mirror of https://github.com/bol-van/zapret/
bol-van
6 months ago
34 changed files with 436 additions and 272 deletions
@ -0,0 +1,25 @@ |
|||||
|
custom_runner() |
||||
|
{ |
||||
|
# $1 - function name |
||||
|
# $2+ - params |
||||
|
|
||||
|
local n script FUNC=$1 |
||||
|
|
||||
|
shift |
||||
|
|
||||
|
[ -f "$CUSTOM_DIR/custom" ] && { |
||||
|
unset -f $FUNC |
||||
|
. "$CUSTOM_DIR/custom" |
||||
|
existf $FUNC && $FUNC "$@" |
||||
|
} |
||||
|
[ -d "$CUSTOM_DIR/custom.d" ] && { |
||||
|
n=$(ls "$CUSTOM_DIR/custom.d" | wc -c | xargs) |
||||
|
[ "$n" = 0 ] || { |
||||
|
for script in "$CUSTOM_DIR/custom.d/"*; do |
||||
|
unset -f $FUNC |
||||
|
. "$script" |
||||
|
existf $FUNC && $FUNC "$@" |
||||
|
done |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,18 @@ |
|||||
|
# this custom script applies tpws mode as it would be with MODE=tpws |
||||
|
|
||||
|
OVERRIDE=tpws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall_v4() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4 |
||||
|
} |
||||
|
zapret_custom_firewall_v6() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6 |
||||
|
} |
||||
@ -0,0 +1,18 @@ |
|||||
|
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
||||
|
|
||||
|
OVERRIDE=tpws-socks |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall_v4() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4 |
||||
|
} |
||||
|
zapret_custom_firewall_v6() |
||||
|
{ |
||||
|
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6 |
||||
|
} |
||||
@ -1,21 +0,0 @@ |
|||||
# this script contain your special code to launch daemons and configure firewall |
|
||||
# use helpers from "functions" file |
|
||||
# in case of upgrade keep this file only, do not modify others |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
: |
|
||||
} |
|
||||
|
|
||||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors |
|
||||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ... |
|
||||
|
|
||||
zapret_custom_firewall_v4() |
|
||||
{ |
|
||||
: |
|
||||
} |
|
||||
zapret_custom_firewall_v6() |
|
||||
{ |
|
||||
: |
|
||||
} |
|
||||
@ -1,47 +0,0 @@ |
|||||
# this custom script demonstrates how to reuse built-in modes and add something from yourself |
|
||||
|
|
||||
MY_TPPORT=$(($TPPORT + 1)) |
|
||||
MY_TPWS_OPT="--methodeol --hostcase" |
|
||||
MY_DPORT=81 |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# stop logic is managed by procd |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local opt |
|
||||
|
|
||||
start_daemons_procd |
|
||||
|
|
||||
opt="--port=$MY_TPPORT $MY_TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
run_tpws 100 "$opt" |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f4="-p tcp --dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f4="tcp dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies nfqws mode as it would be with MODE=nfqws |
||||
|
|
||||
|
OVERRIDE=nfqws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# stop logic is managed by procd |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws mode as it would be with MODE=tpws |
||||
|
|
||||
|
OVERRIDE=tpws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
||||
|
|
||||
|
OVERRIDE=tpws-socks |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE start_daemons_procd |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
File diff suppressed because one or more lines are too long
@ -1,33 +0,0 @@ |
|||||
# this script contain your special code to launch daemons and configure firewall |
|
||||
# use helpers from "functions" file and "zapret" init script |
|
||||
# in case of upgrade keep this file only, do not modify others |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# stop logic is managed by procd |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Start daemon\(s\) |
|
||||
echo Study how other sections work |
|
||||
|
|
||||
run_daemon 1 /bin/sleep 20 |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure iptables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure nftables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
@ -1,47 +0,0 @@ |
|||||
# this custom script demonstrates how to reuse built-in modes and add something from yourself |
|
||||
|
|
||||
MY_TPPORT=$(($TPPORT + 1)) |
|
||||
MY_TPWS_OPT="--methodeol --hostcase" |
|
||||
MY_DPORT=81 |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local opt |
|
||||
|
|
||||
zapret_do_daemons $1 |
|
||||
|
|
||||
