() ipt6()
{ {
ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -I "$@" ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -I "$@"
@ -71,6 +145,10 @@ ipt6_del()
{ {
ip6tables -C "$@" >/dev/null 2>/dev/null && ip6tables -D "$@" ip6tables -C "$@" >/dev/null 2>/dev/null && ip6tables -D "$@"
} }
ipt6_add_del()
{
on_off_function ipt6 ipt6_del "$@"
}
# there's no route_localnet for ipv6 # there's no route_localnet for ipv6
# the best we can is to route to link local of the incoming interface # the best we can is to route to link local of the incoming interface
@ -80,212 +158,355 @@ ipt6_del()
get_ipv6_linklocal() get_ipv6_linklocal()
{ {
# $1 - interface name. if empty - any interface # $1 - interface name. if empty - any interface
if exists ip ; then local dev
local dev [ -n "$1" ] && dev="dev $1"
[ -n "$1" ] && dev="dev $1" ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope link.*$/\1/;t;d' | head -n 1
ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope link.*$/\1/;t;d' | head -n 1
else
ifconfig $1 | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Link.*$/\1/;t;d' | head -n 1
fi
} }
get_ipv6_global() get_ipv6_global()
{ {
# $1 - interface name. if empty - any interface # $1 - interface name. if empty - any interface
if exists ip ; then local dev
local dev [ -n "$1" ] && dev="dev $1"
[ -n "$1" ] && dev="dev $1" ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope global.*$/\1/;t;d' | head -n 1
ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope global.*$/\1/;t;d' | head -n 1
else
ifconfig $1 | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Global.*$/\1/;t;d' | head -n 1
fi
} }
dnat6_target() iface_is_up()
{
# $1 - interface name
[ -f /sys/class/net/$1/operstate ] || return
local state
read state </sys/class/net/$1/operstate
[ "$state" != "down" ]
}
wait_ifup()
{ {
# $1 - lan network name # $1 - interface name
# $2 - var to store target ip6 local ct=0
# get target ip address for DNAT. prefer link locals while
# tpws should be as inaccessible from outside as possible iface_is_up $1 && return
# link local address can appear not immediately after ifup [ "$ct" -ge "$IFUP_WAIT_SEC" ] && break
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts) echo waiting for ifup of $1 for another $(($IFUP_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1 sleep 1
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g') do :; done
eval DNAT6_TARGET="\$$DVAR" false
[ -n "$2" ] && eval $2=''
[ -n "$DNAT6_TARGET" ] || {
# no reason to query if its down
network_is_up $1 || return
local DEVICE
network_get_device DEVICE $1
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $DEVICE)
[ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo $DEVICE: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
sleep 1
do :; done
[ -n "$DNAT6_TARGET" ] || {
echo $DEVICE: no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
[ -n "$DNAT6_TARGET" ] || {
echo $DEVICE: could not get any address
DNAT6_TARGET=-
}
}
eval $DVAR="$DNAT6_TARGET"
}
[ -n "$2" ] && eval $2="$DNAT6_TARGET"
} }
fw_nfqws_pre4() dnat6_target()
{ {
# $1 - filter ipv4 # $1 - lan network name
# $2 - queue number # $2 - var to store target ip6
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g')
eval DNAT6_TARGET="\$$DVAR"
[ -n "$2" ] && eval $2=''
[ -n "$DNAT6_TARGET" ] || {
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $1)
[ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo $1: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
sleep 1
do :; done
[ -n "$DNAT6_TARGET" ] || {
echo $1: no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $1)
[ -n "$DNAT6_TARGET" ] || {
echo $1: could not get any address
DNAT6_TARGET=-
}
}
eval $DVAR="$DNAT6_TARGET"
}
[ -n "$2" ] && eval $2="$DNAT6_TARGET"
}
local DEVICE wan_iface prepare_tpws_fw4()
{
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
# NOTE : kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8
[ -n "$IFACE_LAN" ] && {
iptables -N input_rule_zapret 2>/dev/null
iptables -F input_rule_zapret
iptables -A input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
iptables -A input_rule_zapret -d 127.0.0.0/8 -j DROP
for lan in $IFACE_LAN ; do
ipt INPUT -i $lan -j input_rule_zapret
sysctl -q -w net.ipv4.conf.$lan.route_localnet=1
done
}
}
unprepare_tpws_fw4()
{
[ -n "$IFACE_LAN" ] && {
for lan in $IFACE_LAN ; do
ipt_del INPUT -i $lan -j input_rule_zapret
sysctl -q -w net.ipv4.conf.$lan.route_localnet=0
done
iptables -F input_rule_zapret 2>/dev/null
iptables -X input_rule_zapret 2>/dev/null
}
}
unprepare_tpws_fw()
{
unprepare_tpws_fw4
}
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface print_op()
for ext_iface in $wan_iface; do {
network_get_device DEVICE $ext_iface if [ "$1" = "1" ]; then
ipt PREROUTING -t mangle -i $DEVICE -p tcp $1 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $2 --queue-bypass echo "Adding ip$4tables rule for $3 : $2"
done else
} echo "Deleting ip$4tables rule for $3 : $2"
fi
} }
fw_nfqws_pre6()
fw_tpws4()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - tpws port
[ "$DISABLE_IPV4" = "1" ] || {
[ "$1" = 1 ] && prepare_tpws_fw4
print_op $1 "$2" "tpws (port $3)"
for lan in $IFACE_LAN ; do
ipt_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
done
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
done
else
ipt_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
fi
}
}
fw_tpws6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - tpws port
[ "$DISABLE_IPV6" = "1" ] || {
print_op $1 "$2" "tpws (port $3)" 6
local DNAT6
for lan in $IFACE_LAN ; do
dnat6_target $lan DNAT6
[ "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6]:$3
done
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt6_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
done
else
ipt6_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
fi
}
}
fw_tpws()
{ {
# $1 - filter ipv6 # $1 - 1 - add, 0 - del
# $2 - queue number # $2 - iptable filter for ipv4
# $3 - iptable filter for ipv6
# $4 - tpws port
fw_tpws4 $1 "$2" $4
fw_tpws6 $1 "$3" $4
}
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || { fw_nfqws_pre4()
network_find_wan6_all wan_iface {
for ext_iface in $wan_iface; do # $1 - 1 - add, 0 - del
network_get_device DEVICE $ext_iface # $2 - iptable filter for ipv4
ipt6 PREROUTING -t mangle -i $DEVICE -p tcp $1 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $2 --queue-bypass # $3 - queue number
done [ "$DISABLE_IPV4" = "1" ] || {
} print_op $1 "$2" "nfqws prerouting (qnum $3)"
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
done
else
ipt_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
fi
}
}
fw_nfqws_pre6()
{
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - queue number
[ "$DISABLE_IPV6" = "1" ] || {
print_op $1 "$2" "nfqws prerouting (qnum $3)" 6
if [ -n "$IFACE_WAN" ]; then
for wan in $IFACE_WAN; do
ipt6_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
done
else
ipt6_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