opt="--port=$MY_TPPORT $MY_TPWS_OPT" |
|
||||
filter_apply_hostlist_target opt |
|
||||
do_tpws $1 100 "$opt" |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f4="-p tcp --dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
filter_apply_ipset_target f4 f6 |
|
||||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
local MODE_OVERRIDE=tpws |
|
||||
local f4 f6 |
|
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f4="tcp dport $MY_DPORT" |
|
||||
f6=$f4 |
|
||||
nft_filter_apply_ipset_target f4 f6 |
|
||||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT |
|
||||
} |
|
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies nfqws mode as it would be with MODE=nfqws |
||||
|
|
||||
|
OVERRIDE=nfqws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws mode as it would be with MODE=tpws |
||||
|
|
||||
|
OVERRIDE=tpws |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks |
||||
|
|
||||
|
OVERRIDE=tpws-socks |
||||
|
|
||||
|
zapret_custom_daemons() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1 |
||||
|
} |
||||
|
zapret_custom_firewall() |
||||
|
{ |
||||
|
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1 |
||||
|
} |
||||
|
zapret_custom_firewall_nft() |
||||
|
{ |
||||
|
# stop logic is not required |
||||
|
|
||||
|
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft |
||||
|
} |
||||
@ -1,47 +1,39 @@ |
|||||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering |
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5" |
||||
|
|
||||
QNUM2=$(($QNUM+20)) |
DNUM=101 |
||||
|
QNUM2=$(($DNUM * 5)) |
||||
|
|
||||
zapret_custom_daemons() |
zapret_custom_daemons() |
||||
{ |
{ |
||||
# stop logic is managed by procd |
# stop logic is managed by procd |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
||||
local opt |
do_nfqws $1 $DNUM "$opt" |
||||
|
|
||||
start_daemons_procd |
|
||||
|
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT" |
|
||||
run_daemon 100 $NFQWS "$opt" |
|
||||
} |
} |
||||
zapret_custom_firewall() |
zapret_custom_firewall() |
||||
{ |
{ |
||||
# $1 - 1 - run, 0 - stop |
# $1 - 1 - run, 0 - stop |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f uf4 uf6 |
local f uf4 uf6 |
||||
local first_packet_only="$ipt_connbytes 1:1" |
local first_packet_only="$ipt_connbytes 1:1" |
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" |
||||
|
|
||||
zapret_do_firewall_rules_ipt $1 |
|
||||
|
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32' |
f='-p udp -m length --length 109:407 -m u32 --u32' |
||||
uf4='0>>22&0x3C@8>>16=0x6431' |
uf4='0>>22&0x3C@8>>16=0x6431' |
||||
uf6='48>>16=0x6431' |
uf6='48>>16=0x6431' |
||||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 |
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2 |
||||
|
|
||||
} |
} |
||||
zapret_custom_firewall_nft() |
zapret_custom_firewall_nft() |
||||
{ |
{ |
||||
# stop logic is not required |
# stop logic is not required |
||||
|
|
||||
local MODE_OVERRIDE=nfqws |
|
||||
local f |
local f |
||||
local first_packet_only="$nft_connbytes 1" |
local first_packet_only="$nft_connbytes 1" |
||||
local desync="mark and $DESYNC_MARK == 0" |
local desync="mark and $DESYNC_MARK == 0" |
||||
|
|
||||
zapret_apply_firewall_rules_nft |
|
||||
|
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431" |
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 |
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2 |
||||
} |
} |
||||
|
|
||||
File diff suppressed because one or more lines are too long
@ -1,34 +0,0 @@ |
|||||
# this script contain your special code to launch daemons and configure firewall |
|
||||
# use helpers from "functions" file |
|
||||
# in case of upgrade keep this file only, do not modify others |
|
||||
|
|
||||
zapret_custom_daemons() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Start daemon\(s\) |
|
||||
echo Study how other sections work |
|
||||
|
|
||||
do_daemon $1 1 /bin/sleep 20 |
|
||||
} |
|
||||
zapret_custom_firewall() |
|
||||
{ |
|
||||
# $1 - 1 - run, 0 - stop |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure iptables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
|
|
||||
zapret_custom_firewall_nft() |
|
||||
{ |
|
||||
# stop logic is not required |
|
||||
|
|
||||
# PLACEHOLDER |
|
||||
echo !!! NEED ATTENTION !!! |
|
||||
echo Configure nftables for required actions |
|
||||
echo Study how other sections work |
|
||||
} |
|
||||
Loading…
Reference in new issue