fi
}
} }
fw_nfqws_pre() fw_nfqws_pre()
{ {
# $1 - filter ipv4 # $1 - 1 - add, 0 - del
# $2 - filter ipv6 # $2 - iptable filter for ipv4
# $3 - queue number # $3 - iptable filter for ipv6
# $4 - queue number
fw_nfqws_pre4 "$1" $3 fw_nfqws_pre4 $1 "$2" $4
fw_nfqws_pre6 "$2" $3 fw_nfqws_pre6 $1 "$3" $4
} }
fw_nfqws_post4() fw_nfqws_post4()
{ {
# $1 - filter ipv4 # $1 - 1 - add, 0 - del
# $2 - queue number # $2 - iptable filter for ipv4
# $3 - queue number
local DEVICE wan_iface [ "$DISABLE_IPV4" = "1" ] || {
print_op $1 "$2" "nfqws postrouting (qnum $3)"
[ "$DISABLE_IPV4" = "1" ] || { if [ -n "$IFACE_WAN" ]; then
network_find_wan_all wan_iface for wan in $IFACE_WAN; do
for ext_iface in $wan_iface; do ipt_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
network_get_device DEVICE $ext_iface done
ipt POSTROUTING -t mangle -o $DEVICE -p tcp $1 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $2 --queue-bypass else
done ipt_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
} fi
}
} }
fw_nfqws_post6() fw_nfqws_post6()
{ {
# $1 - filter ipv6 # $1 - 1 - add, 0 - del
# $2 - queue number # $2 - iptable filter for ipv6
# $3 - queue number
local DEVICE wan_iface [ "$DISABLE_IPV6" = "1" ] || {
print_op $1 "$2" "nfqws postrouting (qnum $3)" 6
[ "$DISABLE_IPV6" = "1" ] || { if [ -n "$IFACE_WAN" ]; then
network_find_wan6_all wan_iface for wan in $IFACE_WAN; do
for ext_iface in $wan_iface; do ipt6_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
network_get_device DEVICE $ext_iface done
ipt6 POSTROUTING -t mangle -o $DEVICE -p tcp $1 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $2 --queue-bypass else
done ipt6_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
} fi
}
} }
fw_nfqws_post() fw_nfqws_post()
{ {
# $1 - filter ipv4 # $1 - 1 - add, 0 - del
# $2 - filter ipv6 # $2 - iptable filter for ipv4
# $3 - queue number # $3 - iptable filter for ipv6
# $4 - queue number
fw_nfqws_post4 $1 "$2" $4
fw_nfqws_post6 $1 "$3" $4
}
run_daemon()
{
# $1 - daemon number : 1,2,3,...
# $2 - daemon
# $3 - daemon args
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
fw_nfqws_post4 "$1" $3 local DAEMONBASE=$(basename $2)
fw_nfqws_post6 "$2" $3 local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
echo "Starting daemon $1: $2 $3"
if exists start-stop-daemon ; then
start-stop-daemon -S -p "$PIDFILE" -m -b -x "$2" -- $3
else
if [ -f "$PIDFILE" ] && pgrep -F "$PIDFILE" "$DAEMONBASE" >/dev/null; then
echo already running
else
"$2" $3 >/dev/null 2>/dev/null &
PID=$!
if [ -n "$PID" ]; then
echo $PID >$PIDFILE
else
echo could not start daemon $1 : $2 $3
false
fi
fi
fi
}
stop_daemon()
{
# $1 - daemon number : 1,2,3,...
# $2 - daemon
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
local DAEMONBASE=$(basename $2)
local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
echo "Stopping daemon $1: $2"
if exists start-stop-daemon ; then
start-stop-daemon -K -p "$PIDFILE" -x "$2"
else
if [ -f "$PIDFILE" ]; then
read PID <"$PIDFILE"
kill $PID
rm -f "$PIDFILE"
else
echo no pidfile : $PIDFILE
fi
fi
}
do_daemon()
{
# $1 - 1 - run, 0 - stop
on_off_function run_daemon stop_daemon "$@"
} }
IPT_OWNER="-m owner ! --uid-owner $WS_USER" do_tpws()
fw_tpws4()
{ {
# $1 - filter ipv6 # $1 : 1 - run, 0 - stop
# $2 - tpws port # $2 : daemon number
# $3 : daemon args
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface local OPT="$TPWS_OPT_BASE"
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface [ "$DISABLE_IPV4" = "1" ] || OPT="$OPT $TPWS_OPT_BASE4"
ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $1 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$2 [ "$DISABLE_IPV6" = "1" ] || {
done OPT="$OPT $TPWS_OPT_BASE6"
for lan in $IFACE_LAN; do
# allow localnet route only to special tpws IP OPT="$OPT --bind-iface6=$lan $TPWS_OPT_BASE6_PRE"
iptables -N input_rule_zapret 2>/dev/null done
ipt input_rule_zapret -d 127.0.0.0/8 -j DROP }
ipt input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
do_daemon $1 $2 "$TPWS" "$OPT $3"
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
ipt prerouting_rule -t nat -i $DEVICE -p tcp $1 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$2
ipt input_rule -i $DEVICE -j input_rule_zapret
sysctl -qw net.ipv4.conf.$DEVICE.route_localnet=1
done
}
} }
fw_tpws6() do_tpws_socks()
{ {
# $1 - filter ipv6 # $1 : 1 - run, 0 - stop
# $2 - tpws port # $2 : daemon number
# $3 : daemon args
local DEVICE wan_iface DNAT6
[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface local opt="$TPWS_OPT_BASE --socks"
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface tpws_apply_socks_binds opt
ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $1 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$2
done do_daemon $1 $2 "$TPWS" "$opt $3"
for lan in $OPENWRT_LAN; do
network_get_device DEVICE $lan
[ -n "$DEVICE" ] || continue
dnat6_target $lan DNAT6
[ "$DNAT6" != '-' ] && ipt6 PREROUTING -t nat -i $DEVICE -p tcp $1 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6]:$2
done
}
} }
fw_tpws()
do_nfqws()
{ {
# $1 - filter ipv4 # $1 : 1 - run, 0 - stop
# $2 - filter ipv6 # $2 : daemon number
# $3 - tpws port # $3 : daemon args
fw_tpws4 "$1" $3 do_daemon $1 $2 "$NFQWS" "$NFQWS_OPT_BASE $3"
fw_tpws6 "$2" $3
} }
filter_apply_port_target() filter_apply_port_target()
{ {
# $1 - var name of iptables filter # $1 - var name of iptables filter
@ -301,6 +522,7 @@ filter_apply_port_target()
fi fi
eval $1="\"\$$1 $f\"" eval $1="\"\$$1 $f\""
} }
filter_apply_ipset_target4() filter_apply_ipset_target4()
{ {
# $1 - var name of ipv4 iptables filter # $1 - var name of ipv4 iptables filter
@ -322,6 +544,11 @@ filter_apply_ipset_target()
filter_apply_ipset_target4 $1 filter_apply_ipset_target4 $1
filter_apply_ipset_target6 $2 filter_apply_ipset_target6 $2
} }
filter_apply_hostlist_target()
{
# $1 - var name of tpws or nfqws params
[ "$MODE_FILTER" = "hostlist" ] && eval $1="\"\$$1 --hostlist=$HOSTLIST\""
}
get_nfqws_qnums() get_nfqws_qnums()
{ {
@ -329,7 +556,7 @@ get_nfqws_qnums()
# $2 - var name for ipv4 https # $2 - var name for ipv4 https
# $3 - var name for ipv6 http # $3 - var name for ipv6 http
# $4 - var name for ipv6 https # $4 - var name for ipv6 https
local _qn=x _qns=x _qn6=x _qns6=x local _qn _qns _qn6 _qns6
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
_qn=$QNUM _qn=$QNUM
@ -353,99 +580,49 @@ get_nfqws_qnums()
} }
[ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP6" ] && _qns6=$_qn6; [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP6" ] && _qns6=$_qn6;
} }
eval $1=$_qn [ "$MODE_HTTP" = 1 ] && {
eval $2=$_qns eval $1=$_qn
eval $3=$_qn6 eval $3=$_qn6
eval $4=$_qns6 }
[ "$MODE_HTTPS" = 1 ] && {
eval $2=$_qns
eval $4=$_qns6
}
} }
create_ipset() tpws_apply_socks_binds()
{ {
echo "Creating ipset" local o
"$IPSET_CR" "$@"
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1"
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-addr=::1"
for lan in $IFACE_LAN; do
[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT"
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
done
eval $1="\"\$$1 $o\""
} }
is_flow_offload_avail() create_ipset()
{
# $1 = '' for ipv4, '6' for ipv6
grep -q FLOWOFFLOAD /proc/net/ip$1_tables_targets
}
list_nfqws_rules()
{
# $1 = '' for ipv4, '6' for ipv6
ip$1tables -S POSTROUTING -t mangle | \
grep -E "NFQUEUE --queue-num $QNUM --queue-bypass|NFQUEUE --queue-num $(($QNUM+1)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+2)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+3)) --queue-bypass" | \
sed -re 's/^-A POSTROUTING (.*) -j NFQUEUE.*$/\1/' -e "s/-m mark ! --mark $DESYNC_MARK\/$DESYNC_MARK//"
}
reverse_nfqws_rule()
{
sed -e 's/-o /-i /' -e 's/--dport /--sport /' -e 's/--dports /--sports /' -e 's/ dst$/ src/' -e 's/ dst / src /'
}
apply_flow_offloading_enable_rule()
{
# $1 = '' for ipv4, '6' for ipv6
local i off='-j FLOWOFFLOAD'
[ "$FLOWOFFLOAD" = "hardware" ] && off="$off --hw"
i="forwarding_rule_zapret -m comment --comment zapret_traffic_offloading_enable -m conntrack --ctstate RELATED,ESTABLISHED $off"
echo enabling ipv${1:-4} flow offloading : $i
ip$1tables -A $i
}
apply_flow_offloading_exempt_rule()
{ {
# $1 = '' for ipv4, '6' for ipv6 echo "Creating ipset"
local i v "$IPSET_CR" "$@"
v=$1
shift
i="forwarding_rule_zapret $@ -m comment --comment zapret_traffic_offloading_exemption -j RETURN"
echo applying ipv${v:-4} flow offloading exemption : $i
ip${v}tables -A $i
} }
flow_offloading_exempt_v()
{
# $1 = '' for ipv4, '6' for ipv6
is_flow_offload_avail $1 || return 0
ipt$1_del forwarding_rule -j forwarding_rule_zapret
ip$1tables -F forwarding_rule_zapret 2>/dev/null
ip$1tables -X forwarding_rule_zapret 2>/dev/null
[ "$FLOWOFFLOAD" = 'software' -o "$FLOWOFFLOAD" = 'hardware' ] && {
ip$1tables -N forwarding_rule_zapret
list_nfqws_rules $1 |
while read rule; do
apply_flow_offloading_exempt_rule "$1" $rule
done
list_nfqws_rules $1 | grep -v "connbytes" | reverse_nfqws_rule | zapret_do_firewall()
while read rule; do
apply_flow_offloading_exempt_rule "$1" $rule
done
apply_flow_offloading_enable_rule $1
ipt$1 forwarding_rule -j forwarding_rule_zapret
}
return 0
}
flow_offloading_exempt()
{ {
[ "$DISABLE_IPV4" = "1" ] || flow_offloading_exempt_v # $1 - 1 - add, 0 - del
[ "$DISABLE_IPV6" = "1" ] || flow_offloading_exempt_v 6
}
zapret_apply_firewall()
{
local first_packet_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:4" local first_packet_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:4"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
local f4 f6 qn qns qn6 qns6 local f4 f6 qn qns qn6 qns6
# always create ipsets. ip_exclude ipset is required # always create ipsets. ip_exclude ipset is required
create_ipset no-update [ "$1" != "1" ] || create_ipset no-update
case "${MODE}" in case "${MODE}" in
tpws) tpws)
@ -455,60 +632,123 @@ zapret_apply_firewall()
filter_apply_port_target f4 filter_apply_port_target f4
f6=$f4 f6=$f4
filter_apply_ipset_target f4 f6 filter_apply_ipset_target f4 f6
fw_tpws "$f4" "$f6" $TPPORT fw_tpws $1 "$f4" "$f6" $TPPORT
fi fi
;; ;;
nfqws) nfqws)
# quite complex but we need to minimize nfqws processes to save RAM
if [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ]; then if [ ! "$MODE_HTTP" = "1" ] && [ ! "$MODE_HTTPS" = "1" ]; then
echo both http and https are disabled. not applying redirection. echo both http and https are disabled. not applying redirection.
else else
get_nfqws_qnums qn qns qn6 qns6 get_nfqws_qnums qn qns qn6 qns6
if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ $qn = $qns ]; then if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn" ] && [ "$qn" = "$qns" ]; then
filter_apply_port_target f4 filter_apply_port_target f4
f4="$f4 $first_packet_only" f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 "$f4 $desync" $qn fw_nfqws_post4 $1 "$f4 $desync" $qn
else else
if [ "$MODE_HTTP" = "1" ]; then if [ -n "$qn" ]; then
f4="--dport 80" f4="--dport 80"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packet_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 "$f4 $desync" $qn fw_nfqws_post4 $1 "$f4 $desync" $qn
fi fi
if [ "$MODE_HTTPS" = "1" ]; then if [ -n "$qns" ]; then
f4="--dport 443 $first_packet_only" f4="--dport 443 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 "$f4 $desync" $qns fw_nfqws_post4 $1 "$f4 $desync" $qns
fi fi
fi fi
if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ $qn6 = $qns6 ]; then if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn6" ] && [ "$qn6" = "$qns6" ]; then
filter_apply_port_target f6 filter_apply_port_target f6
f6="$f6 $first_packet_only" f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 "$f6 $desync" $qn6 fw_nfqws_post6 $1 "$f6 $desync" $qn6
else else
if [ "$MODE_HTTP" = "1" ]; then if [ -n "$qn6" ]; then
f6="--dport 80" f6="--dport 80"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packet_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 "$f6 $desync" $qn6 fw_nfqws_post6 $1 "$f6 $desync" $qn6
fi fi
if [ "$MODE_HTTPS" = "1" ]; then if [ -n "$qns6" ]; then
f6="--dport 443 $first_packet_only" f6="--dport 443 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 "$f6 $desync" $qns6 fw_nfqws_post6 $1 "$f6 $desync" $qns6
fi fi
fi fi
fi fi
;; ;;
custom) custom)
existf zapret_custom_firewall && zapret_custom_firewall existf zapret_custom_firewall && zapret_custom_firewall $1
;; ;;
esac esac
[ "$1" = 0 ] && unprepare_tpws_fw
return 0
}
zapret_apply_firewall()
{
zapret_do_firewall 1 "$@"
}
zapret_unapply_firewall()
{
zapret_do_firewall 0 "$@"
}
flow_offloading_exempt zapret_do_daemons()
{
# $1 - 1 - run, 0 - stop
local opt qn qns qn6 qns6
case "${MODE}" in
tpws)
opt="--port=$TPPORT $TPWS_OPT"
filter_apply_hostlist_target opt
do_tpws $1 1 "$opt"
;;
tpws-socks)
opt="--port=$TPPORT $TPWS_OPT"
filter_apply_hostlist_target opt
do_tpws_socks $1 1 "$opt"
;;
nfqws)
get_nfqws_qnums qn qns qn6 qns6
[ -z "$qn" ] || {
opt="--qnum=$qn $NFQWS_OPT_DESYNC_HTTP"
filter_apply_hostlist_target opt
do_nfqws $1 1 "$opt"
}
[ -z "$qns" ] || [ "$qns" = "$qn" ] || {
opt="--qnum=$qns $NFQWS_OPT_DESYNC_HTTPS"
filter_apply_hostlist_target opt
do_nfqws $1 2 "$opt"
}
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
opt="--qnum=$qn6 $NFQWS_OPT_DESYNC_HTTP6"
filter_apply_hostlist_target opt
do_nfqws $1 3 "$opt"
}
[ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
opt="--qnum=$qns6 $NFQWS_OPT_DESYNC_HTTPS6"
filter_apply_hostlist_target opt
do_nfqws $1 4 "$opt"
}
;;
custom)
existf zapret_custom_daemons && zapret_custom_daemons $1
;;
esac
return 0 return 0
} }
zapret_run_daemons()
{
zapret_do_daemons 1 "$@"
}
zapret_stop_daemons()
{
zapret_do_daemons 0 "$@"
}

32
init.d/openwrt/zapret
View File

@ -121,27 +121,25 @@ start_service() {
nfqws) nfqws)
# quite complex but we need to minimize nfqws processes to save RAM # quite complex but we need to minimize nfqws processes to save RAM
get_nfqws_qnums qn qns qn6 qns6 get_nfqws_qnums qn qns qn6 qns6
[ "$DISABLE_IPV4" = "1" ] || { [ -z "$qn" ] || {
opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP" opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
run_daemon 1 "$NFQWS" "$opt" run_daemon 1 "$NFQWS" "$opt"
[ "$qns" = "$qn" ] || {
opt="--qnum=$qns $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS"
filter_apply_hostlist_target opt
run_daemon 2 "$NFQWS" "$opt"
}
} }
[ "$DISABLE_IPV6" = "1" ] || { [ -z "$qns" ] || [ "$qns" = "$qn" ] || {
[ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || { opt="--qnum=$qns $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS"
opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP6" filter_apply_hostlist_target opt
filter_apply_hostlist_target opt run_daemon 2 "$NFQWS" "$opt"
run_daemon 3 "$NFQWS" "$opt" }
} [ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
[ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || { opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP6"
opt="--qnum=$qns6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS6" filter_apply_hostlist_target opt
filter_apply_hostlist_target opt run_daemon 3 "$NFQWS" "$opt"
run_daemon 4 "$NFQWS" "$opt" }
} [ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
opt="--qnum=$qns6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS6"
filter_apply_hostlist_target opt
run_daemon 4 "$NFQWS" "$opt"
} }
;; ;;
custom) custom)

58
init.d/sysv/functions
View File

@ -556,7 +556,7 @@ get_nfqws_qnums()
# $2 - var name for ipv4 https # $2 - var name for ipv4 https
# $3 - var name for ipv6 http # $3 - var name for ipv6 http
# $4 - var name for ipv6 https # $4 - var name for ipv6 https
local _qn=x _qns=x _qn6=x _qns6=x local _qn _qns _qn6 _qns6
[ "$DISABLE_IPV4" = "1" ] || { [ "$DISABLE_IPV4" = "1" ] || {
_qn=$QNUM _qn=$QNUM
@ -580,10 +580,14 @@ get_nfqws_qnums()
} }
[ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP6" ] && _qns6=$_qn6; [ "$NFQWS_OPT_DESYNC_HTTPS6" = "$NFQWS_OPT_DESYNC_HTTP6" ] && _qns6=$_qn6;
} }
eval $1=$_qn [ "$MODE_HTTP" = 1 ] && {
eval $2=$_qns eval $1=$_qn
eval $3=$_qn6 eval $3=$_qn6
eval $4=$_qns6 }
[ "$MODE_HTTPS" = 1 ] && {
eval $2=$_qns
eval $4=$_qns6
}
} }
tpws_apply_socks_binds() tpws_apply_socks_binds()
@ -637,37 +641,37 @@ zapret_do_firewall()
echo both http and https are disabled. not applying redirection. echo both http and https are disabled. not applying redirection.
else else
get_nfqws_qnums qn qns qn6 qns6 get_nfqws_qnums qn qns qn6 qns6
if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ $qn = $qns ]; then if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn" ] && [ "$qn" = "$qns" ]; then
filter_apply_port_target f4 filter_apply_port_target f4
f4="$f4 $first_packet_only" f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qn fw_nfqws_post4 $1 "$f4 $desync" $qn
else else
if [ "$MODE_HTTP" = "1" ]; then if [ -n "$qn" ]; then
f4="--dport 80" f4="--dport 80"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packet_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f4="$f4 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qn fw_nfqws_post4 $1 "$f4 $desync" $qn
fi fi
if [ "$MODE_HTTPS" = "1" ]; then if [ -n "$qns" ]; then
f4="--dport 443 $first_packet_only" f4="--dport 443 $first_packet_only"
filter_apply_ipset_target4 f4 filter_apply_ipset_target4 f4
fw_nfqws_post4 $1 "$f4 $desync" $qns fw_nfqws_post4 $1 "$f4 $desync" $qns
fi fi
fi fi
if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ $qn6 = $qns6 ]; then if [ "$MODE_HTTP_KEEPALIVE" != "1" ] && [ -n "$qn6" ] && [ "$qn6" = "$qns6" ]; then
filter_apply_port_target f6 filter_apply_port_target f6
f6="$f6 $first_packet_only" f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qn6 fw_nfqws_post6 $1 "$f6 $desync" $qn6
else else
if [ "$MODE_HTTP" = "1" ]; then if [ -n "$qn6" ]; then
f6="--dport 80" f6="--dport 80"
[ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packet_only" [ "$MODE_HTTP_KEEPALIVE" = "1" ] || f6="$f6 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qn6 fw_nfqws_post6 $1 "$f6 $desync" $qn6
fi fi
if [ "$MODE_HTTPS" = "1" ]; then if [ -n "$qns6" ]; then
f6="--dport 443 $first_packet_only" f6="--dport 443 $first_packet_only"
filter_apply_ipset_target6 f6 filter_apply_ipset_target6 f6
fw_nfqws_post6 $1 "$f6 $desync" $qns6 fw_nfqws_post6 $1 "$f6 $desync" $qns6
@ -711,27 +715,25 @@ zapret_do_daemons()
;; ;;
nfqws) nfqws)
get_nfqws_qnums qn qns qn6 qns6 get_nfqws_qnums qn qns qn6 qns6
[ "$DISABLE_IPV4" = "1" ] || { [ -z "$qn" ] || {
opt="--qnum=$qn $NFQWS_OPT_DESYNC_HTTP" opt="--qnum=$qn $NFQWS_OPT_DESYNC_HTTP"
filter_apply_hostlist_target opt filter_apply_hostlist_target opt
do_nfqws $1 1 "$opt" do_nfqws $1 1 "$opt"
[ "$qns" = "$qn" ] || {
opt="--qnum=$qns $NFQWS_OPT_DESYNC_HTTPS"
filter_apply_hostlist_target opt
do_nfqws $1 2 "$opt"
}
} }
[ "$DISABLE_IPV6" = "1" ] || { [ -z "$qns" ] || [ "$qns" = "$qn" ] || {
[ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || { opt="--qnum=$qns $NFQWS_OPT_DESYNC_HTTPS"
opt="--qnum=$qn6 $NFQWS_OPT_DESYNC_HTTP6" filter_apply_hostlist_target opt
filter_apply_hostlist_target opt do_nfqws $1 2 "$opt"
do_nfqws $1 3 "$opt" }
} [ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
[ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || { opt="--qnum=$qn6 $NFQWS_OPT_DESYNC_HTTP6"
opt="--qnum=$qns6 $NFQWS_OPT_DESYNC_HTTPS6" filter_apply_hostlist_target opt
filter_apply_hostlist_target opt do_nfqws $1 3 "$opt"
do_nfqws $1 4 "$opt" }
} [ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
opt="--qnum=$qns6 $NFQWS_OPT_DESYNC_HTTPS6"
filter_apply_hostlist_target opt
do_nfqws $1 4 "$opt"
} }
;; ;;
custom) custom)

Write Preview
Loading…
Cancel
Save